# Stage 1: Extract the gitea-runner binary from the official Alpine-based image
FROM docker.io/gitea/runner:latest AS runner

# Stage 2: Debian-based image with native glibc support
FROM debian:bookworm-slim

COPY --from=runner /usr/local/bin/gitea-runner /usr/local/bin/gitea-runner
COPY --from=runner /usr/local/bin/run.sh /usr/local/bin/run.sh
RUN chmod +x /usr/local/bin/run.sh

ENTRYPOINT ["/usr/local/bin/run.sh"]

# Create dedicated runner user (UID 1000) for non-root container execution
RUN groupadd -g 1000 runner && \
    useradd -u 1000 -g 1000 -m -d /home/runner -s /bin/bash runner

# Install runner tooling
RUN apt-get update && apt-get install -y --no-install-recommends \
    bash \
    ca-certificates \
    curl \
    git \
    jq \
    make \
    nodejs \
    openssh-client \
    python3 \
    python3-pip \
    rsync \
    unzip \
    zip \
    && rm -rf /var/lib/apt/lists/*

# Set work directory
ENV RUNNER_WORKDIR=/home/runner

# Ensure container runs as non-root by default
USER runner