ADD alpine-minirootfs-3.23.4-aarch64.tar.gz / # buildkit

CMD ["/bin/sh"]

ENV JAVA_HOME=/opt/java/openjdk

ENV PATH=/opt/java/openjdk/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

ENV LANG=en_US.UTF-8 LANGUAGE=en_US:en LC_ALL=en_US.UTF-8

RUN /bin/sh -c set -eux; apk add --no-cache fontconfig ttf-dejavu gnupg ca-certificates p11-kit-trust musl-locales musl-locales-lang tzdata coreutils openssl ; rm -rf /var/cache/apk/* # buildkit

ENV JAVA_VERSION=jdk-21.0.10+7

RUN /bin/sh -c set -eux; ARCH="$(apk --print-arch)"; case "${ARCH}" in aarch64) ESUM='d1cd7b33dcd81293b0b705f4d0e79adce092786be31736a63abe6a4b31841ae5'; BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.10%2B7/OpenJDK21U-jre_aarch64_alpine-linux_hotspot_21.0.10_7.tar.gz'; ;; x86_64) ESUM='4f6200277644afe6ad49218ae1dd45ab3d0d0b2ac4109163604e36156a93a306'; BINARY_URL='https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.10%2B7/OpenJDK21U-jre_x64_alpine-linux_hotspot_21.0.10_7.tar.gz'; ;; *) echo "Unsupported arch: ${ARCH}"; exit 1; ;; esac; wget -O /tmp/openjdk.tar.gz ${BINARY_URL}; wget -O /tmp/openjdk.tar.gz.sig ${BINARY_URL}.sig; export GNUPGHOME="$(mktemp -d)"; gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 3B04D753C9050D9A5D343F39843C48A565F8F04B; gpg --batch --verify /tmp/openjdk.tar.gz.sig /tmp/openjdk.tar.gz; rm -rf "${GNUPGHOME}" /tmp/openjdk.tar.gz.sig; echo "${ESUM} */tmp/openjdk.tar.gz" | sha256sum -c -; mkdir -p "$JAVA_HOME"; tar --extract --file /tmp/openjdk.tar.gz --directory "$JAVA_HOME" --strip-components 1 --no-same-owner ; rm -f /tmp/openjdk.tar.gz; # buildkit

RUN /bin/sh -c set -eux; echo "Verifying install ..."; echo "java --version"; java --version; echo "Complete." # buildkit

COPY --chmod=755 entrypoint.sh /__cacert_entrypoint.sh # buildkit

ENTRYPOINT ["/__cacert_entrypoint.sh"]

EXPOSE [9092/tcp]

USER root

ARG kafka_url=https://dist.apache.org/repos/dist/dev/kafka/4.3.0-rc0/kafka_2.13-4.3.0.tgz

ARG build_date=2026-04-28

COPY *kafka.tgz kafka.tgz # buildkit

LABEL org.label-schema.name=kafka org.label-schema.description=Apache Kafka org.label-schema.build-date=2026-04-28 org.label-schema.vcs-url=https://github.com/apache/kafka org.opencontainers.image.authors=Apache Kafka

RUN |2 kafka_url=https://dist.apache.org/repos/dist/dev/kafka/4.3.0-rc0/kafka_2.13-4.3.0.tgz build_date=2026-04-28 /bin/sh -c mkdir opt/kafka; set -eux ; apk update ; apk upgrade ; apk add --no-cache bash; if [ -n "$kafka_url" ]; then apk add --no-cache wget gcompat gpg gpg-agent procps; wget -nv -O kafka.tgz "$kafka_url"; wget -nv -O kafka.tgz.asc "$kafka_url.asc"; tar xfz kafka.tgz -C /opt/kafka --strip-components 1; wget -nv -O KEYS https://downloads.apache.org/kafka/KEYS; gpg --import KEYS; gpg --batch --verify kafka.tgz.asc kafka.tgz; rm kafka.tgz kafka.tgz.asc KEYS; apk del wget gpg gpg-agent; else tar xfz kafka.tgz -C /opt/kafka --strip-components 1; rm kafka.tgz; fi; mkdir -p /var/lib/kafka/data /etc/kafka/secrets; mkdir -p /etc/kafka/docker /usr/logs /mnt/shared/config; adduser -h /home/appuser -D --shell /bin/bash appuser; chown appuser:appuser -R /usr/logs /opt/kafka /mnt/shared/config; chown appuser:root -R /var/lib/kafka /etc/kafka/secrets /etc/kafka; chmod -R ug+w /etc/kafka /var/lib/kafka /etc/kafka/secrets; cp /opt/kafka/config/log4j2.yaml /etc/kafka/docker/log4j2.yaml; cp /opt/kafka/config/tools-log4j2.yaml /etc/kafka/docker/tools-log4j2.yaml; apk cache clean; # buildkit

COPY server.properties /etc/kafka/docker/server.properties # buildkit

COPY kafka.jsa /opt/kafka/kafka.jsa # buildkit

COPY storage.jsa /opt/kafka/storage.jsa # buildkit

COPY --chown=appuser:appuser resources/common-scripts /etc/kafka/docker # buildkit

COPY --chown=appuser:appuser launch /etc/kafka/docker/launch # buildkit

USER appuser

VOLUME [/etc/kafka/secrets /var/lib/kafka/data /mnt/shared/config]

CMD ["/etc/kafka/docker/run"]