#!/bin/sh
set -eu

uid="$(id -u)"
if [ "$uid" -eq 0 ]; then
    echo "refusing to run rootless Docker as root" >&2
    exit 1
fi

for command in dockerd-rootless.sh rootlesskit slirp4netns newuidmap newgidmap docker; do
    command -v "$command" >/dev/null 2>&1 || {
        echo "missing rootless Docker prerequisite: $command" >&2
        exit 1
    }
done

grep -q "^$(id -un):.*:65536$" /etc/subuid || {
    echo "missing 65536-entry subordinate UID range for $(id -un)" >&2
    exit 1
}
grep -q "^$(id -gn):.*:65536$" /etc/subgid || {
    echo "missing 65536-entry subordinate GID range for $(id -gn)" >&2
    exit 1
}

export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/tmp/bot-bottle-docker-run}"
mkdir -p "$XDG_RUNTIME_DIR" "$HOME/.docker"
chmod 700 "$XDG_RUNTIME_DIR"

# Docker uses this config for build and child-container proxy injection.  The
# token-bearing proxy URL is already available to the agent; persisting it
# inside this disposable VM does not broaden its authority.
python3 - <<'PY'
import json
import os
from pathlib import Path

proxy = os.environ.get("HTTPS_PROXY") or os.environ.get("https_proxy", "")
no_proxy = os.environ.get("NO_PROXY") or os.environ.get("no_proxy", "")
config = {"proxies": {"default": {
    "httpProxy": proxy,
    "httpsProxy": proxy,
    "noProxy": no_proxy,
}}}
path = Path.home() / ".docker" / "config.json"
path.write_text(json.dumps(config), encoding="utf-8")
path.chmod(0o600)
PY

if docker info >/dev/null 2>&1; then
    exit 0
fi

log=/tmp/bot-bottle-rootless-docker.log
nohup dockerd-rootless.sh \
    --storage-driver=fuse-overlayfs \
    >"$log" 2>&1 </dev/null &