# shellcheck disable=SC1001
LATEST_DEB11_DISTROLESS_SHA256=$(crane digest gcr.io/distroless/static-debian11 | awk -F\: '{print $2}')
sed -i -E "s/sha256:[a-z0-9]+/sha256:${LATEST_DEB11_DISTROLESS_SHA256}/g" docker/Dockerfile.distroless

# shellcheck disable=SC1001
LATEST_IPTABLES_DISTROLESS_SHA256=$(crane digest gcr.io/istio-release/iptables | awk -F\: '{print $2}')

# prepare a distroless source context to copy files from
FROM gcr.io/distroless/static-debian11@sha256:9be3fcc6abeaf985b5ecce59451acbcbb15e7be39472320c538d0d55a0834edc as distroless_source

# prepare a base dev to modify file contents
FROM ubuntu:noble as ubuntu_source

# Modify contents of container
COPY --from=distroless_source /etc/ /home/etc
COPY --from=distroless_source /home/nonroot /home/nonroot
RUN echo istio-proxy:x:1337: >> /home/etc/group

# The source can be found at https://github.com/istio/distroless/tree/iptables
# This version is from commit 86c4972a9f5f245cfb382c8e1e95f176d968c882.
FROM ${ISTIO_BASE_REGISTRY}/iptables@sha256:863a23b9b2d6f3f282e651fb62a47d28a7bd19356839367654254f5677cea6fa as distroless

# This will build the final image based on either debug or distroless from above
# hadolint ignore=DL3006
FROM ${BASE_DISTRIBUTION:-debug}