#!/bin/bash
set -e
[ -n "$DEBUG" ] && set -x

target=
img=""
dockerfile="${PWD}/Dockerfile"
priv=
opts=
become=
verbose=
cwd=$PWD
no_tty=
read_only=

usage() {
	printf "usage: %s OPTIONS -- [ARGS]\n" "$(basename "$0")"
	printf "\n"
	printf "  -t TARGET\n"
	printf "  -i IMAGE\n"
	printf "  -f DOCKERFILE\n"
	printf "  -o EXTRA OPTIONS\n"
	printf "  -D (run privileged)\n"
	printf "  -B (don't reassign uid/gid)\n"
	printf "  -v (be verbose)\n"
	printf "  -c CWD\n"
	printf "  -T (not tty)\n"
	printf "  -W (readonly)\n"
	printf "\n"
	printf "Enter the container defined in Dockerfile, with \$PWD mounted at /src\n"
	exit 2
}

while getopts t:i:f:o:c:vBDTWh o; do
	case $o in
		t) target="$OPTARG" ;;
		i) img="$OPTARG" ;;
		f) dockerfile="$OPTARG" ;;
		o) opts="$OPTARG" ;;
		c) cwd="$OPTARG" ;;
		D) priv=1 ;;
		B) become=1 ;;
		v) verbose=1 ;;
		T) no_tty=1 ;;
		W) read_only=1 ;;
		h | ?) usage ;;
	esac
done
shift $((OPTIND - 1))

if [ -z "$img" ]; then
	name="$(basename "$dockerfile" | cut -d'.' -f1 | tr '[:upper:]' '[:lower:]')" # support <name>.Dockerfile
	scope="$(basename "$(dirname "$(readlink -f -- "$dockerfile")")" | tr '[:upper:]' '[:lower:]')"
	# fall back to directory name
	[ "$name" = "Dockerfile" ] && name="$scope"
	img="${scope}/${name}"

	# allow setting this to some non-file value to skip building
	# > enter -i alpine -f none
	# for a quick alpine based container with $PWD mounted in
	[ -f "$dockerfile" ] \
		&& docker build --tag="$img" --target="$target" --file="$dockerfile" "$PWD"
fi

extra_args=
[ -n "$become" ] && extra_args="${extra_args} "
[ -n "$priv" ] && {
	extra_args="${extra_args} \
		--tmpfs=/run --tmpfs=/sys/fs/cgroup \
		--sysctl=net.ipv4.ip_forward=1 \
		--security-opt=apparmor:unconfined --security-opt=seccomp:unconfined \
		--cap-add NET_ADMIN --cap-add SYS_ADMIN --cap-add SYS_RESOURCE \
		--tmpfs=/var/lib/docker"
}
# make the container transparent
[ -z "$priv" ] && {
	extra_args="${extra_args} \
		--privileged \
		--mount=type=bind,src=${HOME},target=${HOME},ro \
		--network=host"
}

[ -n "$opts" ] && extra_args="${extra_args} ${opts}"

[ -z "$become" ] \
	&& extra_args="${extra_args} --user="$(id -u):$(id -g)""

[ -z "$no_tty" ] \
	&& extra_args="${extra_args} --tty"

[ -n "$read_only" ] \
	&& read_only=",ro"

ep="sh"
[ -n "$1" ] && {
	ep="$1"
	shift
}

[ -n "$verbose" ] && { set -x; }

if dev=$(echo "$@" | grep -Po '\/dev\/[^ ]*'); then
	extra_args="${extra_args} --device=${dev}"
fi

cname=$(mktemp --dry-run enter_XXXX)
exec docker run --name "$cname" --rm -i \
	--env-file <(safe-env) \
	--uts host \
	--ipc host \
	--entrypoint="$ep" \
	--mount=type=bind,src="$cwd",dst=/src"$read_only" -w /src $extra_args "$img" $@