template.dockerfile.j2

# syntax=docker/dockerfile:1.7-labs
# 
# This Dockerfile was generated by the Wine base image build script:
# https://github.com/EpicGamesExt/WineResources/blob/{{ BUILD_SCRIPT_VERSION }}/build/build.py
# 
# This file was generated with the following options:
# 
# - 32-bit support:          {% if TEMPLATE_ENABLE_32_BIT_SUPPORT %}yes{% else %}no{% endif %}

# - sudo support:            {% if TEMPLATE_ENABLE_SUDO_SUPPORT %}yes{% else %}no{% endif %}

# - Mitigations:             {% if TEMPLATE_ENABLE_MITIGATIONS %}yes{% else %}no{% endif %}

# - Default base image:      {{ TEMPLATE_DEFAULT_BASE_IMAGE }}
# - Non-root user name:      {{ TEMPLATE_USER_NAME }}
# - Non-root user ID:        {{ TEMPLATE_USER_ID }}
# - Non-root user group ID:  {{ TEMPLATE_GROUP_ID }}
# - Wine prefix path:        {{ TEMPLATE_WINE_PREFIX }}
# 

# Note: the base image is configurable, but it must be based on Ubuntu 22.04
ARG BASE_IMAGE={{ TEMPLATE_DEFAULT_BASE_IMAGE }}
FROM ${BASE_IMAGE} AS builder

# Disable interactive prompts during package installation
ENV DEBIAN_FRONTEND=noninteractive

# Install our common tools
RUN rm -f /etc/apt/apt.conf.d/docker-clean; echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \
	apt-get update && \
	apt-get install -y --no-install-recommends \
		autoconf \
		automake \
		ca-certificates \
		cmake \
		curl \
		git \
		libtool \
		python3 \
		python3-pip \
		xz-utils

# Install the LLVM-MinGW toolchain, which is required in order to build Wine with PDB debug symbols
ENV PATH="$PATH:/opt/llvm-mingw/bin"
ARG LLVM_MINGW_RELEASE="https://github.com/mstorsjo/llvm-mingw/releases/download/20240619/llvm-mingw-20240619-msvcrt-ubuntu-20.04-x86_64.tar.xz"
RUN curl -fSL "$LLVM_MINGW_RELEASE" -o /tmp/llvm-mingw.tar.xz && \
	mkdir /opt/llvm-mingw && \
	tar -xvf /tmp/llvm-mingw.tar.xz --directory /opt/llvm-mingw --strip-components=1 && \
	rm /tmp/llvm-mingw.tar.xz


{% if TEMPLATE_ENABLE_32_BIT_SUPPORT %}

# Enable the installation of 32-bit packages
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \
	dpkg --add-architecture i386 && \
	apt-get update

{% endif %}


# Retrieve the list of build prerequisites for the selected version of Wine
RUN curl -fSL "https://dl.winehq.org/wine-builds/ubuntu/dists/jammy/main/source/wine_{{ TEMPLATE_WINE_PACKAGE_VERSION }}~jammy-1.dsc" -o /tmp/wine-deps.dsc

# Install the 64-bit versions of the build prerequisites
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \
	apt-get build-dep -y --no-install-recommends --host-architecture=amd64 /tmp/wine-deps.dsc


{% if TEMPLATE_ENABLE_32_BIT_SUPPORT %}

# Install the 32-bit versions of the build prerequisites (excluding tools that don't need the 32-bit versions)
# 
# Things to note:
# - There is no `gcc:i386` package, instead we need `gcc-multilib` in order to compile 32-bit C programs (and `g++-multilib` for 32-bit C++ programs)
# - We specify the `--force-overwrite` option to allow `krb5-multidev:i386` to overwrite the file `/usr/bin/krb5-config.mit` that was previously created by `krb5-multidev:amd64`
# 
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \
	sed -i 's/autoconf//; s/bison//; s/bsdmainutils//; s/docbook-to-man//; s/docbook-utils//; s/docbook-xsl//; s/flex//; s/flex//; s/gawk//; s/gcc//; s/gettext//; s/patch//; s/perl//; s/sharutils//;' /tmp/wine-deps.dsc && \
	apt-get build-dep -y --no-install-recommends --host-architecture=i386 -o Dpkg::Options::="--force-overwrite" /tmp/wine-deps.dsc && \
	apt-get install -y --no-install-recommends gcc-multilib g++-multilib

{% endif %}


# Install the 64-bit versions of Wine's optional dependencies
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \
	apt-get update && apt-get install -y --no-install-recommends \
		libcapi20-dev:amd64 \
		libgcrypt20-dev:amd64 \
		libgstreamer-plugins-base1.0-dev:amd64 \
		libusb-1.0-0-dev:amd64 \
		libvulkan-dev:amd64 \
		oss4-dev \
		samba-dev:amd64


{% if TEMPLATE_ENABLE_32_BIT_SUPPORT %}

# Install the 32-bit versions of Wine's optional dependencies
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \
	apt-get update && apt-get install -y --no-install-recommends \
		libcapi20-dev:i386 \
		libgstreamer-plugins-base1.0-dev:i386 \
		libusb-1.0-0-dev:i386 \
		libvulkan-dev:i386

{% endif %}


# Build the memory shim used for overcommit prevention
COPY memory-shim/memory-shim.cpp /tmp/
RUN g++ -shared -ldl -fPIC /tmp/memory-shim.cpp -o /tmp/memory-shim-64.so
{% if TEMPLATE_ENABLE_32_BIT_SUPPORT %}
RUN g++ -shared -ldl -fPIC -m32 /tmp/memory-shim.cpp -o /tmp/memory-shim-32.so
{% endif %}


# Clone the source code for libcgroup
RUN git clone \
	--depth=1 \
	--recurse-submodules \
	--shallow-submodules \
	-b 'v3.1.0' \
	'https://github.com/libcgroup/libcgroup.git' \
	/tmp/libcgroup

# Generate the `configure` script for libcgroup
RUN cd /tmp/libcgroup && \
	autoreconf -fi

# Build the 64-bit version of libcgroup from source
RUN mkdir /tmp/libcgroup/build64 && \
	cd /tmp/libcgroup/build64 && \
	../configure \
		--prefix=/usr \
		--libdir=/usr/lib/x86_64-linux-gnu \
		--enable-shared \
		--disable-static \
		--disable-tools \
		--disable-pam \
		--disable-daemon \
		--disable-python \
		--disable-systemd \
		--disable-initscript-install \
		--disable-tests \
		--disable-samples \
		--disable-code-coverage && \
	make install


{% if TEMPLATE_ENABLE_32_BIT_SUPPORT %}

# Build the 32-bit version of libcgroup from source
RUN mkdir /tmp/libcgroup/build32 && \
	cd /tmp/libcgroup/build32 && \
	CFLAGS="-m32" ../configure \
		--host=i386-linux-gnu \
		--prefix=/usr \
		--libdir=/usr/lib/i386-linux-gnu \
		--enable-shared \
		--disable-static \
		--disable-tools \
		--disable-pam \
		--disable-daemon \
		--disable-python \
		--disable-systemd \
		--disable-initscript-install \
		--disable-tests \
		--disable-samples \
		--disable-code-coverage && \
	make install

{% endif %}


# Fix the erroneous include in the main libcgroup header that remains despite being built without systemd support
RUN sed -i 's|#include <libcgroup/systemd.h>||' /usr/include/libcgroup.h

# Clone the source code for the selected version of Wine
ENV WINE_SOURCE="/tmp/wine"
RUN git clone --progress --depth=1 -b "{{ TEMPLATE_WINE_RELEASE_TAG }}" 'https://gitlab.winehq.org/wine/wine.git' "$WINE_SOURCE"

# Build libmemory-patches
COPY --chown=nonroot:nonroot libmemory-patches /tmp/libmemory-patches
RUN cd /tmp/libmemory-patches/ && \
	gcc -std=c99 -shared -O2 -fvisibility=hidden "-I$WINE_SOURCE/include" -fPIC -o libmemory-patches64.so cgroups.c overcommit.c -lcgroup && \
	cp libmemory-patches64.so /lib/x86_64-linux-gnu/libmemory-patches.so && \
	cp libmemory-patches.h /usr/include/
{% if TEMPLATE_ENABLE_32_BIT_SUPPORT %}
RUN cd /tmp/libmemory-patches/ && \
	gcc -std=c99 -shared -O2 -fvisibility=hidden "-I$WINE_SOURCE/include" -m32 -o libmemory-patches32.so cgroups.c overcommit.c -lcgroup && \
	cp libmemory-patches32.so /usr/lib/i386-linux-gnu/libmemory-patches.so
{% endif %}

# Apply our patches to the Wine source code
COPY ./patches /tmp/patches/
RUN cd "$WINE_SOURCE" && \
	git config --global user.email "root@container.builder" && \
	git config --global user.name "Container Build Stage" && \
	git apply --whitespace=nowarn /tmp/patches/*.patch && \
	git am /tmp/patches/*.mbox

# Run the codegen steps that need to be performed prior to running `configure`
# (Commands from here: <https://github.com/Kron4ek/Wine-Builds/blob/0697823107e88f791b4da2bc496d93d5ad1afd03/build_wine.sh#L283-L285>)
RUN cd "$WINE_SOURCE" && \
	./dlls/winevulkan/make_vulkan && \
	./tools/make_requests && \
	autoreconf -f

# Build the 64-bit version of Wine with PDB debug symbols, setting the `-x` flag for the shell to enable verbose output
# (See: <https://stackoverflow.com/questions/5820303/how-do-i-force-make-gcc-to-show-me-the-commands>)
RUN mkdir "$WINE_SOURCE/build64" && \
	cd "$WINE_SOURCE/build64" && \
	CROSSCC='x86_64-w64-mingw32-gcc' CROSSDEBUG='pdb' ../configure --prefix=/opt/wine/wine64 --enable-win64 --disable-werror --disable-tests --with-mingw && \
	make -s -j`nproc --all` SHELL='/bin/sh -x' && \
	make install


{% if TEMPLATE_ENABLE_32_BIT_SUPPORT %}

# Build the 32-bit version of Wine with PDB debug symbols, setting the `-x` flag for the shell to enable verbose output
RUN mkdir "$WINE_SOURCE/build32" && \
	cd "$WINE_SOURCE/build32" && \
	CROSSCC='i686-w64-mingw32-gcc' CROSSDEBUG='pdb' ../configure --prefix=/opt/wine/wine32 --disable-werror --disable-tests --with-mingw && \
	make -s -j`nproc --all` SHELL='/bin/sh -x' && \
	make install

{% endif %}


{% if TEMPLATE_ENABLE_32_BIT_SUPPORT %}

# Merge the 64-bit and 32-bit files into a single unified Wine installation:
# 
# - We include all files from the 64-bit version of the `bin` directory, plus `wine` and `wine-preloader` from the 32-bit version
# - We include all files from both the 64-bit and 32-bit versions of the `lib` directory (under Wine 7.x, the 64-bit version of the directory is called `lib64`)
# 
RUN mkdir -p /opt/wine/wine64/lib && \
	cp /opt/wine/wine32/bin/wine                  /opt/wine/wine64/bin/wine && \
	cp /opt/wine/wine32/bin/wine-preloader        /opt/wine/wine64/bin/wine-preloader && \
	cp -R /opt/wine/wine32/lib/wine/i386-unix     /opt/wine/wine64/lib/wine/i386-unix && \
	cp -R /opt/wine/wine32/lib/wine/i386-windows  /opt/wine/wine64/lib/wine/i386-windows

{% endif %}


{% if TEMPLATE_ENABLE_MITIGATIONS %}

# The version of MSBuild that comes bundled with Mono is a batch file, but UAT expects an executable,
# so we build a tiny wrapper that runs the batch file and forwards all supplied command-line arguments
FROM golang:1.21-bookworm AS wrapper
COPY msbuild/MSBuildWrapper.go /tmp/MSBuildWrapper.go
RUN GOOS=windows GOARCH=amd64 go build -o /tmp/MSBuildWrapper.exe /tmp/MSBuildWrapper.go

{% endif %}


# Create an optional build stage that gathers the DLL files and PDB debug symbols for the Wine system libraries (useful for debugging purposes)
# (Note that this will not be built by default, it must be targeted explicitly by passing `--target artifacts` to the `docker buildx build` command)
ARG BASE_IMAGE
FROM ${BASE_IMAGE} AS artifacts
COPY --from=builder --parents /opt/wine/wine64/lib/wine/x86_64-windows/*.dll /wine-debug-files/x86_64/
COPY --from=builder --parents /tmp/wine/build64/dlls/*/x86_64-windows/*.pdb /wine-debug-files/x86_64/
{% if TEMPLATE_ENABLE_32_BIT_SUPPORT %}
COPY --from=builder --parents /opt/wine/wine64/lib/wine/i386-windows/*.dll /wine-debug-files/i386/
COPY --from=builder --parents /tmp/wine/build32/dlls/*/i386-windows/*.pdb /wine-debug-files/i386/
{% endif %}

# Copy the Wine build artifacts into our base image
ARG BASE_IMAGE
FROM ${BASE_IMAGE} AS runtime
COPY --from=builder /opt/wine/wine64 /opt/wine
ENV PATH=${PATH}:/opt/wine/bin

# Copy the memory shim into the new image
COPY --from=builder /tmp/memory-shim-64.so /lib/x86_64-linux-gnu/memory-shim.so
{% if TEMPLATE_ENABLE_32_BIT_SUPPORT %}
COPY --from=builder /tmp/memory-shim-32.so /lib/i386-linux-gnu/memory-shim.so
{% endif %}

# Copy libmemory-patches into the new image
COPY --from=builder /tmp/libmemory-patches/libmemory-patches64.so /lib/x86_64-linux-gnu/libmemory-patches.so
{% if TEMPLATE_ENABLE_32_BIT_SUPPORT %}
COPY --from=builder /tmp/libmemory-patches/libmemory-patches32.so /lib/i386-linux-gnu/libmemory-patches.so
{% endif %}

# Copy libcgroup into the new image
COPY --from=builder /usr/lib/x86_64-linux-gnu/libcgroup.* /usr/lib/x86_64-linux-gnu/
{% if TEMPLATE_ENABLE_32_BIT_SUPPORT %}
COPY --from=builder /usr/lib/i386-linux-gnu/libcgroup.* /usr/lib/i386-linux-gnu/
{% endif %}

# Disable interactive prompts during package installation
ENV DEBIAN_FRONTEND=noninteractive

# Enable the memory shim
ENV LD_PRELOAD=memory-shim.so

# Install Wine's runtime dependencies
RUN rm -f /etc/apt/apt.conf.d/docker-clean; echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \
	apt-get update && apt-get install -y --no-install-recommends \
		apt-transport-https \
		ca-certificates \
		curl \
		gstreamer1.0-plugins-base \
		libfontconfig1 \
		libgnutls30 \
		libgnutlsxx28 \
		libgnutls-openssl27 \
		libgstreamer-plugins-base1.0-0 \
		libgstreamer1.0-0 \
		libusb-1.0-0 \
		libvulkan1 \
		libx11-6 \
		software-properties-common \
		tzdata \
		winbind \
		xvfb


{% if TEMPLATE_ENABLE_32_BIT_SUPPORT %}

# Enable 32-bit application support
RUN dpkg --add-architecture i386
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \
	apt-get update && apt-get install -y --no-install-recommends \
		libc6:i386 \
		libfontconfig1:i386 \
		libfreetype6:i386 \
		libgnutls30:i386 \
		libgnutlsxx28:i386 \
		libgnutls-openssl27:i386 \
		libvulkan1:i386

{% endif %}


{% if TEMPLATE_ENABLE_SUDO_SUPPORT %}

# Install sudo support
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \
	apt-get update && apt-get install -y --no-install-recommends \
		sudo

# Disable the default "lecture" message the first time a user runs a command using sudo
RUN echo 'Defaults lecture="never"' >> /etc/sudoers

# Create a non-root user with no password and allow them to run commands using sudo
RUN groupadd -g {{ TEMPLATE_GROUP_ID }} {{ TEMPLATE_USER_NAME }} && \
	useradd --create-home --home /home/{{ TEMPLATE_USER_NAME }} --shell /bin/bash --uid {{ TEMPLATE_USER_ID }} --gid {{ TEMPLATE_GROUP_ID }} {{ TEMPLATE_USER_NAME }} && \
	passwd -d {{ TEMPLATE_USER_NAME }} && \
	usermod -a -G sudo {{ TEMPLATE_USER_NAME }}

{% else %}

# Create a non-root user with no password
RUN groupadd -g {{ TEMPLATE_GROUP_ID }} {{ TEMPLATE_USER_NAME }} && \
	useradd --create-home --home /home/{{ TEMPLATE_USER_NAME }} --shell /bin/bash --uid {{ TEMPLATE_USER_ID }} --gid {{ TEMPLATE_GROUP_ID }} {{ TEMPLATE_USER_NAME }} && \
	passwd -d {{ TEMPLATE_USER_NAME }}

{% endif %}


# Create a new 64-bit Wine prefix for our non-root user
ENV WINEARCH=win64
ENV WINEPREFIX={{ TEMPLATE_WINE_PREFIX }}
RUN mkdir -p "$WINEPREFIX" && chown -R {{ TEMPLATE_USER_NAME }}:{{ TEMPLATE_USER_NAME }} "{{ TEMPLATE_CHOWN_DIR }}"
USER {{ TEMPLATE_USER_NAME }}
RUN wineboot && wineserver --wait


{% if TEMPLATE_ENABLE_32_BIT_SUPPORT %}

# Preinstall Wine Mono
RUN curl -fSL 'https://github.com/madewokherd/wine-mono/releases/download/wine-mono-{{ TEMPLATE_WINE_MONO_VERSION }}/wine-mono-{{ TEMPLATE_WINE_MONO_VERSION }}-x86.msi' -o /tmp/wine-mono-x86.msi && \
	wine msiexec /quiet /i /tmp/wine-mono-x86.msi && \
	wineserver --wait && \
	rm /tmp/wine-mono-x86.msi

{% endif %}


{% if TEMPLATE_ENABLE_MITIGATIONS %}

# Add the Microsoft root certificate trust lists for code signing and timestamping used by .NET for NuGet signing and validation
USER root
RUN \
	curl -fSL 'https://raw.githubusercontent.com/dotnet/sdk/bdbc1e8e8db13bcba0b3f9e9e26573c2a4b0f5bd/src/Layout/redist/trustedroots/codesignctl.pem' -o /usr/local/share/ca-certificates/codesignctl.crt && \
	curl -fSL 'https://raw.githubusercontent.com/dotnet/sdk/bdbc1e8e8db13bcba0b3f9e9e26573c2a4b0f5bd/src/Layout/redist/trustedroots/timestampctl.pem' -o /usr/local/share/ca-certificates/timestampctl.crt && \
	update-ca-certificates
USER {{ TEMPLATE_USER_NAME }}

# Copy our system-wide MSBuild property overrides files into the image
{% set COMMON_IMPORTAFTER = "${WINEPREFIX}/drive_c/users/steamuser/AppData/Local/Microsoft/MSBuild/Current/Imports/Microsoft.Common.props/ImportAfter" %}
{% set NETFRAMEWORK_IMPORTAFTER = "${WINEPREFIX}/drive_c/users/steamuser/AppData/Local/Microsoft/MSBuild/Current/Microsoft.NETFramework.props/ImportAfter" %}
RUN mkdir -p \
	"{{ COMMON_IMPORTAFTER }}" \
	"{{ NETFRAMEWORK_IMPORTAFTER }}" 
COPY --chown={{ TEMPLATE_USER_NAME }}:{{ TEMPLATE_USER_NAME }} msbuild/Custom.After.Microsoft.Common.Props "{{ COMMON_IMPORTAFTER }}/Custom.After.Microsoft.Common.Props"
COPY --chown={{ TEMPLATE_USER_NAME }}:{{ TEMPLATE_USER_NAME }} msbuild/Custom.After.Microsoft.NETFramework.Props "{{ NETFRAMEWORK_IMPORTAFTER }}/Custom.After.Microsoft.NETFramework.Props"

# Install the `unzip` tool
USER root
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked --mount=type=cache,target=/var/lib/apt,sharing=locked \
	apt-get update && apt-get install -y --no-install-recommends \
		unzip
USER {{ TEMPLATE_USER_NAME }}

# The Wine version of Mono doesn't include MSBuild, so we install the Windows version of upstream Mono, which does include MSBuild
RUN curl -fSL 'https://download.mono-project.com/archive/6.12.0/windows-installer/mono-6.12.0.199-x64-0.msi' -o /tmp/mono-x64.msi && \
	wine64 msiexec /i /tmp/mono-x64.msi && \
	wineserver --wait && \
	rm /tmp/mono-x64.msi

# Create the directory to hold the .NET Framework reference assemblies
{% set REFERENCEASSEMBLIES_DIR = "${WINEPREFIX}/drive_c/Program Files (x86)/Reference Assemblies/Microsoft/Framework/.NETFramework" %}
RUN mkdir -p "{{ REFERENCEASSEMBLIES_DIR }}"

# Extract the .NET Framework 4.6.2 reference assemblies from the official NuGet package
RUN curl -fSL 'https://www.nuget.org/api/v2/package/Microsoft.NETFramework.ReferenceAssemblies.net462/1.0.3' -o /tmp/net462.nupkg && \
	unzip /tmp/net462.nupkg -d /tmp/net462 && \
	cp -R /tmp/net462/build/.NETFramework/v4.6.2 "{{ REFERENCEASSEMBLIES_DIR }}/v4.6.2" && \
	rm -rf /tmp/net462 /tmp/net462.nupkg

# Copy our MSBuild wrapper executable alongside Mono's MSBuild batch file
COPY --from=wrapper --chown={{ TEMPLATE_USER_NAME }}:{{ TEMPLATE_USER_NAME }} ["/tmp/MSBuildWrapper.exe", "{{ TEMPLATE_WINE_PREFIX }}/drive_c/Program Files/Mono/bin/MSBuild.exe"]

# Set the Visual Studio telemetry opt-out value for 64-bit applications
RUN wine64 reg add "HKLM\\SOFTWARE\\Microsoft\\VSCommon\\17.0\\SQM" /f /v OptIn /t REG_DWORD /d 0 && wineserver --wait

# Set the Visual Studio telemetry opt-out value for 32-bit applications
RUN wine64 reg add "HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\VSCommon\\17.0\\SQM" /f /v OptIn /t REG_DWORD /d 0 && wineserver --wait

{% endif %}