#!/usr/bin/env bash

set -eu

fail() {
  printf 'FAIL: %s\n' "$1" >&2
  exit 1
}

SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)" \
  || fail "cannot resolve script directory"
HOST_UID="$(id -u)"
HOST_GID="$(id -g)"
JDK17_IMAGE="${JDK17_IMAGE:-eclipse-temurin:17.0.20_8-jdk@sha256:a27c79d44326d5f689668df5fedfee487652066d2a91e172747056cc7fbee6fc}"

test "$HOST_UID" -ne 0 \
  || fail "run as an ordinary user that is allowed to access Docker"
docker version >/dev/null \
  || fail "cannot access the Docker daemon"

exec docker run --rm \
  --network none \
  --read-only \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  --user "$HOST_UID:$HOST_GID" \
  --mount "type=bind,src=$SCRIPT_DIR,dst=/lab,readonly" \
  --tmpfs "/tmp:rw,nosuid,nodev,size=128m,uid=$HOST_UID,gid=$HOST_GID,mode=1777" \
  --env JDK17_HOME=/opt/java/openjdk \
  "$JDK17_IMAGE" \
  bash /lab/run.sh