FROM jenkins/inbound-agent:alpine AS jnlp

FROM python:3.13.2-alpine

# USER jenkins
RUN apk --no-cache -U add openjdk17-jre python3 postgresql-client git python3-dev openssh mysql-client build-base curl \
  && apk cache clean
RUN python3 -m ensurepip \
  && pip3 install --no-cache-dir --upgrade pip setuptools

# USER root
# ADD ca-chain.der .

# RUN $JAVA_HOME/bin/keytool -noprompt -alias local-CA \
#   -keystore "$JAVA_HOME/jre/lib/security/cacerts" \
#   -import -file ca-chain.der \
#   -storepass changeit

# USER jenkins
COPY --from=jnlp /usr/local/bin/jenkins-agent /usr/local/bin/jenkins-agent
COPY --from=jnlp /usr/share/jenkins/agent.jar /usr/share/jenkins/agent.jar

RUN mkdir "$HOME/.ssh/" \
  && touch "$HOME/.ssh/known_hosts" \
  && ssh-keyscan github.com >> ~/.ssh/known_hosts

# COPY ca-chain.crt "$JAVA_HOME/jre/lib/security"
# RUN cd "$JAVA_HOME/jre/lib/security" \
#   && keytool -import -alias homeca -storepass changeit -noprompt -trustcacerts -keystore cacerts -file ca-chain.crt

ENTRYPOINT ["/usr/local/bin/jenkins-agent"]