From 0971e58d52e08ba916deca9414ab83365407db81 Mon Sep 17 00:00:00 2001
From: Robert-Jan Huijsman <22160949+rjhuijsman@users.noreply.github.com>
Date: Tue, 18 Aug 2026 11:01:17 +0000
Subject: [PATCH] Dockerfile: install the Ory CLI on workstations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Managing our Ory Network projects — authenticating, and applying
their configuration — needs the `ory` CLI, which the workstation
image didn't include. Install the non-sqlite Linux build: the
`sqlite` variants link against GLIBC 2.38, newer than this image
(Ubuntu Jammy / GLIBC 2.35).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 Dockerfile | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index e587b446..afb451b1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -324,6 +324,24 @@ RUN curl --retry 5 --retry-all-errors -fSsL https://github.com/groundcover-com/c
     && tar -zxf /tmp/groundcover.tar.gz -C /usr/bin \
     && chmod +x /usr/bin/groundcover
 
+# Install the Ory CLI so developers can `ory auth` and manage Ory
+# Network projects. The non-sqlite build is deliberate: the `sqlite`
+# variants link against GLIBC 2.38, newer than this image (Ubuntu
+# Jammy, GLIBC 2.35).
+ARG ORY_VERSION=1.3.1
+RUN set -e; \
+    if [ "${TARGETARCH}" = "amd64" ]; then \
+    ARCH_SUFFIX="64bit"; \
+    elif [ "${TARGETARCH}" = "arm64" ]; then \
+    ARCH_SUFFIX="arm64"; \
+    else \
+    echo "Unsupported arch: ${TARGETARCH}" && exit 1; \
+    fi; \
+    curl --retry 5 --retry-all-errors -fsL "https://github.com/ory/cli/releases/download/v${ORY_VERSION}/ory_${ORY_VERSION}-linux_${ARCH_SUFFIX}.tar.gz" -o ory.tar.gz \
+    && tar -zxf ory.tar.gz -C /usr/local/bin/ ory \
+    && rm ory.tar.gz \
+    && chmod +x /usr/local/bin/ory
+
 # Install the Envoy binary, so we can run the tests that use
 # local-binary Envoy rather than Docker-based Envoy.
 RUN set -e; \