# Agent Sandbox — isolated Linux environment for CLI coding agents
# Designed for macOS hosts (Docker Desktop / OrbStack)
FROM ubuntu:24.04

ARG TARGETARCH
ARG DEBIAN_FRONTEND=noninteractive
ARG USERNAME=agent
ARG USER_UID=1000
ARG USER_GID=1000

LABEL org.opencontainers.image.title="asandbox" \
      org.opencontainers.image.description="Secure Docker sandbox for CLI AI coding agents" \
      org.opencontainers.image.source="local"

# Base tools
RUN apt-get update && apt-get install -y --no-install-recommends \
        ca-certificates \
        curl \
        wget \
        git \
        gnupg \
        openssh-client \
        sudo \
        less \
        nano \
        vim-tiny \
        jq \
        unzip \
        zip \
        tar \
        gzip \
        bzip2 \
        xz-utils \
        build-essential \
        python3 \
        python3-pip \
        python3-venv \
        python3-dev \
        ripgrep \
        fd-find \
        tree \
        rsync \
        locales \
        tzdata \
        procps \
        iproute2 \
        iputils-ping \
        dnsutils \
    && rm -rf /var/lib/apt/lists/* \
    && ln -sf /usr/bin/fdfind /usr/local/bin/fd \
    && locale-gen en_US.UTF-8

ENV LANG=en_US.UTF-8 \
    LC_ALL=en_US.UTF-8 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PIP_NO_CACHE_DIR=1 \
    NPM_CONFIG_UPDATE_NOTIFIER=false \
    NPM_CONFIG_FUND=false

# Node.js 22 LTS (many agents are Node-based)
RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
    && apt-get install -y --no-install-recommends nodejs \
    && rm -rf /var/lib/apt/lists/* \
    && corepack enable || true

# uv (fast Python package manager)
RUN curl -LsSf https://astral.sh/uv/install.sh | sh \
    && mv /root/.local/bin/uv /usr/local/bin/uv \
    && mv /root/.local/bin/uvx /usr/local/bin/uvx 2>/dev/null || true

# Create non-root user matching host UID/GID when possible (macOS staff=20 often exists as dialout)
RUN set -eux; \
    if getent group "${USER_GID}" >/dev/null; then \
      EXISTING_GROUP="$(getent group "${USER_GID}" | cut -d: -f1)"; \
      useradd --uid "${USER_UID}" --gid "${USER_GID}" -m -s /bin/bash "${USERNAME}" \
        || useradd --uid "${USER_UID}" -g "${EXISTING_GROUP}" -m -s /bin/bash "${USERNAME}"; \
    else \
      groupadd --gid "${USER_GID}" "${USERNAME}"; \
      useradd --uid "${USER_UID}" --gid "${USER_GID}" -m -s /bin/bash "${USERNAME}"; \
    fi; \
    echo "${USERNAME} ALL=(ALL) NOPASSWD:ALL" > "/etc/sudoers.d/${USERNAME}"; \
    chmod 0440 "/etc/sudoers.d/${USERNAME}"

# installagent + shell integration (agents installed on demand inside shell)
COPY installagent /usr/local/bin/installagent
COPY entrypoint.sh /usr/local/bin/asandbox-entrypoint
COPY bashrc.asandbox /etc/asandbox.bashrc
RUN chmod +x /usr/local/bin/installagent /usr/local/bin/asandbox-entrypoint \
    && echo 'source /etc/asandbox.bashrc' >> /home/${USERNAME}/.bashrc \
    && echo 'source /etc/asandbox.bashrc' >> /home/${USERNAME}/.profile \
    && mkdir -p /home/${USERNAME}/.local/bin /home/${USERNAME}/.npm-global/bin \
    && chown -R ${USERNAME} /home/${USERNAME}

# Workspace mount point (host path is also bind-mounted at real path)
RUN mkdir -p /workspace && chown ${USERNAME} /workspace

WORKDIR /workspace
USER ${USERNAME}
ENV HOME=/home/${USERNAME} \
    PATH="/home/${USERNAME}/.local/bin:/home/${USERNAME}/.npm-global/bin:/usr/local/bin:${PATH}"

ENTRYPOINT ["/usr/local/bin/asandbox-entrypoint"]
CMD ["bash", "-l"]