# syntax=docker/dockerfile:1
#
# Ory Kratos for the EchoBark hub: the upstream image plus our identity schema,
# our config, and an entrypoint that runs the (idempotent) SQL migration before
# serving — `kratos serve` alone loops forever on a database with no schema.
#
# Kamal only builds the app image, so accessory images are built + pushed here:
#   make hub-kratos-push

FROM oryd/kratos:v1.3.1

USER root
COPY kratos.yml            /etc/config/kratos/kratos.yml
COPY identity.schema.json  /etc/config/kratos/identity.schema.json
COPY docker-entrypoint.sh  /usr/local/bin/docker-entrypoint.sh
# Directories need the execute bit to be traversed; Kratos's config loader also
# writes a snapshot next to the config on load, so the runtime user must own the
# tree.
RUN find /etc/config -type d -exec chmod 0755 {} + \
 && find /etc/config -type f -exec chmod 0644 {} + \
 && chmod 0755 /usr/local/bin/docker-entrypoint.sh \
 && chown -R ory:ory /etc/config
USER ory

ENV HOME=/tmp
EXPOSE 4433 4434
ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["serve"]
