# Copyright (c) 2015-2019 Tigera, Inc. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.


# NOTE: This Dockerfile should be kept in-sync with the one in calico/node.
# This ensures that testing of Felix in this repository is done in the same
# userspace environment as it will be deployed in calico/node.

FROM ubuntu:focal as wgtool

RUN apt-get update && \
    apt-get install --no-install-recommends wireguard-tools -y

FROM calico/bpftool:v5.3-amd64 as bpftool

FROM debian:10-slim
LABEL maintainer="Shaun Crampton <shaun@tigera.io>"

# Binary to execute as "felix". This allows us to swap out
# alternative builds for the tests.
# TODO: We should just mount this in from the host.
ARG FV_BINARY=bin/calico-felix-amd64

# Install remaining runtime deps required for felix from the global repository
RUN apt-get update && apt-get install -y \
    ipset \
    iptables \
    iproute2 \
    iputils-arping \
    iputils-ping \
    iputils-tracepath \
    # Need arp
    net-tools \
    conntrack \
    runit \
    # Need kmod to ensure ip6tables-save works correctly
    kmod \
    # Need netbase in order for ipset to work correctly
    # See https://github.com/kubernetes/kubernetes/issues/68703
    netbase \
    # Also needed (provides utilities for browsing procfs like ps)
    procps \
    ca-certificates \
    # Felix FV tests require these
    wget \
    ethtool \
    tcpdump

# Copy in wg tool from stage 1.
COPY --from=wgtool /usr/bin/wg /usr/bin/wg

# Default to the xtables backend of iptables.
RUN update-alternatives --set iptables /usr/sbin/iptables-legacy
RUN update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy

# Install tini, the init daemon we use.
ENV TINI_VERSION v0.18.0
ADD https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini-static-amd64 /sbin/tini

ADD felix.cfg /etc/calico/felix.cfg
ADD calico-felix-wrapper /usr/bin

ADD bin/test-connection bin/test-workload bin/pktgen /

# Add the felix and calico-bpf binaries from the host.
ADD $FV_BINARY /code/calico-felix
ADD bin/calico-bpf /usr/bin/calico-bpf

ADD bpf/bin/* /usr/lib/calico/bpf/

RUN ln -s /code/calico-felix /usr/bin
COPY --from=bpftool /bpftool /usr/bin
WORKDIR /code

# Since our binary isn't designed to run as PID 1, run it via the tini init daemon.
RUN chmod +x /sbin/tini
ENTRYPOINT ["/sbin/tini", "--"]

# Run felix (via the wrapper script) by default
CMD ["/usr/bin/calico-felix-wrapper"]
