Dockerfile.base

ARG PG_MAJOR=17

FROM oraclelinux:9-slim

ARG PG_MAJOR
ARG PG_FULL_VERSION=17.10
ARG PATRONI_VERSION=4.1.3
ARG PGBACKREST_VERSION=2.54.2

LABEL maintainer="Fly.io" \
      description="PostgreSQL with Patroni for the Percona Operator 2.6, built from scratch"

ENV LC_ALL=en_US.utf-8 \
    LANG=en_US.utf-8 \
    container=oci

# ── Base OS ──────────────────────────────────────────────────────────────────
RUN microdnf -y update && \
    microdnf -y install glibc-langpack-en platform-python && \
    microdnf clean all && \
    rm -rf /var/cache/dnf /var/cache/yum

# ── Repo setup: Percona + Oracle EPEL ───────────────────────────────────────
# oracle-epel-release-el9 is in Oracle Linux repos — no external download needed.
RUN set -ex; \
    microdnf -y install findutils oracle-epel-release-el9; \
    curl -Lfs -o /tmp/percona-release.rpm \
      "https://repo.percona.com/yum/percona-release-latest.noarch.rpm"; \
    rpm -i /tmp/percona-release.rpm; \
    percona-release enable ppg-${PG_MAJOR} release; \
    rm -f /tmp/*.rpm; \
    microdnf clean all

ENV PGROOT=/usr/pgsql-${PG_MAJOR} \
    PGVERSION=${PG_MAJOR}

# ── PostgreSQL base package + system tools ───────────────────────────────────
# llvmjit intentionally excluded: JIT is off by default in PG16+ and LLVM
# adds complexity and image size with no operational benefit here.
RUN set -ex; \
    microdnf -y install \
      bind-utils gettext hostname python3-pyparsing perl libedit \
      openssh openssh-server openssh-clients procps-ng \
      libpq glibc-all-langpacks \
      percona-postgresql${PG_MAJOR}-${PG_FULL_VERSION}; \
    microdnf -y reinstall tzdata; \
    microdnf clean all

# ── Extensions + Patroni (all RPM — no pip) ──────────────────────────────────
RUN set -ex; \
    microdnf -y install \
      percona-pgaudit${PG_MAJOR} \
      percona-pgaudit${PG_MAJOR}_set_user \
      percona-pgbackrest-${PGBACKREST_VERSION} \
      percona-postgresql${PG_MAJOR}-contrib-${PG_FULL_VERSION} \
      percona-postgresql${PG_MAJOR}-server-${PG_FULL_VERSION} \
      percona-postgresql${PG_MAJOR}-libs-${PG_FULL_VERSION} \
      percona-pg_stat_monitor${PG_MAJOR} \
      percona-wal2json${PG_MAJOR} \
      percona-pg_repack${PG_MAJOR} \
      psmisc rsync perl nss_wrapper tar bzip2 lz4 file tzdata unzip \
      python3-psycopg2 python3-ydiff python3-dateutil python3-urllib3 \
      python3-pyyaml python3-click ydiff percona-patroni-${PATRONI_VERSION}; \
    microdnf clean all; \
    rm -rf /var/cache/dnf /var/cache/yum

# ── pgvector ─────────────────────────────────────────────────────────────────
RUN set -ex; \
    microdnf -y install percona-pgvector_${PG_MAJOR}; \
    rpm -e percona-telemetry-agent --nodeps 2>/dev/null || true; \
    microdnf clean all; \
    rm -rf /var/cache/dnf /var/cache/yum

ENV PATH=/usr/pgsql-${PG_MAJOR}/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
    NSS_WRAPPER_SUBDIR=postgres

# ── Directory structure ───────────────────────────────────────────────────────
RUN set -ex; \
    mkdir -p \
      /opt/crunchy/bin/postgres \
      /opt/crunchy/conf \
      /pgdata /pgwal /pgconf /backrestrepo /tablespaces /.ssh; \
    chown -R postgres:postgres \
      /opt/crunchy /var/lib/pgsql \
      /pgdata /pgwal /pgconf /backrestrepo /tablespaces \
      /usr/pgsql-${PG_MAJOR}; \
    chmod -R g=u \
      /opt/crunchy /var/lib/pgsql \
      /pgdata /pgwal /pgconf /backrestrepo /tablespaces; \
    chown 26:0 /.ssh; \
    chmod g+rwx /.ssh; \
    rm -f /run/nologin

# ── Operator-required scripts ─────────────────────────────────────────────────
# /usr/local/bin/relocate-extensions.sh  — called by extension-relocator init container
# /opt/crunchy/bin/postgres/pgbackrest_info.sh — called by pgMonitor collector
COPY scripts/relocate-extensions.sh /usr/local/bin/relocate-extensions.sh
COPY scripts/crunchy/bin/postgres/pgbackrest_info.sh /opt/crunchy/bin/postgres/pgbackrest_info.sh
RUN chmod +x \
      /usr/local/bin/relocate-extensions.sh \
      /opt/crunchy/bin/postgres/pgbackrest_info.sh

# ── OOM protection ────────────────────────────────────────────────────────────
# The operator sets command=["patroni", "/etc/patroni"] on the pod spec, bypassing
# Docker ENTRYPOINT. We intercept by placing our wrapper at /usr/bin/patroni and
# renaming the real binary to /usr/bin/patroni-real.
# NOTE: oom_score_adj writes require CAP_SYS_RESOURCE. The wrapper fails silently
# without it — no crash, just no OOM adjustment.
COPY scripts/patroni-wrapper.sh /usr/local/bin/patroni-wrapper.sh
COPY postgres-oom-adjuster.sh /usr/local/bin/postgres-oom-adjuster.sh
RUN set -ex; \
    mv /usr/bin/patroni /usr/bin/patroni-real; \
    ln -sf /usr/local/bin/patroni-wrapper.sh /usr/bin/patroni; \
    chmod +x \
      /usr/local/bin/patroni-wrapper.sh \
      /usr/local/bin/postgres-oom-adjuster.sh

# ── PG tuning ─────────────────────────────────────────────────────────────────
RUN echo "huge_pages = off" >> /usr/pgsql-${PG_MAJOR}/share/postgresql.conf.sample

# ── Cleanup ───────────────────────────────────────────────────────────────────
# Remove RPM-installed default pgbackrest.conf (/etc/pgbackrest.conf ships with
# repo-path=/var/lib/pgbackrest — the old 1.x alias for repo1-path). pgbackrest
# 2.36+ treats both names in the same section as a duplicate error. The operator
# manages all pgbackrest config exclusively via ConfigMaps in /etc/pgbackrest/conf.d/.
RUN rm -f /etc/pgbackrest.conf && rm -rf /var/spool/pgbackrest

EXPOSE 5432
VOLUME ["/sshd", "/pgconf", "/pgdata", "/pgwal", "/backrestrepo"]
USER 26
CMD ["/usr/bin/patroni"]