FROM gcr.io/pingcap-public/pingcap/alpine:3.22.1 as builder
WORKDIR /workspace
# Download aws-iam-authenticator
# CVE fix: upgrade from v0.7.7 (CVE-2026-39828..35, 46595, 46597 etc. in golang.org/x/crypto)
RUN wget -O aws-iam-authenticator https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/download/v0.7.18/aws-iam-authenticator_0.7.18_linux_amd64
# Download ack-ram-tool
# CVE fix: upgrade from v0.20.0-beta.6 to latest stable v0.19.0 (includes patched Go stdlib + golang.org/x/crypto, x/net, x/sys)
RUN wget -qO- https://github.com/AliyunContainerService/ack-ram-tool/releases/download/v0.19.0/ack-ram-tool_0.19.0_Linux_x86_64.tar.gz | tar xvz
# Download kubelogin for azure
# CVE fix: upgrade from v0.2.14 (stdlib 1.24.11) to v0.2.19 (stdlib >= 1.25.12, golang.org/x/crypto 0.52.0)
RUN wget -qO- https://github.com/Azure/kubelogin/releases/download/v0.2.19/kubelogin-linux-amd64.zip | busybox unzip -d . -

# Use distroless as minimal base image to package the manager binary
# Refer to https://github.com/GoogleContainerTools/distroless for more details
# FROM gcr.io/pingcap-public/pingcap/alpine-glibc:alpine-3.22.1
# Required by the security team to replace base image
# CVE fix: pin to digest. Image currently contains libcrypto3/libssl3 3.5.7-r0 which patches
# CVE-2026-45447, CVE-2026-34182/3, CVE-2026-42764, CVE-2026-45445, CVE-2026-34180/1,
# CVE-2026-42766/7/8/9/70, CVE-2026-45446, CVE-2026-7383, CVE-2026-9076.
FROM frolvlad/alpine-glibc:alpine-3.22_glibc-2.42@sha256:0e48177035d9013f7d56fe7442c1adb18d416c841e6ed3380dc22e82e0b1b2d4
WORKDIR /
COPY --from=builder /workspace/aws-iam-authenticator /usr/local/bin/
RUN chmod +x /usr/local/bin/aws-iam-authenticator
COPY --from=builder /workspace/ack-ram-tool /usr/local/bin/
COPY --from=builder /workspace/bin/linux_amd64/kubelogin /usr/local/bin/
RUN chmod +x /usr/local/bin/kubelogin
COPY bin/autoscale_stub autoscale_stub
RUN chmod +x /autoscale_stub
USER 65532:65532
ENTRYPOINT ["/autoscale_stub"]