FROM debian:bookworm AS builder

RUN \
    --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && apt-get install -y --no-install-recommends \
    libguestfs-tools cloud-image-utils curl linux-image-amd64 \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /build

RUN chmod 0644 /boot/vmlinuz*

RUN curl -Lo debian.qcow2 https://cloud.debian.org/images/cloud/bookworm/20260316-2418/debian-12-nocloud-amd64-20260316-2418.qcow2 && \
    echo "661a11d853616ba72913ace404961a28350c58eb4041edd2c847aec932d5b99b debian.qcow2" | sha256sum --check

COPY challenge.service flagger.py ipset.save iptables.save .

RUN virt-customize -a debian.qcow2 \
    --update \
    --install iptables \
    --install ipset \
    --upload iptables.save:/iptables.save \
    --upload ipset.save:/ipset.save \
    --upload challenge.service:/etc/systemd/system/challenge.service \
    --upload flagger.py:/flagger.py \
    --run-command 'systemctl daemon-reload && systemctl enable challenge.service' \
    --run-command 'rm -rf /var/lib/apt/lists/*'

FROM debian:bookworm-slim

RUN  \
    --mount=type=cache,target=/var/cache/apt,sharing=locked \
    --mount=type=cache,target=/var/lib/apt,sharing=locked \
    apt-get update && apt-get install -y --no-install-recommends \
    qemu-system-x86 qemu-utils qemu-kvm \
    && rm -rf /var/lib/apt/lists/*


COPY --from=builder /build/debian.qcow2 /vm/

COPY flag.txt /vm/
COPY entrypoint.sh /entrypoint.sh

RUN chmod +x /entrypoint.sh
CMD ["/entrypoint.sh"]