FROM fedora:43 AS base
RUN --mount=type=cache,target=/var/cache/libdnf5 <<EOF
    set -eux

    dnf --setopt keepcache=1 install -y \
        btrfs-progs \
        composefs \
        dosfstools \
        kernel \
        mokutil \
        openssh-server \
        policycoreutils-python-utils \
        sbsigntools \
        selinux-policy-targeted \
        skopeo \
        strace \
        systemd \
        systemd-boot-unsigned \
        systemd-ukify \
        util-linux

        rm -vf /var/lib/systemd/random-seed
EOF

# --- Everything above this line should hopefully stay cached ---

COPY cfsctl /usr/bin
COPY extra /
COPY test-thing.fedora-42 /
RUN <<EOF
    set -eux

    systemctl enable systemd-networkd

    checkmodule -M -m -o /etc/composefs_workarounds.mod /etc/composefs_workarounds.te
    semodule_package -o /etc/composefs_workarounds.pp -m /etc/composefs_workarounds.mod
    semodule -i /etc/composefs_workarounds.pp

    passwd -d root
    mkdir /sysroot
EOF

FROM base AS kernel
RUN --mount=type=bind,from=base,target=/mnt/base <<EOF
    set -eux

    COMPOSEFS_KARG="$(cfsctl --hash sha256 --erofs-version 1 compute-karg /mnt/base)"

    mkdir -p /etc/kernel /etc/dracut.conf.d
    echo "${COMPOSEFS_KARG} rw" > /etc/kernel/cmdline
EOF
RUN --mount=type=cache,target=/var/cache/libdnf5 \
    --mount=type=secret,id=key \
    --mount=type=secret,id=cert <<EOF
    kernel-install add-all
EOF

FROM base AS bootable
COPY --from=kernel /boot /boot
