# Image for the REAL-runtime run of the container canary test (STORY-348
# T-PB-348f; conformance-adversarial.test.sh class 6 with
# CANARY_CONTAINER_RUNTIME=docker|podman). The test hands this file to
# lib/sandbox.sh as a stack pack's image definition, so the image is built by
# the same sandbox_ensure_image path a client's pack image is. The tag hashes
# this file only — the test removes the tag first so an edited exfil-agent is
# always rebuilt.
FROM alpine:3.20
RUN apk add --no-cache bash curl git
COPY exfil-agent /usr/local/bin/exfil-agent
RUN chmod 755 /usr/local/bin/exfil-agent && mkdir -p /home/agent && chmod 1777 /home/agent
ENV HOME=/home/agent
