# Derived Keycloak image with the four realm exports baked into the import dir.
# `start-dev --import-realm` reads /opt/keycloak/data/import at boot. Baking the
# realms in (rather than bind-mounting ./realms) keeps the import working on
# Gitea's containerized runner, where bind mounts do not reach sibling
# containers. See docs/runbooks/gitea-actions-gotchas.md.
FROM quay.io/keycloak/keycloak:26.1
COPY realms /opt/keycloak/data/import