Dockerfile.ubi.ibmjava8

# (C) Copyright IBM Corporation 2019, 2023.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

FROM ibmjava:8-ubi

USER root

ARG VERBOSE=false
ARG OPENJ9_SCC=true
ARG EN_SHA=366618db4b733337adc71ec30b1f33d36cf78a81858636360061036a926f373f
ARG NON_IBM_SHA=d349f6ea3acd71910348904dd48f81940b86ca5f879737206ae37f858767ad0f
ARG NOTICES_SHA=e7031658e09e2442279db72eed9238fb30d98c06dabb112fb21b8618b7e810ee

ENV SERVER_NAME=defaultServer

LABEL org.opencontainers.image.authors="Leo Christy Jesuraj, Arthur De Magalhaes, Chris Potter" \
      org.opencontainers.image.vendor="IBM" \
      org.opencontainers.image.url="http://wasdev.net" \
      org.opencontainers.image.documentation="https://www.ibm.com/support/knowledgecenter/SSAW57_liberty/com.ibm.websphere.wlp.nd.multiplatform.doc/ae/cwlp_about.html" \
      org.opencontainers.image.version="23.0.0.3" \
      org.opencontainers.image.revision="cl230320230319-1900" \
      vendor="IBM" \
      name="IBM WebSphere Liberty" \
      version="23.0.0.3" \
      summary="Image for WebSphere Liberty with IBM's Java and Red Hat's UBI 8" \
      description="This image contains the WebSphere Liberty runtime with IBM's Java and Red Hat's UBI 8 as the base OS.  For more information on this image please see https://ibm.biz/wl-app-image-template"

# Install WebSphere Liberty
ENV LIBERTY_VERSION 23.0.0_03

ARG LIBERTY_URL
ARG DOWNLOAD_OPTIONS=""

RUN yum -y install unzip wget openssl \
    && yum clean all \
    && useradd -u 1001 -r -g 0 -s /usr/sbin/nologin default \
    && LIBERTY_URL=${LIBERTY_URL:-$(wget -q -O - https://public.dhe.ibm.com/ibmdl/export/pub/software/websphere/wasdev/downloads/wlp/index.yml  | grep $LIBERTY_VERSION -A 6 | sed -n 's/\s*kernel:\s//p' | tr -d '\r' )}  \
    && wget $DOWNLOAD_OPTIONS $LIBERTY_URL -U UA-IBM-WebSphere-Liberty-Docker -O /tmp/wlp.zip \
    && LICENSE_BASE=$(wget -q -O - https://public.dhe.ibm.com/ibmdl/export/pub/software/websphere/wasdev/downloads/wlp/index.yml  | grep $LIBERTY_VERSION -A 6 | sed -n 's/\s*license:\s//p' | sed 's/\(.*\)\/.*/\1\//' | tr -d '\r') \
    && wget ${LICENSE_BASE}en.html -U UA-IBM-WebSphere-Liberty-Docker -O /licenses/en.html \
    && wget ${LICENSE_BASE}non_ibm_license.html -U UA-IBM-WebSphere-Liberty-Docker -O /licenses/non_ibm_license.html \
    && wget ${LICENSE_BASE}notices.html -U UA-IBM-WebSphere-Liberty-Docker -O /licenses/notices.html \    
    && echo "$EN_SHA /licenses/en.html" | sha256sum -c --strict --check \
    && echo "$NON_IBM_SHA /licenses/non_ibm_license.html" | sha256sum -c --strict --check \
    && echo "$NOTICES_SHA /licenses/notices.html" | sha256sum -c --strict --check \
    && chmod -R g+x /usr/bin \
    && unzip -q /tmp/wlp.zip -d /opt/ibm \
    && rm /tmp/wlp.zip \
    && chown -R 1001:0 /opt/ibm/wlp \
    && chmod -R g+rw /opt/ibm/wlp \
    && yum -y remove unzip wget \
    && yum clean all

ENV PATH=$PATH:/opt/ibm/wlp/bin:/opt/ibm/helpers/build

# Add labels for consumption by IBM Product Insights
LABEL "ProductID"="fbf6a96d49214c0abc6a3bc5da6e48cd" \
      "ProductName"="WebSphere Application Server Liberty" \
      "ProductVersion"="23.0.0.3" \
      "BuildLabel"="cl230320230319-1900"

# Set Path Shortcuts
ENV LOG_DIR=/logs \
    WLP_OUTPUT_DIR=/opt/ibm/wlp/output \
    OPENJ9_SCC=$OPENJ9_SCC

# Configure WebSphere Liberty
RUN /opt/ibm/wlp/bin/server create \
    && rm -rf $WLP_OUTPUT_DIR/.classCache /output/workarea

COPY helpers/ /opt/ibm/helpers/
COPY fixes/ /opt/ibm/fixes/

# Create symlinks && set permissions for non-root user
RUN mkdir /logs \
    && mkdir /etc/wlp \
    && mkdir -p /opt/ibm/wlp/usr/shared/resources/lib.index.cache \
    && mkdir -p /home/default \
    && ln -s /opt/ibm /liberty \
    && ln -s /opt/ibm/fixes /fixes \
    && ln -s /opt/ibm/wlp/usr/shared/resources/lib.index.cache /lib.index.cache \
    && chown -R 1001:0 /opt/ibm/helpers \
    && chmod -R g+rwx /opt/ibm/helpers \
    && chown -R 1001:0 /opt/ibm/fixes \
    && chmod -R g+rwx /opt/ibm/fixes \
    && chown -R 1001:0 /opt/ibm/wlp/usr \
    && chmod -R g+rw /opt/ibm/wlp/usr \
    && chown -R 1001:0 /opt/ibm/wlp/output \
    && chmod -R g+rw /opt/ibm/wlp/output \
    && chown -R 1001:0 /logs \
    && chmod -R g+rw /logs \
    && chown -R 1001:0 /etc/wlp \
    && chmod -R g+rw /etc/wlp \
    && chown -R 1001:0 /home/default \
    && chmod -R g+rw /home/default \
    && mkdir -p /opt/ibm/links \
    && chown -R 1001:0 /opt/ibm/links \
    && chmod -R g+rw /opt/ibm/links

# Create second-level symlinks as non-root user
USER 1001

RUN mkdir -p $WLP_OUTPUT_DIR/defaultServer \
    && ln -s $WLP_OUTPUT_DIR/defaultServer /opt/ibm/links/output \
    && ln -s /opt/ibm/wlp/usr/servers/defaultServer /opt/ibm/links/config \
    && mkdir -p /opt/ibm/links/config/configDropins/defaults \
    && mkdir -p /opt/ibm/links/config/configDropins/overrides

# Create first-level symlinks as root user
USER root

RUN mkdir /output \
    && chmod -t /output \
    && rm -rf /output \
    && ln -s /opt/ibm/links/output /output \
    && ln -s /opt/ibm/links/config /config \
    && chown -R 1001:0 /opt/ibm/links/output \
    && chmod -R g+rw /opt/ibm/links/output \
    && chown -R 1001:0 /opt/ibm/links/config \
    && chmod -R g+rw /opt/ibm/links/config \
    && chown -R 1001:0 /config \
    && chmod -R g+rw /config \
    && chown -R 1001:0 /output \
    && chmod -R g+rw /output

# Create a new SCC layer
RUN if [ "$OPENJ9_SCC" = "true" ]; then populate_scc.sh; fi \
    && rm -rf /output/messaging /output/resources/security /logs/* $WLP_OUTPUT_DIR/.classCache \
    && chown -R 1001:0 /opt/ibm/wlp/output \
    && chmod -R g+rwx /opt/ibm/wlp/output

# These settings are needed so that we can run as a different user than 1001 after server warmup
ENV RANDFILE=/tmp/.rnd \
    IBM_JAVA_OPTIONS="-Xshareclasses:name=liberty,readonly,nonfatal,cacheDir=/output/.classCache/ -Dosgi.checkConfiguration=false ${IBM_JAVA_OPTIONS}"

USER 1001

EXPOSE 9080 9443

ENTRYPOINT ["/opt/ibm/helpers/runtime/docker-server.sh"]
CMD ["/opt/ibm/wlp/bin/server", "run"]