ARG KC_TAG=22.0
FROM quay.io/keycloak/keycloak:${KC_TAG} as builder

# Enable health and metrics support
ENV KC_HEALTH_ENABLED=true
ENV KC_METRICS_ENABLED=true

ARG KC_DB=
RUN test "${KC_DB}" || { echo \${KC_DB} must be set!; exit 1; }

WORKDIR /opt/keycloak
# for demonstration purposes only, please make sure to use proper certificates in production instead
RUN keytool -genkeypair -storepass password -storetype PKCS12 -keyalg RSA -keysize 2048 -dname "CN=server" -alias server -ext "SAN:c=DNS:idm.test.hfh-it.de,IP:192.168.44.11" -keystore conf/server.keystore
RUN /opt/keycloak/bin/kc.sh build


FROM registry.access.redhat.com/ubi9 AS ubi-micro-build
RUN dnf install --releasever 9 --setopt install_weak_deps=false --nodocs -y util-linux


FROM quay.io/keycloak/keycloak:${KC_TAG}

COPY --from=builder /opt/keycloak/ /opt/keycloak/
COPY --from=ubi-micro-build /usr/lib64/libcap-ng.so.0* /usr/lib64/
COPY --from=ubi-micro-build /usr/bin/setpriv /usr/bin

USER root
COPY entrypoint /sa-entrypoint
RUN chmod 544 /sa-entrypoint

ENTRYPOINT ["/bin/sh", "/sa-entrypoint"]
CMD ["start", "--optimized"]