unbase_oci

#!/usr/bin/env bash

set -eufo pipefail

container_image=ghcr.io/gardenlinux/unbase_oci:8e33b68bf7b93d392fa8ef3248adb0a65d43c67a
container_engine=podman

container_mount_opts=()

while [ $# -gt 0 ]; do
	case "$1" in
		--container-image)
			container_image="$2"
			shift 2
			;;
		--container-engine)
			container_engine="$2"
			shift 2
			;;
		--print-container-image)
			printf '%s\n' "$container_image"
			exit 0
			;;
		*)
			break
			;;
	esac
done

args=()

while [ $# -gt 0 ]; do
	case "$1" in
		-i|--include|-x|--exclude|--dpkg-include)
			container_mount_opts+=(-v "$(realpath "$2"):/mnt$(realpath "$2")")
			args+=("$1" "/mnt$(realpath "$2")")
			shift 2
			;;
		--no-default-include|--no-default-exclude|-d|--dpkg-dependencies|-l|--ldd-dependencies|--print-tree)
			args+=("$1")
			shift
			;;
		*)
			break
			;;
	esac
done

container_mount_opts+=(-v "$(realpath "$1"):/mnt$(realpath "$1")")
[ "$1" = "$2" ] || container_mount_opts+=(-v "$(realpath "$2"):/mnt$(realpath "$2")")
[ -e "$3" ] || touch "$3"
container_mount_opts+=(-v "$(realpath "$3"):/mnt$(realpath "$3")")
args+=("/mnt$(realpath "$1")" "/mnt$(realpath "$2")" "/mnt$(realpath "$3")")

"$container_engine" run --rm --security-opt seccomp=unconfined --security-opt apparmor=unconfined --security-opt label=disable --read-only --tmpfs /tmp:rw,exec "${container_mount_opts[@]}" "$container_image" "${args[@]}"