FROM alpine:3.22

RUN apk add --no-cache openssh-server socat \
    && addgroup -g 10001 dbeaver \
    && adduser -D -u 10001 -G dbeaver -s /bin/sh dbeaver \
    && sed -i 's/^dbeaver:[^:]*/dbeaver:NP/' /etc/shadow

COPY sshd_config /etc/ssh/sshd_config
COPY entrypoint.sh /usr/local/bin/dbeaver-gateway-entrypoint
COPY tunnel-only.sh /usr/local/bin/tunnel-only

RUN chmod 0755 /usr/local/bin/dbeaver-gateway-entrypoint /usr/local/bin/tunnel-only

EXPOSE 22

ENTRYPOINT ["/usr/local/bin/dbeaver-gateway-entrypoint"]