#!/usr/bin/env bash
# Explicit storage paths also work when a rootless Podman agent runs as UID 0
# inside its user namespace. Changing HOME alone then selects the system store.
moshiro_setup_buildah() {
  local store_home="${1:?Buildah cache directory is required}"
  local config="$store_home/.config/containers/moshiro-storage.conf"
  local key runroot temporary_config
  key="$(printf '%s' "$store_home" | sha256sum | cut -c1-16)"
  runroot="${XDG_RUNTIME_DIR:-/tmp}/moshiro-buildah-$(id -u)/$key"
  mkdir -p "$store_home/.local/share/containers/storage" "$(dirname "$config")" "$runroot"
  temporary_config="$(mktemp "$(dirname "$config")/moshiro-storage.XXXXXX")"
  (
    umask 077
    printf '[storage]\ndriver = "%s"\ngraphroot = "%s"\nrunroot = "%s"\n' \
      "${STORAGE_DRIVER:-overlay}" "$store_home/.local/share/containers/storage" "$runroot" > "$temporary_config"
  )
  # Several Linux RIDs can enter the shared store together. Readers must see
  # the complete configuration while another job initializes the same store.
  mv -f "$temporary_config" "$config"
  chmod 700 "$runroot"
  export CONTAINERS_STORAGE_CONF="$config"
  # The outer Podman container provides the user namespace and capabilities;
  # RUN does not need a second OCI runtime or nested cgroup management.
  export BUILDAH_ISOLATION="${BUILDAH_ISOLATION:-chroot}"
  local info_fd
  exec {info_fd}> "$store_home/.info.lock"
  flock -w 900 "$info_fd" || { echo "could not lock Buildah info for $store_home" >&2; return 1; }
  buildah info >/dev/null
  flock -u "$info_fd"
  exec {info_fd}>&-
  echo "Buildah store: $store_home/.local/share/containers/storage ($BUILDAH_ISOLATION)"
}