#

# NOTE: RockyLinux-9 creates zomby processes!

#

ARG PG_VERSION=17

ARG PYTHON_VERSION=3

# --------------------------------------------- base1

FROM rockylinux/rockylinux:9 AS base1

# STEP 1: Fix the root cause (unstable mirrors). Switch to the official CDN.

RUN sed -i 's/mirrorlist=/ #mirrorlist=/g' /etc/yum.repos.d/rocky*.repo && \

sed -i 's/#baseurl=http:\/\/dl.rockylinux.org/baseurl=https:\/\/dl.rockylinux.org/g' /etc/yum.repos.d/rocky*.repo

# In RHEL 9/10, the repository for dev packages is called CRB (instead of powertools)

RUN dnf install -y 'dnf-command(config-manager)' && \

dnf config-manager --set-enabled crb

# Consolidating system utilities, including iproute (to prevent tests from failing)

# Added the --allowerasing flag so dnf can seamlessly replace curl-minimal with full-fledged curl

RUN dnf install -y --setopt=retries=10 --setopt=max_parallel_downloads=10 --allowerasing \

sudo \

curl \

ca-certificates \

openssh-server \

openssh-clients \

sshpass \

time \

util-linux \

procps-ng \

git \

iproute \

bzip2 \

&& dnf clean all

# In RHEL 9/10, to generate host keys inside Docker, you need to call this binary

RUN /usr/libexec/openssh/sshd-keygen rsa && \

/usr/libexec/openssh/sshd-keygen ed25519

RUN sed -i 's/#MaxStartups 10:30:100/MaxStartups 2000:30:2000/' /etc/ssh/sshd_config && \

sed -i 's/#MaxSessions 10/MaxSessions 500/' /etc/ssh/sshd_config && \

sed -i 's/#MaxAuthTries 6/MaxAuthTries 20/' /etc/ssh/sshd_config

# --------------------------------------------- postgres dev tools

FROM base1 AS base1_with_dev_tools

RUN dnf install -y --setopt=retries=10 --setopt=max_parallel_downloads=10 --allowerasing \

gcc \

make \

meson \

flex \

bison \

pkg-config \

openssl-devel \

libicu-devel \

libzstd-devel \

zlib-devel \

lz4-devel \

libxml2-devel \

perl-interpreter \

perl-FindBin \

perl-File-Compare \

&& dnf clean all

# --------------------------------------------- postgres build

FROM base1_with_dev_tools AS base1_with_pg-17

RUN curl -fsSL https://ftp.postgresql.org/pub/source/v17.7/postgresql-17.7.tar.bz2 -o postgresql.tar.bz2 \

&& mkdir -p /pg/postgres/source \

&& tar -xjf postgresql.tar.bz2 -C /pg/postgres/source --strip-components=1 \

&& rm postgresql.tar.bz2

WORKDIR /pg/postgres/source

RUN ./configure --prefix=/pg/postgres/install --with-zlib --with-openssl --without-readline --with-lz4 --with-zstd --with-libxml

RUN make -j 4 install

RUN make -j 4 -C contrib install

# SETUP PG_CONFIG

RUN ln -s /pg/postgres/install/bin/pg_config -t /usr/local/bin

# SETUP PG CLIENT LIBRARY

RUN ln -s /pg/postgres/install/lib/libpq.so.5 /usr/lib64/libpq.so.5 && \

echo "/pg/postgres/install/lib" > /etc/ld.so.conf.d/postgres.conf && ldconfig

# --------------------------------------------- base2_with_python-3

FROM base1_with_pg-${PG_VERSION} AS base2_with_python-3

# Rocky 9/10 installs python3.9 or higher (depending on the repository)

RUN dnf install -y --setopt=retries=10 --setopt=max_parallel_downloads=10 --allowerasing \

python3 \

python3-devel \

&& dnf clean all

ENV PYTHON_BINARY=/usr/bin/python3

# --------------------------------------------- final

FROM base2_with_python-${PYTHON_VERSION} AS final

EXPOSE 22

RUN useradd -m test && usermod -aG wheel test

# Enable sudo without a password

RUN echo "test ALL=(ALL:ALL) NOPASSWD:ALL" >> /etc/sudoers

# HACK FOR RHEL 9/10: Allow legacy key types and disable UsePAM.

# Additionally, allow passwordless root/test authentication for testing.

RUN echo "test:*" | chpasswd -e && \

sed -i 's/UsePAM yes/UsePAM no/' /etc/ssh/sshd_config && \

echo "PubkeyAcceptedKeyTypes +ssh-rsa" >> /etc/ssh/sshd_config && \

echo "PermitEmptyPasswords yes" >> /etc/ssh/sshd_config

COPY --chown=test:test . /home/test/testgres

WORKDIR /home/test/testgres

ENV LANG=C.UTF-8

RUN chmod 700 /home/test/ && \

mkdir -p /home/test/.ssh && \

echo 'Host *' > /home/test/.ssh/config && \

echo ' ControlMaster auto' >> /home/test/.ssh/config && \

echo ' ControlPath /home/test/.ssh/master-%r@%h:%p' >> /home/test/.ssh/config && \

echo ' ControlPersist 30m' >> /home/test/.ssh/config && \

echo ' StrictHostKeyChecking no' >> /home/test/.ssh/config && \

echo ' UserKnownHostsFile /dev/null' >> /home/test/.ssh/config && \

echo ' GSSAPIAuthentication no' >> /home/test/.ssh/config && \

chown -R test:test /home/test/.ssh && \

chmod 700 /home/test/.ssh && \

chmod 600 /home/test/.ssh/config

# Our ENTRYPOINT with a stub

ENTRYPOINT ["sh", "-c", " \

", "DUMMY-DUMMY-DUMMY"]

# In CMD, we change the key generation from the deprecated -t rsa to the modern -t ed25519!

# This ensures that Rocky 9/10 will accept this key without any cryptographic policy issues.

CMD ["bash", "-c", " \

"]