# The exam's remote desktop: XFCE on Ubuntu 24.04 with a terminal and Firefox, served to the
# browser over noVNC. It is the "base" machine of a session - no kubeconfig here; every task says
# which host to ssh to.
FROM docker.io/library/ubuntu:24.04
ENV DEBIAN_FRONTEND=noninteractive LANG=C.UTF-8
# Ubuntu's own firefox package only installs the snap, which cannot run in a container: Firefox ESR
# comes from Mozilla's APT repository instead, pinned above Ubuntu's. Ubuntu's image has a user
# `ubuntu` on uid 1000, which is the candidate's.
RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates curl \
 && install -d -m 0755 /etc/apt/keyrings \
 && curl -fsSL -o /etc/apt/keyrings/packages.mozilla.org.asc https://packages.mozilla.org/apt/repo-signing-key.gpg \
 && echo 'deb [signed-by=/etc/apt/keyrings/packages.mozilla.org.asc] https://packages.mozilla.org/apt mozilla main' \
      > /etc/apt/sources.list.d/mozilla.list \
 && printf 'Package: *\nPin: origin packages.mozilla.org\nPin-Priority: 1000\n' > /etc/apt/preferences.d/mozilla \
 && userdel -r ubuntu \
 && apt-get update \
 && apt-get install -y --no-install-recommends \
      xfce4 xfce4-terminal dbus-x11 elementary-xfce-icon-theme greybird-gtk-theme \
      fonts-dejavu fonts-liberation \
      tigervnc-standalone-server novnc websockify \
      firefox-esr mousepad xclip \
      openssh-client sudo vim nano less jq tmux curl wget bash-completion ca-certificates \
      procps iputils-ping dnsutils \
 && rm -rf /var/lib/apt/lists/*
COPY rootfs/ /
RUN useradd -m -s /bin/bash -u 1000 candidate \
 && echo 'candidate ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/candidate && chmod 440 /etc/sudoers.d/candidate \
 && install -d -o candidate -g candidate /home/candidate/.config/xfce4/xfconf/xfce-perchannel-xml \
 && install -m644 -o candidate -g candidate /etc/xdg/xfce4/panel/default.xml \
      /home/candidate/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-panel.xml \
 && chmod +x /usr/local/bin/start-desktop
USER candidate
WORKDIR /home/candidate
EXPOSE 6080
ENTRYPOINT ["/usr/local/bin/start-desktop"]