#!/usr/bin/env sh
# docker/install.sh — install full (rootful) Docker Engine and let the
# invoking user talk to it without sudo.
#
# What it does:
#   1. Installs Docker Engine from Docker's upstream package repo. Skipped when
#      `docker` is already installed. Debian-family hosts go through Docker's
#      convenience script (get.docker.com); RHEL-family hosts wire up the
#      docker-ce repo directly — see install_rhel() for why.
#   2. Enables and starts the service (systemd hosts only).
#   3. Adds the invoking user to the `docker` group so the daemon socket is
#      usable without sudo. Takes effect at next login.
#
# Deliberately no-ops when a rootless Docker daemon is detected (e.g. Kasm
# ships its own rootless setup) — installing rootful Docker there would fight
# the existing runtime. See docker-rootless-cgroup/ for the Kasm-side config.
#
# Idempotent and safe to re-run. Uses sudo.
set -eu

SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
REPO_ROOT="$(dirname -- "$SCRIPT_DIR")"

# shellcheck source=../lib/os-detect.sh
. "$REPO_ROOT/lib/os-detect.sh"

say() { printf '%s\n' "$*" >&2; }

DOCKER_PKGS="docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin"

# install_rhel — install docker-ce from Docker's EL repo.
#
# WHY NOT get.docker.com: the convenience script allowlists distros by
# /etc/os-release ID and aborts on anything it does not recognize —
# "ERROR: Unsupported distribution 'ol'" on Oracle Linux, and the same for
# other EL rebuilds it has not enumerated. On a match it does nothing more
# than what this function does: add the repo, then install the packages.
# Wiring the repo up directly drops the allowlist, so every EL rebuild
# (Oracle, Rocky, Alma, CentOS, RHEL) installs from one code path.
#
# The repo URL is keyed on $releasever/$basearch, which dnf expands per host,
# so EL9 and EL10 both resolve without a version table here.
install_rhel() {
  say "docker: adding Docker CE repo (EL \$releasever/\$basearch)..."
  sudo tee /etc/yum.repos.d/docker-ce.repo >/dev/null <<'REPO'
[docker-ce-stable]
name=Docker CE Stable - $basearch
baseurl=https://download.docker.com/linux/centos/$releasever/$basearch/stable
enabled=1
gpgcheck=1
gpgkey=https://download.docker.com/linux/centos/gpg
REPO
  # --allowerasing: containerd.io conflicts with the distro's own runc/containerd
  # on EL rebuilds that ship them (Oracle Linux does). Let dnf swap them out
  # rather than dead-end on the conflict.
  if command -v dnf >/dev/null 2>&1; then
    # shellcheck disable=SC2086
    sudo dnf install -y --allowerasing $DOCKER_PKGS
  else
    # shellcheck disable=SC2086
    sudo yum install -y --allowerasing $DOCKER_PKGS
  fi
}

# install_debian — Docker's convenience script; it supports every Debian-family
# distro this repo targets and sets up the apt repo and keyring.
install_debian() {
  say "docker: installing Docker Engine via get.docker.com..."
  tmp="$(mktemp)"
  if command -v curl >/dev/null 2>&1; then
    curl -fsSL https://get.docker.com -o "$tmp"
  elif command -v wget >/dev/null 2>&1; then
    wget -qO "$tmp" https://get.docker.com
  else
    say "docker: need curl or wget"; rm -f "$tmp"; return 1
  fi
  sudo sh "$tmp"
  rm -f "$tmp"
}

# --- skip on rootless-Docker hosts -------------------------------------------
if command -v docker >/dev/null 2>&1 &&
   docker info -f '{{println .SecurityOptions}}' 2>/dev/null | grep -q 'name=rootless'; then
  say "docker: rootless Docker daemon detected; leaving it alone."
  exit 0
fi

# --- 1. install engine -------------------------------------------------------
if command -v docker >/dev/null 2>&1; then
  say "docker: engine already installed ($(docker --version 2>/dev/null || echo 'version unknown'))."
else
  case "$(detect_pkg_family)" in
    rhel)   install_rhel ;;
    debian) install_debian ;;
    *)      say "docker: unsupported/undetected OS family; install Docker manually."; exit 1 ;;
  esac
fi

# --- 2. enable + start the service (systemd only) ----------------------------
if [ -d /run/systemd/system ] && command -v systemctl >/dev/null 2>&1; then
  sudo systemctl enable --now docker
else
  say "docker: no systemd; not managing the service (start dockerd yourself)."
fi

# --- 3. group membership for the invoking user -------------------------------
user="$(id -un)"
if id -nG "$user" | tr ' ' '\n' | grep -qx docker; then
  say "docker: $user already in the docker group."
else
  sudo usermod -aG docker "$user"
  say "docker: added $user to the docker group."
  say "  Log out and back in (or run 'newgrp docker') for it to take effect."
fi