FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6

# Alpine plus jq. Nothing application-specific — a general-purpose base for any
# workload that needs to read JSON from a shell script.
#
# It exists because installing tools at container start is not acceptable here:
# `apk add` makes every start depend on network and package-index availability,
# and the resolved version can drift between restarts of an otherwise pinned
# image. Tools belong in the image.
#
# Everything else such a script typically needs (sh, sed, cp, cat, tr, awk) comes
# from busybox in the base, so jq is the only addition.
#
# Runs as root like the other ci/images entries. Consumers that can drop
# privilege should set runAsNonRoot/runAsUser themselves — what the workload
# needs to read is workload-specific, so it does not belong baked in here.
#
# First consumer is the zigbee2mqtt seed-data init container. Worth recording why
# a real JSON parser is justified there rather than a sed/awk match: "key" occurs
# 12 times in that document (once per device with an APS link_key) and the FIRST
# occurrence is a DEVICE key, because "devices" sorts before "network_key". An
# unanchored extraction therefore yields a device link key, and herdsman then
# forms a NEW Zigbee network and drops every device.
RUN apk add --no-cache jq
