# Dev/test container for wp-engine.sh
#
# Provides the root + systemd + apt environment the script expects on a bare
# host. Must run --privileged (set in devcontainer.json) so UFW, Fail2ban and a
# nested Docker daemon behave like they would on real hardware.
#
# Manual (non-VS Code) usage:
#   docker build -t wp-engine-dev .devcontainer
#   docker run --rm -d --name wp-engine-dev --privileged \
#     -p 80:80 -p 443:443 -p 81:81 -p 3000:3000 -p 48222:48222 \
#     -v "$PWD":/workspaces/SecureServer wp-engine-dev
#   docker exec -it wp-engine-dev bash

FROM ubuntu:24.04

ENV DEBIAN_FRONTEND=noninteractive \
    container=docker

# systemd as PID 1, plus tools the harness and the script's hardening path need.
# (ufw/fail2ban/docker are deliberately NOT preinstalled -- wp-engine.sh installs
# them itself during --bootstrap, which is exactly what we want to test.)
RUN apt-get update && apt-get install -y --no-install-recommends \
        systemd \
        systemd-sysv \
        openssh-server \
        openssh-client \
        sudo \
        ca-certificates \
        curl \
        gnupg \
        lsb-release \
        apt-transport-https \
        git \
        jq \
        shellcheck \
        iproute2 \
        procps \
    && rm -rf /var/lib/apt/lists/* \
    && mkdir -p /run/sshd /run/lock

# Silence units that cannot work inside a container so boot completes cleanly.
RUN systemctl set-default multi-user.target \
    && systemctl mask --no-reload -- \
        systemd-remount-fs.service \
        getty.target \
        systemd-logind.service \
        dev-hugepages.mount \
        sys-fs-fuse-connections.mount \
        2>/dev/null || true

# Docker-in-Docker: Docker 29's default containerd snapshotter fails to mount
# nested overlay layers (EINVAL on overlay-on-overlay). The classic overlay2
# graphdriver (same as the official docker:dind image) works on kernels >= 5.11.
COPY daemon.json /etc/docker/daemon.json

# Container-friendly init: systemd wants SIGRTMIN+3 to shut down.
STOPSIGNAL SIGRTMIN+3

CMD ["/sbin/init"]