# Pinned to 8.0.3
# Do not bump to :latest — versions 8.0.4+ ship without microdnf, until we work on KDH-753
FROM confluentinc/cp-schema-registry:8.0.3

USER root

# Update and install find for determing SSL configuration in entrypoint
RUN microdnf -y update && microdnf -y install findutils jq python3-pip && microdnf clean all

RUN python3 --version
RUN python3 -m pip install --upgrade pip

COPY schemas /home/appuser/schemas
RUN chown -R appuser:appuser /home/appuser/schemas \
  && chmod -R u=rwX,g=rX,o-rwx /home/appuser/schemas

COPY entrypoint.sh upload-schemas.sh healthcheck.sh /usr/local/bin/
RUN chown root:root /usr/local/bin/entrypoint.sh /usr/local/bin/upload-schemas.sh /usr/local/bin/healthcheck.sh \
  && chmod 755 /usr/local/bin/entrypoint.sh /usr/local/bin/upload-schemas.sh /usr/local/bin/healthcheck.sh

USER appuser

ENV REGISTRY_PORT=8081
ENV SCHEMA_REGISTRY_KAFKASTORE_SECURITY_PROTOCOL='SSL'
ENV SCHEMA_REGISTRY_GROUP_UNIQUE_IDENTIFIER='orchard'
ENV SCHEMA_REGISTRY_COMPATIBILITY_LEVEL='backward'
ENV SCHEMA_REGISTRY_KAFKASTORE_TOPIC='_schemas'
ENV SCHEMA_REGISTRY_KAFKASTORE_TOPIC_REPLICATION_FACTOR=3
ENV SCHEMA_REGISTRY_KAFKASTORE_INIT_TIMEOUT_MS=60000
ENV SCHEMA_REGISTRY_KAFKASTORE_SSL_ENABLED_PROTOCOLS='TLSv1.2'
ENV SCHEMA_REGISTRY_LEADER_ELIGIBILITY='true'

# Mitigate CVE-2021-44228
# https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
ENV LOG4J_FORMAT_MSG_NO_LOOKUPS="true"

EXPOSE ${REGISTRY_PORT}

CMD ["/usr/local/bin/entrypoint.sh"]

#FORCE REDEPLOY:1