FROM ghcr.io/windmill-labs/windmill:dev

# Rust
COPY --from=rust:1.93.0 /usr/local/cargo /usr/local/cargo
COPY --from=rust:1.93.0 /usr/local/rustup /usr/local/rustup
RUN RUSTUP_HOME=/usr/local/rustup CARGO_HOME=/usr/local/cargo /usr/local/cargo/bin/cargo install cargo-sweep --version ^0.7

# Ansible
RUN uv tool install ansible && [ -d "$(uv tool dir)/ansible/bin/" ] && find "$(uv tool dir)/ansible/bin/" -mindepth 1 -maxdepth 1 -type f -executable -regextype posix-extended -regex '^((.+/)?)[^.]+' -print0 | xargs -0 ln -s -t "$UV_TOOL_BIN_DIR/" || true

# C#
RUN wget https://dot.net/v1/dotnet-install.sh -O dotnet-install.sh \
    && chmod +x dotnet-install.sh \
    && ./dotnet-install.sh --channel 9.0 --install-dir /usr/share/dotnet \
    && ln -s /usr/share/dotnet/dotnet /usr/bin/dotnet \
    && rm dotnet-install.sh
# Nushell
COPY --from=ghcr.io/nushell/nushell:0.101.0-bookworm /usr/bin/nu /usr/bin/nu

# Java
RUN apt-get -y update && apt-get install -y default-jdk
RUN curl -fLo coursier https://github.com/coursier/coursier/releases/download/v2.1.24/coursier \
	&& mv ./coursier /usr/bin/coursier \
	&& chmod +x /usr/bin/coursier
RUN /usr/bin/java -jar /usr/bin/coursier about

# Ruby
RUN apt-get install -y ruby ruby-bundler

# R
RUN apt-get install -y r-base-dev \
    && Rscript -e 'install.packages("renv", lib="/usr/lib/R/library", repos="https://cloud.r-project.org")'

# Rootless container runtime (podman) for docker-mode jobs. When a `# docker` job
# runs on a worker with no Docker daemon provided (no DOCKER_HOST, no mounted
# /var/run/docker.sock), Windmill automatically starts a per-job rootless podman —
# no privileged dind sidecar or host Docker socket. Run the docker worker group as
# `user: "1000:1000"` for a rootless (unprivileged) daemon; running as root still
# works but is rootful (less isolated).
RUN apt-get -y update \
    && apt-get install -y --no-install-recommends \
        podman \
        uidmap \
        fuse-overlayfs \
        slirp4netns \
        crun \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*
RUN useradd -u 1000 -m -s /bin/bash windmill 2>/dev/null || true
# Ensure a subuid/subgid range exists for rootless podman (useradd usually adds
# one already; only append if it didn't, to avoid a duplicate range).
RUN grep -q '^windmill:' /etc/subuid || echo "windmill:100000:65536" >> /etc/subuid; \
    grep -q '^windmill:' /etc/subgid || echo "windmill:100000:65536" >> /etc/subgid
# newuidmap/newgidmap need privilege to map the subuid range for rootless podman;
# ensure they are setuid in case the package's file capabilities are lost in the
# image layers.
RUN chmod u+s /usr/bin/newuidmap /usr/bin/newgidmap
# NB: rootless container networking is defaulted to slirp4netns (the netavark
# bridge default fails rootless without nftables setup) per-job by the worker via
# a job-scoped containers.conf, rather than globally here, so rootful podman is
# unaffected.

# Fix UV cache permissions for non-root user support (uid 1000, etc.)
# The uv tool install ansible command populates the UV cache with root-owned files
RUN chmod -R a+rw /tmp/windmill/cache/uv && \
    find /tmp/windmill/cache/uv -type d -exec chmod 777 {} +