#!/bin/sh

set -eu

usage() {
  printf '%s\n' 'Usage: docker-loopback.sh check|serve' >&2
  exit 64
}

fail() {
  printf '%s\n' '{"schemaVersion":1,"component":"qinglong3-cluster-copilot-console-launcher","event":"launch_failed"}' >&2
  exit 78
}

[ "$#" -eq 1 ] || usage
mode=$1
case "$mode" in
  check|serve) ;;
  *) usage ;;
esac

image=${QL3_COPILOT_CONSOLE_IMAGE-}
private_root=${QL3_COPILOT_CONSOLE_PRIVATE_ROOT-}
network=${QL3_COPILOT_CONSOLE_NETWORK-}
port=${QL3_COPILOT_CONSOLE_PORT-}
resource_class=${QL3_COPILOT_CONSOLE_RESOURCE_CLASS-compact}

printf '%s' "$image" | grep -Eq '^[A-Za-z0-9][A-Za-z0-9._/-]{0,191}@sha256:[0-9a-f]{64}$' || fail
printf '%s' "$network" | grep -Eq '^[A-Za-z0-9][A-Za-z0-9_.-]{0,62}$' || fail
case "$network" in
  bridge|default|host|none) fail ;;
esac
printf '%s' "$port" | grep -Eq '^[1-9][0-9]{3,4}$' || fail
[ "$port" -ge 1024 ] 2>/dev/null || fail
[ "$port" -le 65535 ] 2>/dev/null || fail
case "$private_root" in
  /*) ;;
  *) fail ;;
esac
case "$private_root" in
  *','*|*':'*) fail ;;
esac
[ -d "$private_root" ] || fail
canonical_root=$(CDPATH= cd -- "$private_root" 2>/dev/null && pwd -P) || fail
[ "$canonical_root" = "$private_root" ] || fail

case "$resource_class" in
  compact)
    memory=192m
    cpus=0.25
    pids=32
    ;;
  standard)
    memory=512m
    cpus=1
    pids=64
    ;;
  *) fail ;;
esac

set -- docker run --rm --pull never --init --read-only \
  --network "$network" \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  --user 10001:10001 \
  --pids-limit "$pids" \
  --memory "$memory" \
  --cpus "$cpus" \
  --stop-timeout 3 \
  --tmpfs /tmp:rw,noexec,nosuid,nodev,size=8m,mode=700,uid=10001,gid=10001 \
  --mount "type=bind,src=$private_root,dst=/var/run/secrets/qinglong3/copilot-console,readonly"

if [ "$mode" = serve ]; then
  set -- "$@" --publish "127.0.0.1:$port:$port/tcp"
fi

set -- "$@" "$image" copilot-console \
  --container-published-loopback \
  "--port=$port" \
  --config /var/run/secrets/qinglong3/copilot-console/client.json \
  --credential /var/run/secrets/qinglong3/copilot-console/credential \
  --session /var/run/secrets/qinglong3/copilot-console/session

if [ "$mode" = check ]; then
  set -- "$@" --check
fi

exec "$@"