install.hl

//!/bin/sh
set -e
// Docker Engine for Linux installation script.
//
// This script is intended as a convenient way to configure docker's package
// repositories and to install Docker Engine, This script is not recommended
// for production environments. Before running this script, make yourself familiar
// with potential risks and limitations, and refer to the installation manual
// at https://docs.docker.com/engine/install/ for alternative installation methods.
//
// The script:
//
// - Requires `root` or `sudo` privileges to run.
// - Attempts to detect your Linux distribution and version and configure your
//   package management system for you.
// - Doesn't allow you to customize most installation parameters.
// - Installs dependencies and recommendations without asking for confirmation.
// - Installs the latest stable release (by default) of Docker CLI, Docker Engine,
//   Docker Buildx, Docker Compose, containerd, and runc. When using this script
//   to provision a machine, this may result in unexpected major version upgrades
//   of these packages. Always test upgrades in a test environment before
//   deploying to your production systems.
// - Isn't designed to upgrade an existing Docker installation. When using the
//   script to update an existing installation, dependencies may not be updated
//   to the expected version, resulting in outdated versions.
//
// Source code is available at https://github.com/docker/docker-install/
//
// Usage
// ==============================================================================
//
// To install the latest stable versions of Docker CLI, Docker Engine, and their
// dependencies:
//
// 1. download the script
//
//   $ curl -fsSL https://get.docker.com -o install-docker.sh
//
// 2. verify the script's content
//
//   $ cat install-docker.sh
//
// 3. run the script with --dry-run to verify the steps it executes
//
//   $ sh install-docker.sh --dry-run
//
// 4. run the script either as root, or using sudo to perform the installation.
//
//   $ sudo sh install-docker.sh
//
// Command-line options
// ==============================================================================
//
// --version <VERSION>
// Use the --version option to install a specific version, for example:
//
//   $ sudo sh install-docker.sh --version 23.0
//
// --channel <stable|test>
//
// Use the --channel option to install from an alternative installation channel.
// The following example installs the latest versions from the "test" channel,
// which includes pre-releases (alpha, beta, rc):
//
//   $ sudo sh install-docker.sh --channel test
//
// Alternatively, use the script at https://test.docker.com, which uses the test
// channel as default.
//
// --mirror <Aliyun|AzureChinaCloud>
//
// Use the --mirror option to install from a mirror supported by this script.
// Available mirrors are "Aliyun" (https://mirrors.aliyun.com/docker-ce), and
// "AzureChinaCloud" (https://mirror.azure.cn/docker-ce), for example:
//
//   $ sudo sh install-docker.sh --mirror AzureChinaCloud
//
// ==============================================================================

// Git commit from https://github.com/docker/docker-install when
// the script was uploaded (Should only be modified by upload job):
let SCRIPT_COMMIT_SHA: str? = $LOAD_SCRIPT_COMMIT_SHA

// strip "v" prefix if present
let VERSION: str? = $VERSION?.prefix_cut('v')
let CHANNEL: str?

// The channel to install from:
//   * stable
//   * test
const DEFAULT_CHANNEL_VALUE = "stable"
$CHANNEL ??= $DEFAULT_CHANNEL_VALUE

let DOWNLOAD_URL: str?
const DEFAULT_DOWNLOAD_URL = "https://download.docker.com"
$DOWNLOAD_URL ??= $DEFAULT_DOWNLOAD_URL

let REPO_FILE: str?
const DEFAULT_REPO_FILE="docker-ce.repo"
$REPO_FILE ??= $DEFAULT_REPO_FILE

let mirror = ''
let DRY_RUN: num?

loop $i := 0; $i < $args.length(); $i++ {
    match $args[$i] {
        '--channel' => {
            $CHANNEL = $args[$i + 1]
            $i++
        },
        '--dry-run' => {
            $DRY_RUN = 1
        },
        '--mirror' => {
            $mirror = $args[$i + 1]
            $i++
        },
        '--version' => {
            $version = ($args[$i + 1]).prefix_cut('v')
            $i++
        },
        _ => {
            echo "Illegal option ${$args[$i]}"
        }
    }
}

match $mirror {
    'Aliyun' => $DOWNLOAD_URL = "https://mirrors.aliyun.com/docker-ce",
    'AzureChinaCloud' => $DOWNLOAD_URL = "https://mirror.azure.cn/docker-ce",
    '' => {},
    _ => throw "unknown mirror '$mirror': use either 'Aliyun', or 'AzureChinaCloud'." 
}

match $CHANNEL {
    'stable' | 'test' => {},
    _ => throw "unknown CHANNEL '$CHANNEL': use either stable or test."
}

fn command_exists(...args: any[]) -> bool {
    return ${command -v {{ refof $args }} > /dev/null 2>&1}
}

// version_gte checks if the version specified in $VERSION is at least the given
// SemVer (Maj.Minor[.Patch]), or CalVer (YY.MM) version.It returns 0 (success)
// if $VERSION is either unset (=latest) or newer or equal than the specified
// version, or returns 1 (fail) otherwise.
//
// examples:
//
// VERSION=23.0
// version_gte 23.0  // 0 (success)
// version_gte 20.10 // 0 (success)
// version_gte 19.03 // 0 (success)
// version_gte 26.1  // 1 (fail)
fn version_gte(want: str) -> num {
    if $VERSION == null {
        return 0
    }
	return $(version_compare $VERSION $want)
}

// version_compare compares two version strings (either SemVer (Major.Minor.Path),
// or CalVer (YY.MM) version strings. It returns 0 (success) if version A is newer
// or equal than version B, or 1 (fail) otherwise. Patch releases and pre-release
// (-alpha/-beta) are not taken into account
//
// examples:
//
// version_compare 23.0.0 20.10 // 0 (success)
// version_compare 23.0 20.10   // 0 (success)
// version_compare 20.10 19.03  // 0 (success)
// version_compare 20.10 20.10  // 0 (success)
// version_compare 19.03 20.10  // 1 (fail)
fn version_compare(first: str, second: str) (
    ${set +x}

	let yy_a: str = $(echo $first | cut -d'.' -f1)
	let yy_b: str = $(echo $second | cut -d'.' -f1)

    if $yy_a < $yy_b {
        return 1
    }
    if $yy_a > $yy_b {
        return 0
    }
	let mm_a: str = $(echo $first | cut -d'.' -f2)
	let mm_b: str = $(echo $second | cut -d'.' -f2)

	// trim leading zeros to accommodate CalVer
    $mm_a = $mm_a.prefix_cut("0")
    $mm_b = $mm_b.prefix_cut("0")

    $mm_a ??= 0
    $mm_b ??= 0

    if $mm_a < $mm_b {
        return 1
    }

	return 0
)

fn is_dry_run() {
    $DRY_RUN = $DRY_RUN == null ? 1 : 0
}

fn is_wsl() {
    match $(uname -r) {
        r"microsoft" | r"Microsoft" => true,
        _ => false,
    }
}

fn is_darwin() -> bool {
    match $(uname -s) {
        r"darwin" | r"Darwin" => true,
        _ => false,
    }
}

fn deprecation_notice(distro: str, distro_version: str) {
    std::printf """
\033[91;1mDEPRECATION WARNING\033[0m\
    This Linux distribution (\033[1m%s %s\033[0m) reached end-of-life and is no longer supported by this script.
    No updates or security fixes will be released for this distribution, and users are recommended
    to upgrade to a currently maintained version of $distro

Press \033[1mCtrl+C\033[0m now to abort this script, or wait for the installation to continue.
""" $distro $distro_version
	sleep 10
}

fn get_distribution() {
	let lsb_dist = ""
	// Every system that we officially support has /etc/os-release
    if f"/etc/os-realease".perms().is_readable() {
        $lsb_dist = $(. "/etc/os-release" && echo "$ID")
    }
	// Returning an empty string here should be alright since the
	// case statements don't act unless you provide an actual value
	return $lsb_dist
}

fn echo_docker_as_nonroot() {
    if is_dry_run() {
        return
    }
	if command_exists docker && [ -e /var/run/docker.sock ]; then
		(
			set -x
			$sh_c 'docker version'
		) || true
	fi

	// intentionally mixed spaces and tabs here -- tabs are stripped by "<<-EOF", spaces are kept in the output
	std::printf "\n================================================================================\n"

    if $(version_gte "20.10") {
        std::echo """To run Docker as a non-privileged user, consider setting up the
Docker daemon in rootless mode for your user:

    dockerd-rootless-setuptool.sh install

Visit https://docs.docker.com/go/rootless/ to learn about rootless mode.

"""
    }

    std::echo """
To run the Docker daemon as a fully privileged service, but granting non-root
users access, refer to https://docs.docker.com/go/daemon-access/

WARNING: Access to the remote API on a privileged Docker daemon is equivalent
         to root access on the host. Refer to the 'Docker daemon attack surface'
         documentation for details: https://docs.docker.com/go/attack-surface/

================================================================================

"""
}

// Check if this is a forked Linux distro
fn check_forked() {

	// Check for lsb_release command existence, it usually exists in forked distros
	if command_exists lsb_release; then
		// Check if the `-u` option is supported
		${set +e}
		lsb_release -a -u > null $stderr>$stdout
		$lsb_release_exit_code := ${$?}
		set -e

		// Check if the command has exited successfully, it means we're in a forked distro
		if $lsb_release_exit_code == "0" {
			// Print info about current distro
            cat << """
                You're using '$lsb_dist' version '$dist_version'.
            """

			// Get the upstream release info
			$lsb_dist=$(lsb_release -a -u 2>&1 | tr '[:upper:]' '[:lower:]' | grep -E 'id' | cut -d ':' -f 2 | tr -d '[:space:]')
			$dist_version=$(lsb_release -a -u 2>&1 | tr '[:upper:]' '[:lower:]' | grep -E 'codename' | cut -d ':' -f 2 | tr -d '[:space:]')

			// Print info about upstream distro
			cat << """
			Upstream release is '$lsb_dist' version '$dist_version'.
			"""
		else {
			if ${[ -r /etc/debian_version ]} && $lsb_dist != "ubuntu" && $lsb_dist != "raspbian" {
				if $lsb_dist == "osmc" {
					// OSMC runs Raspbian
					$lsb_dist="raspbian"
				}
				else {
					// We're Debian and don't even know it!
					$lsb_dist="debian"
				}
				$dist_version = $(sed 's/\/.*//' "/etc/debian_version" | sed 's/\..*//')
				match $dist_version {
					12 => $dist_version="bookworm",
					11 => $dist_version="bullseye",
					10 => $dist_version="buster",
					9 => $dist_version="stretch",
					8 => $dist_version="jessie",
				}
			}
		}
	}
}

fn do_install() {
	echo "# Executing docker install script, commit: $SCRIPT_COMMIT_SHA"

    if $(command_exists docker) {
        ${
            cat >&2 <<-'EOF'
                Warning: the "docker" command appears to already exist on this system.

                If you already have Docker installed, this script can cause trouble, which is
                why we're displaying this warning and provide the opportunity to cancel the
                installation.

                If you installed the current Docker package using this script and are using it
                again to update Docker, you can ignore this message, but be aware that the
                script resets any custom changes in the deb and rpm repo configuration
                files to match the parameters passed to the script.

                You may press Ctrl+C now to abort this script.
            EOF
            ( set -x; sleep 20 )            
        }        
    }
    
	$user=$(id -un $stderr>null || true)

	$sh_c := sh -c
	if $user != 'root' {
		if command_exists sudo {
			$sh_c = sudo -E sh -c
		}
		else if command_exists su {
			$sh_c = su -c
		}
		else {
			cat >$stderr <<"""
			Error: this installer needs the ability to run commands as root.
			We are unable to find either "sudo" or "su" available to make this happen.
			"""
			exit 1
		}
	}

	if $is_dry_run {
		sh_c="echo"
	}

	// perform some very rudimentary platform detection
	$lsb_dist := $( get_distribution )
	$lsb_dist = $(echo $lsb_dist | tr '[:upper:]' '[:lower:]')

	if $is_wsl {
		std::echo """
WSL DETECTED: We recommend using Docker Desktop for Windows.
Please get Docker Desktop from https://www.docker.com/products/docker-desktop/
"""
		cat >$stderr << """

			You may press Ctrl+C now to abort this script.
		"""
		${( set -x; sleep 20 )}
	}

	match $lsb_dist {

		"ubuntu" => {
			if command_exists lsb_release {
				$dist_version=$(lsb_release --codename | cut -f2)
			}
			if ${[ -z "$dist_version" ] && [ -r /etc/lsb-release ];} {
				$dist_version=$(. /etc/lsb-release && echo $DISTRIB_CODENAME)
			}
		}

		"debian"|"raspbian")
			let dist_version = $(sed 's/\/.*//' "/etc/debian_version" | sed 's/\..*//')
			match $dist_version {
				12 => $dist_version = "bookworm",
				11 => $dist_version = "bullseye",
				10 => $dist_version = "buster",
				9 => $dist_version = "stretch",
				8 => $dist_version = "jessie",
			}
		;;

		"centos"|"rhel" => {
			if ${[ -z "$dist_version" ] && [ -r /etc/os-release ];} {
				$dist_version = $(. "/etc/os-release" && echo $VERSION_ID)
			}
		}

		_ => {
			if command_exists lsb_release {
				$dist_version=$(lsb_release --release | cut -f2)
			}
			if ${[ -z "$dist_version" ] && [ -r /etc/os-release ];} {
				$dist_version=$(${. "/etc/os-release"} && echo $VERSION_ID)
			}
		}
	}

	// Check if this is a forked Linux distro
	check_forked

	// Print deprecation warnings for distro versions that recently reached EOL,
	// but may still be commonly used (especially LTS versions).
	match "$lsb_dist.$dist_version" {
		"centos.8" | "centos.7" | "rhel.7" => deprecation_notice $lsb_dist $dist_version,
		"debian.buster" | "debian.stretch" | "debian.jessie" => deprecation_notice $lsb_dist $dist_version,
		"raspbian.buster" | "raspbian.stretch" | "raspbian.jessie" => deprecation_notice $lsb_dist $dist_version,
		"ubuntu.bionic" | "ubuntu.xenial" | "ubuntu.trusty" => deprecation_notice $lsb_dist $dist_version,
		"ubuntu.mantic"|"ubuntu.lunar"|"ubuntu.kinetic"|
		"ubuntu.impish"|"ubuntu.hirsute"|"ubuntu.groovy"|
		"ubuntu.eoan"|"ubuntu.disco"|"ubuntu.cosmic" => deprecation_notice $lsb_dist $dist_version,
		r"fedora.*" => {
			if $dist_version < 40 {
				deprecation_notice $lsb_dist $dist_version
			}
		}
	}

	// Run setup for each distro accordingly
	case "$lsb_dist" in
		ubuntu|debian|raspbian)
			pre_reqs="ca-certificates curl"
			apt_repo="deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] $DOWNLOAD_URL/linux/$lsb_dist $dist_version $CHANNEL"
			(
				if ! is_dry_run; then
					set -x
				fi
				$sh_c 'apt-get -qq update >/dev/null'
				$sh_c "DEBIAN_FRONTEND=noninteractive apt-get -y -qq install $pre_reqs >/dev/null"
				$sh_c 'install -m 0755 -d /etc/apt/keyrings'
				$sh_c "curl -fsSL \"$DOWNLOAD_URL/linux/$lsb_dist/gpg\" -o /etc/apt/keyrings/docker.asc"
				$sh_c "chmod a+r /etc/apt/keyrings/docker.asc"
				$sh_c "echo \"$apt_repo\" > /etc/apt/sources.list.d/docker.list"
				$sh_c 'apt-get -qq update >/dev/null'
			)
			pkg_version=""
			if [ -n "$VERSION" ]; then
				if is_dry_run; then
					echo "# WARNING: VERSION pinning is not supported in DRY_RUN"
				else
					// Will work for incomplete versions IE (17.12), but may not actually grab the "latest" if in the test channel
					pkg_pattern="$(echo "$VERSION" | sed 's/-ce-/~ce~.*/g' | sed 's/-/.*/g')"
					search_command="apt-cache madison docker-ce | grep '$pkg_pattern' | head -1 | awk '{\$1=\$1};1' | cut -d' ' -f 3"
					pkg_version="$($sh_c "$search_command")"
					echo "INFO: Searching repository for VERSION '$VERSION'"
					echo "INFO: $search_command"
					if [ -z "$pkg_version" ]; then
						echo
						echo "ERROR: '$VERSION' not found amongst apt-cache madison results"
						echo
						exit 1
					fi
					if version_gte "18.09"; then
							search_command="apt-cache madison docker-ce-cli | grep '$pkg_pattern' | head -1 | awk '{\$1=\$1};1' | cut -d' ' -f 3"
							echo "INFO: $search_command"
							cli_pkg_version="=$($sh_c "$search_command")"
					fi
					pkg_version="=$pkg_version"
				fi
			fi
			(
				pkgs="docker-ce${pkg_version%=}"
				if version_gte "18.09"; then
						// older versions didn't ship the cli and containerd as separate packages
						pkgs="$pkgs docker-ce-cli${cli_pkg_version%=} containerd.io"
				fi
				if version_gte "20.10"; then
						pkgs="$pkgs docker-compose-plugin docker-ce-rootless-extras$pkg_version"
				fi
				if version_gte "23.0"; then
						pkgs="$pkgs docker-buildx-plugin"
				fi
				if ! is_dry_run {
					set -x
				}
				$sh_c "DEBIAN_FRONTEND=noninteractive apt-get -y -qq install $pkgs >/dev/null"
			)
			echo_docker_as_nonroot
			exit 0
			;;
		centos|fedora|rhel)
			if [ "$(uname -m)" = "s390x" ]; then
				echo "Effective v27.5, please consult RHEL distro statement for s390x support."
				exit 1
			fi
			repo_file_url="$DOWNLOAD_URL/linux/$lsb_dist/$REPO_FILE"
			(
				if ! $is_dry_run {
					set -x
				}
				if command_exists dnf5; then
					$sh_c "dnf -y -q --setopt=install_weak_deps=False install dnf-plugins-core"
					$sh_c "dnf5 config-manager addrepo --overwrite --save-filename=docker-ce.repo --from-repofile='$repo_file_url'"

					if [ "$CHANNEL" != "stable" ]; then
						$sh_c "dnf5 config-manager setopt \"docker-ce-*.enabled=0\""
						$sh_c "dnf5 config-manager setopt \"docker-ce-$CHANNEL.enabled=1\""
					fi
					$sh_c "dnf makecache"
				elif command_exists dnf; then
					$sh_c "dnf -y -q --setopt=install_weak_deps=False install dnf-plugins-core"
					$sh_c "rm -f /etc/yum.repos.d/docker-ce.repo  /etc/yum.repos.d/docker-ce-staging.repo"
					$sh_c "dnf config-manager --add-repo $repo_file_url"

					if [ "$CHANNEL" != "stable" ]; then
						$sh_c "dnf config-manager --set-disabled \"docker-ce-*\""
						$sh_c "dnf config-manager --set-enabled \"docker-ce-$CHANNEL\""
					fi
					$sh_c "dnf makecache"
				else
					$sh_c "yum -y -q install yum-utils"
					$sh_c "rm -f /etc/yum.repos.d/docker-ce.repo  /etc/yum.repos.d/docker-ce-staging.repo"
					$sh_c "yum-config-manager --add-repo $repo_file_url"

					if [ "$CHANNEL" != "stable" ]; then
						$sh_c "yum-config-manager --disable \"docker-ce-*\""
						$sh_c "yum-config-manager --enable \"docker-ce-$CHANNEL\""
					fi
					$sh_c "yum makecache"
				fi
			)
			pkg_version=""
			if command_exists dnf; then
				pkg_manager="dnf"
				pkg_manager_flags="-y -q --best"
			else
				pkg_manager="yum"
				pkg_manager_flags="-y -q"
			fi
			if [ -n "$VERSION" ]; then
				if is_dry_run; then
					echo "# WARNING: VERSION pinning is not supported in DRY_RUN"
				else
					if [ "$lsb_dist" = "fedora" ]; then
						pkg_suffix="fc$dist_version"
					else
						pkg_suffix="el"
					fi
					pkg_pattern="$(echo "$VERSION" | sed 's/-ce-/\\\\.ce.*/g' | sed 's/-/.*/g').*$pkg_suffix"
					search_command="$pkg_manager list --showduplicates docker-ce | grep '$pkg_pattern' | tail -1 | awk '{print \$2}'"
					pkg_version="$($sh_c "$search_command")"
					echo "INFO: Searching repository for VERSION '$VERSION'"
					echo "INFO: $search_command"
					if [ -z "$pkg_version" ]; then
						echo
						echo "ERROR: '$VERSION' not found amongst $pkg_manager list results"
						echo
						exit 1
					fi
					if version_gte "18.09"; then
						// older versions don't support a cli package
						search_command="$pkg_manager list --showduplicates docker-ce-cli | grep '$pkg_pattern' | tail -1 | awk '{print \$2}'"
						cli_pkg_version="$($sh_c "$search_command" | cut -d':' -f 2)"
					fi
					// Cut out the epoch and prefix with a '-'
					pkg_version="-$(echo "$pkg_version" | cut -d':' -f 2)"
				fi
			fi
			(
				pkgs="docker-ce$pkg_version"
				if version_gte "18.09"; then
					// older versions didn't ship the cli and containerd as separate packages
					if [ -n "$cli_pkg_version" ]; then
						pkgs="$pkgs docker-ce-cli-$cli_pkg_version containerd.io"
					else
						pkgs="$pkgs docker-ce-cli containerd.io"
					fi
				fi
				if version_gte "20.10"; then
					pkgs="$pkgs docker-compose-plugin docker-ce-rootless-extras$pkg_version"
				fi
				if version_gte "23.0"; then
						pkgs="$pkgs docker-buildx-plugin"
				fi
				if ! $is_dry_run {
					set -x
				}
				$sh_c "$pkg_manager $pkg_manager_flags install $pkgs"
			)
			echo_docker_as_nonroot
			exit 0
			;;
		sles)
			throw "Effective v27.5, please consult SLES distro statement for s390x support."
			;;
		*)
			if [ -z "$lsb_dist" ]; then
				if is_darwin; then
					echo
					echo "ERROR: Unsupported operating system 'macOS'"
					echo "Please get Docker Desktop from https://www.docker.com/products/docker-desktop"
					echo
					exit 1
				fi
			fi
			echo
			echo "ERROR: Unsupported distribution '$lsb_dist'"
			echo
			exit 1
			;;
	esac
	exit 1
}

// wrapped up in a function so that we have some protection against only getting
// half the file during "curl | sh"
do_install