# --------------------------------------------------------------------

#

# Licensed to the Apache Software Foundation (ASF) under one or more

# contributor license agreements. See the NOTICE file distributed

# with this work for additional information regarding copyright

# ownership. The ASF licenses this file to You under the Apache

# License, Version 2.0 (the "License"); you may not use this file

# except in compliance with the License. You may obtain a copy of the

# License at

#

# http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

# implied. See the License for the specific language governing

# permissions and limitations under the License.

#

# --------------------------------------------------------------------

# Multi-stage Dockerfile for Apache Cloudberry Sandbox Environment

# --------------------------------------------------------------------

# This Dockerfile supports two source modes:

# - Main branch: clone the latest main from GitHub (CODEBASE_VERSION=main)

# - Local source: use the repository contents from the Docker build context

# (CODEBASE_VERSION=local), recommended for developers working from

# their current checkout.

# In both modes it compiles and installs Cloudberry, then creates a

# runtime environment for testing and development.

# --------------------------------------------------------------------

# Build stage: Use pre-built image to compile Cloudberry

ARG CODEBASE_VERSION=main

FROM rockylinux/rockylinux:9.6 AS builder

ARG CODEBASE_VERSION

# Install build toolchains and development headers (avoid coreutils/curl conflicts on arm64)

RUN dnf makecache && \

dnf install -y \

epel-release \

git && \

dnf config-manager --disable epel-cisco-openh264 && \

dnf makecache && \

dnf config-manager --disable epel && \

dnf install -y --enablerepo=epel \

the_silver_searcher \

bat \

htop && \

dnf install -y \

bison \

cmake3 \

ed \

file \

flex \

gcc \

gcc-c++ \

gdb \

glibc-langpack-en \

glibc-locale-source \

initscripts \

iproute \

less \

lsof \

m4 \

net-tools \

openssh-clients \

openssh-server \

perl \

rpm-build \

rpmdevtools \

rsync \

sudo \

tar \

unzip \

util-linux-ng \

wget \

sshpass \

which && \

dnf install -y \

apr-devel \

bzip2-devel \

java-11-openjdk \

java-11-openjdk-devel \

krb5-devel \

libcurl-devel \

libevent-devel \

libxml2-devel \

libuuid-devel \

libzstd-devel \

lz4 \

lz4-devel \

openldap-devel \

openssl-devel \

pam-devel \

perl-ExtUtils-Embed \

perl-Test-Simple \

perl-core \

python3-devel \

python3-pytest \

readline-devel \

zlib-devel && \

dnf install -y --enablerepo=crb \

liburing-devel \

libuv-devel \

libyaml-devel \

libicu-devel \

perl-IPC-Run \

protobuf-devel && \

dnf clean all && \

cd && XERCES_LATEST_RELEASE=3.3.0 && \

wget -nv "https://archive.apache.org/dist/xerces/c/3/sources/xerces-c-${XERCES_LATEST_RELEASE}.tar.gz" && \

echo "$(curl -sL https://archive.apache.org/dist/xerces/c/3/sources/xerces-c-${XERCES_LATEST_RELEASE}.tar.gz.sha256)" | sha256sum -c - && \

tar xf "xerces-c-${XERCES_LATEST_RELEASE}.tar.gz"; rm "xerces-c-${XERCES_LATEST_RELEASE}.tar.gz" && \

cd xerces-c-${XERCES_LATEST_RELEASE} && \

./configure --prefix=/usr/local/xerces-c && \

make -j$(nproc) && \

make install -C ~/xerces-c-${XERCES_LATEST_RELEASE} && \

rm -rf ~/xerces-c*

# Create gpadmin user and grant passwordless sudo in builder

RUN groupadd -r gpadmin && \

useradd -m -r -g gpadmin -s /bin/bash gpadmin && \

echo "gpadmin ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/gpadmin && \

chmod 440 /etc/sudoers.d/gpadmin

# Switch to gpadmin user

USER gpadmin

WORKDIR /home/gpadmin

# Copy repository contents from build context

# Note: This COPY always executes regardless of CODEBASE_VERSION due to Docker

# layer caching behavior. For main branch builds, the copied content will be

# removed and replaced by a fresh git clone in the RUN step below. This is an

# acceptable tradeoff to keep the Dockerfile simple and maintainable.

COPY --chown=gpadmin:gpadmin . /home/gpadmin/cloudberry

# Obtain Cloudberry source code based on build mode

RUN if [ "${CODEBASE_VERSION}" = "local" ]; then \

echo "Using local source from build context"; \

else \

rm -rf /home/gpadmin/cloudberry && \

git clone --recurse-submodules --branch main --single-branch --depth=1 https://github.com/apache/cloudberry.git; \

fi

# Build Cloudberry using the official build scripts

RUN cd /home/gpadmin/cloudberry && \

export SRC_DIR=/home/gpadmin/cloudberry && \

mkdir -p ${SRC_DIR}/build-logs && \

./devops/build/automation/cloudberry/scripts/configure-cloudberry.sh && \

./devops/build/automation/cloudberry/scripts/build-cloudberry.sh

# --------------------------------------------------------------------

# Runtime stage: Switch to a slimmer base image (Rocky Linux 9)

# --------------------------------------------------------------------

FROM rockylinux/rockylinux:9.6

# Install required runtime dependencies, SSH server, sudo, and tools

# Note: Use dnf on Rocky Linux 9

RUN dnf -y update && \

dnf -y install \

openssh-server openssh-clients \

sudo shadow-utils \

bash procps-ng \

ca-certificates \

python3 \

apr \

bzip2-libs \

krb5-libs \

libevent \

libicu \

liburing \

libuuid \

libxml2 \

libyaml \

libzstd \

lz4 \

ncurses \

openldap \

openssl \

pam \

pcre2 \

perl \

protobuf \

readline \

zlib \

glibc-langpack-en \

libuv \

iproute \

net-tools \

which \

rsync \

keyutils \

libstdc++ && \

dnf clean all && rm -rf /var/cache/dnf

# Create gpadmin user and group, grant passwordless sudo

RUN groupadd -r gpadmin && \

useradd -m -r -g gpadmin -s /bin/bash gpadmin && \

echo "gpadmin ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/gpadmin && \

chmod 440 /etc/sudoers.d/gpadmin

# Prepare SSH daemon: generate host keys, ensure runtime dir, and allow gpadmin to start it

RUN ssh-keygen -A && mkdir -p /run/sshd && chmod u+s /usr/sbin/sshd

# Copy built Cloudberry from builder stage

COPY --from=builder /usr/local/cloudberry-db /usr/local/cloudberry-db

# Bring Xerces libs into Cloudberry lib dir and normalize SONAME via builder-installed versioned prefix

COPY --from=builder /usr/local/xerces-c/lib/libxerces-c.so /usr/local/cloudberry-db/lib/

COPY --from=builder /usr/local/xerces-c/lib/libxerces-c-3.*.so /usr/local/cloudberry-db/lib/

# Copy configuration files to their final destinations

COPY devops/sandbox/configs/90-cbdb-limits.conf /etc/security/limits.d/90-cbdb-limits.conf

COPY devops/sandbox/configs/90-cbdb-sysctl.conf /etc/sysctl.d/90-cbdb-sysctl.conf

COPY devops/sandbox/configs/gpinitsystem_singlenode /tmp/gpinitsystem_singlenode

COPY devops/sandbox/configs/gpinitsystem_multinode /tmp/gpinitsystem_multinode

COPY devops/sandbox/configs/multinode-gpinit-hosts /tmp/multinode-gpinit-hosts

COPY devops/sandbox/configs/init_system.sh /tmp/init_system.sh

# Runtime configuration

RUN echo "cdw" > /tmp/gpdb-hosts && \

chmod 755 /tmp/gpinitsystem_singlenode && \

chmod 755 /tmp/gpinitsystem_multinode && \

chmod 755 /tmp/init_system.sh && \

mkdir -p /data0/database/coordinator /data0/database/primary /data0/database/mirror && \

chown -R gpadmin:gpadmin \

/usr/local/cloudberry-db \

/tmp/gpinitsystem_singlenode \

/tmp/gpinitsystem_multinode \

/tmp/gpdb-hosts \

/tmp/multinode-gpinit-hosts \

/data0 && \

echo "export COORDINATOR_DATA_DIRECTORY=/data0/database/coordinator/gpseg-1" >> /home/gpadmin/.bashrc && \

echo -e '\n# Add Cloudberry entries\nif [ -f /usr/local/cloudberry-db/cloudberry-env.sh ]; then\n source /usr/local/cloudberry-db/cloudberry-env.sh\nfi' >> /home/gpadmin/.bashrc

# ----------------------------------------------------------------------

# Generate SSH keypair for gpadmin user at build time

# ----------------------------------------------------------------------

# WARNING: This embeds a fixed SSH keypair in the Docker image for

# sandbox convenience. This is ONLY suitable for local testing and

# development. DO NOT use this image in production or any environment

# where security is a concern.

# ----------------------------------------------------------------------

RUN mkdir -p /home/gpadmin/.ssh && \

ssh-keygen -t rsa -b 4096 -N '' -C 'gpadmin@cloudberry-sandbox' \

-f /home/gpadmin/.ssh/id_rsa && \

cat /home/gpadmin/.ssh/id_rsa.pub >> /home/gpadmin/.ssh/authorized_keys && \

chmod 700 /home/gpadmin/.ssh && \

chmod 600 /home/gpadmin/.ssh/id_rsa && \

chmod 644 /home/gpadmin/.ssh/id_rsa.pub && \

chmod 600 /home/gpadmin/.ssh/authorized_keys && \

chown -R gpadmin:gpadmin /home/gpadmin/.ssh

# Set default user and working directory

USER gpadmin

WORKDIR /home/gpadmin

EXPOSE 5432 22

# cgroup mount (provided by compose/run)

VOLUME [ "/sys/fs/cgroup" ]

# Start the container by running the initialization script

CMD ["bash","-c","/tmp/init_system.sh"]