#!/usr/bin/env bash
set -Eeuo pipefail

die() { printf '[host-runtime][FAIL] %s\n' "$1" >&2; exit 1; }
info() { printf '[host-runtime] %s\n' "$1"; }
runtime_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

[[ "$(id -u)" == '0' ]] || die '请使用 root 执行'
[[ "$(uname -m)" == 'x86_64' ]] || die '当前运行时只支持 x86_64'
[[ -r /etc/os-release ]] || die '无法识别操作系统'
. /etc/os-release
[[ "${ID:-}" == 'openEuler' && "${VERSION_ID:-}" == 24.03* ]] \
  || die "当前模板只允许 openEuler 24.03，实际：${PRETTY_NAME:-unknown}"

command -v docker >/dev/null 2>&1 && die 'Docker 已存在，不允许运行时模板覆盖现有安装'
command -v podman >/dev/null 2>&1 && die '检测到 Podman，请先完成人工兼容性评审'
command -v containerd >/dev/null 2>&1 && die '检测到已有 containerd，请先完成人工兼容性评审'
[[ ! -e /etc/systemd/system/docker.service ]] || die '检测到已有 docker.service，不允许覆盖'
[[ -f "${runtime_dir}/docker.tgz" ]] || die '缺少 docker.tgz'
[[ -f "${runtime_dir}/docker-compose" ]] || die '缺少 docker-compose'
[[ -f "${runtime_dir}/SHA256SUMS" ]] || die '缺少 SHA256SUMS'
(cd "${runtime_dir}" && sha256sum -c SHA256SUMS)

stage_dir="$(mktemp -d /tmp/foodsafe-docker-runtime.XXXXXX)"
trap 'rm -rf -- "${stage_dir}"' EXIT
tar -xzf "${runtime_dir}/docker.tgz" -C "${stage_dir}"
for binary in docker dockerd containerd containerd-shim-runc-v2 ctr runc docker-init docker-proxy; do
  source_path="$(find "${stage_dir}" -type f -name "${binary}" -print -quit)"
  [[ -n "${source_path}" ]] || die "Docker 静态包缺少 ${binary}"
  install -m 755 "${source_path}" "/usr/local/bin/${binary}"
done
install -d -m 755 /usr/local/lib/docker/cli-plugins /etc/docker /var/lib/docker
install -m 755 "${runtime_dir}/docker-compose" /usr/local/lib/docker/cli-plugins/docker-compose

if [[ ! -f /etc/docker/daemon.json ]]; then
  cat >/etc/docker/daemon.json <<'JSON'
{
  "data-root": "/var/lib/docker",
  "log-driver": "json-file",
  "log-opts": { "max-size": "20m", "max-file": "5" }
}
JSON
fi

cat >/etc/systemd/system/docker.service <<'UNIT'
[Unit]
Description=Docker Application Container Engine
After=network-online.target
Wants=network-online.target

[Service]
Type=notify
ExecStart=/usr/local/bin/dockerd --host=unix:///var/run/docker.sock
ExecReload=/bin/kill -s HUP $MAINPID
Restart=always
RestartSec=3
Delegate=yes
KillMode=process
LimitNOFILE=infinity
LimitNPROC=infinity
LimitCORE=infinity
TasksMax=infinity

[Install]
WantedBy=multi-user.target
UNIT

systemctl daemon-reload
systemctl enable --now docker
docker info >/dev/null 2>&1 || die 'Docker daemon 启动失败'
docker compose version >/dev/null 2>&1 || die 'Docker Compose V2 验证失败'
info 'Docker 离线运行时安装完成'