# ============================================================
# 基础镜像：RockyLinux 8 + Python 3.12.8（多阶段、精简版）
# 定位：通用 Python 运行时，预置 MySQL 客户端运行库
# 产出：python-base:3.12.8
# ============================================================

# ============================================================
# 阶段一：builder —— 编译 Python，产物最终丢弃
# ============================================================
FROM rockylinux:8 AS builder

ENV PYTHON_VERSION=3.12.8 \
    PYTHON_HOME=/usr/local/python3.12.8 \
    LANG=en_US.UTF-8

# 安装编译 CPython 所需的工具链
#   make / gcc / gcc-c++    构建工具
#   openssl-devel           _ssl / _hashlib 模块
#   bzip2-devel             _bz2 模块
#   libffi-devel            _ctypes 模块
#   zlib-devel              zlib 模块（第三方包间接依赖）
#   readline-devel          readline 模块
#   sqlite-devel            _sqlite3 模块（必须保留）
#   xz / tar / findutils    解压与裁剪
# 注意：不装 cmake，CPython 不用它
RUN set -eux; \
    sed -e 's|^mirrorlist=|#mirrorlist=|g' \
        -e 's|^#baseurl=http://dl.rockylinux.org/$contentdir|baseurl=https://mirrors.aliyun.com/rockylinux|g' \
        -i.bak /etc/yum.repos.d/*.repo; \
    dnf install -y --setopt=install_weak_deps=False \
        make gcc gcc-c++ \
        openssl-devel bzip2-devel libffi-devel \
        zlib-devel readline-devel sqlite-devel \
        xz tar findutils; \
    dnf clean all; rm -rf /var/cache/dnf

# 添加 Python 源码包（构建上下文中需有 Python-3.12.8.tar.xz）
ADD Python-3.12.8.tar.xz /tmp/

# 编译安装 Python，并裁剪安装目录
#   --enable-shared          生成 libpython3.12.so，便于其他程序链接
#   --with-system-ffi        使用系统 libffi，避免自编译
#   --with-ensurepip=install 安装 pip
#   裁剪：删除 test/idlelib/tkinter/lib2to3 等运行时不需要的模块，
#         删除 .a/.la/__pycache__/.pyc，strip .so 调试符号
#   注意：不要删 ensurepip 和 site-packages，否则 pip 会丢失
RUN set -eux; \
    cd /tmp/Python-3.12.8; \
    ./configure \
        --prefix=${PYTHON_HOME} \
        --enable-shared \
        --with-system-ffi \
        --with-ensurepip=install; \
    make -j"$(nproc)"; \
    make install; \
    cd ${PYTHON_HOME}; \
    rm -rf lib/python3.12/test \
           lib/python3.12/idlelib \
           lib/python3.12/tkinter \
           lib/python3.12/turtledemo \
           lib/python3.12/lib2to3 \
           lib/python3.12/config-3.12-*; \
    find ${PYTHON_HOME} -name '__pycache__' -type d -exec rm -rf {} + 2>/dev/null || true; \
    find ${PYTHON_HOME} -name '*.pyc' -delete; \
    find ${PYTHON_HOME} -name '*.a' -delete; \
    find ${PYTHON_HOME} -name '*.la' -delete; \
    find ${PYTHON_HOME}/bin ${PYTHON_HOME}/lib -type f -name '*.so*' \
        -exec strip --strip-unneeded {} + 2>/dev/null || true; \
    cd /tmp; rm -rf /tmp/Python-3.12.8


# ============================================================
# 阶段二：runtime —— 最终基础镜像
# ============================================================
FROM rockylinux:8 AS runtime

# 镜像元数据
LABEL maintainer="小蚂蚁云团队" \
      version="1.3" \
      description="RockyLinux 8 + Python 3.12.8 精简运行环境（预置 MySQL 运行库）" \
      python.version="3.12.8"

# 运行时环境变量
#   PYTHON_HOME 与 builder 一致，便于 COPY 路径引用
#   PATH 把 Python bin 目录放最前，保证 python/pip 生效
ENV PYTHON_VERSION=3.12.8 \
    PYTHON_HOME=/usr/local/python3.12.8 \
    TZ=Asia/Shanghai \
    LANG=en_US.UTF-8 \
    PATH=/usr/local/python3.12.8/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

# 安装运行时库
#   openssl-libs / bzip2-libs / libffi / zlib / readline / sqlite-libs
#     Python 各标准库模块的运行期依赖
#   mariadb-connector-c
#     MySQL 客户端运行库，为 MySQL 项目预置
#   glibc-langpack-en / shadow-utils / tzdata
#     locale、useradd/groupadd、时区数据
# 同时完成时区和 locale 配置
RUN set -eux; \
    sed -e 's|^mirrorlist=|#mirrorlist=|g' \
        -e 's|^#baseurl=http://dl.rockylinux.org/$contentdir|baseurl=https://mirrors.aliyun.com/rockylinux|g' \
        -i.bak /etc/yum.repos.d/*.repo; \
    dnf install -y --setopt=install_weak_deps=False \
        openssl-libs bzip2-libs libffi zlib \
        readline sqlite-libs \
        mariadb-connector-c \
        glibc-langpack-en shadow-utils tzdata; \
    dnf clean all; rm -rf /var/cache/dnf; \
    ln -snf /usr/share/zoneinfo/${TZ} /etc/localtime; \
    echo ${TZ} > /etc/timezone; \
    echo 'LANG="en_US.UTF-8"' > /etc/locale.conf; \
    echo 'LC_ALL="en_US.UTF-8"' >> /etc/locale.conf

# 从 builder 拷贝编译好的 Python，编译工具链不进入最终镜像
COPY --from=builder ${PYTHON_HOME} ${PYTHON_HOME}

# 建软链、注册动态库、验证
#   ldconfig 注册 ${PYTHON_HOME}/lib，否则运行 python 会报 libpython3.12.so 找不到
RUN set -eux; \
    ln -sf ${PYTHON_HOME}/bin/python3.12 /usr/bin/python3; \
    ln -sf ${PYTHON_HOME}/bin/python3.12 /usr/bin/python; \
    ln -sf ${PYTHON_HOME}/bin/pip3 /usr/bin/pip; \
    echo "${PYTHON_HOME}/lib" > /etc/ld.so.conf.d/python3.conf; \
    ldconfig; \
    python3 --version; pip --version

# 创建非 root 用户 esxi，工作目录 /opt/apps
RUN set -eux; \
    groupadd -r esxi; \
    useradd -r -g esxi -d /opt/apps -s /bin/bash esxi; \
    mkdir -p /opt/apps; \
    chown -R esxi:esxi /opt/apps ${PYTHON_HOME}

WORKDIR /opt/apps
USER esxi

# 健康检查：每 30s 检查 python3 是否可用
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD python3 --version > /dev/null 2>&1 || exit 1

CMD ["python3", "--version"]