# stack-python-uv — the container image a `runners.<role>.sandbox: container`
# role runs in when the project composes this pack (and no earlier pack in
# profile.extends ships an image) and sets no runners.<role>.sandbox_image
# (STORY-348 T-PB-348b, AC-2). lib/sandbox.sh builds it on first use as
# `harness-stack-python-uv:<content hash>`; editing this file changes the tag.
#
# What it carries: CPython 3.12 with uv/uvx (the pack's gates are all
# `uv run --frozen …`; uv uses this interpreter and never downloads one), the
# engine's GNU userland, and — because the agent client is a Node program —
# Node 22 copied from the official image, plus the client itself.
#
# HOME is a world-writable /home/agent (the container runs as the operator's
# uid on Linux hosts), and uv's cache lives under it. AGENT_CLIENT_NPM=''
# builds without a client.
ARG PYTHON_VERSION=3.12
ARG NODE_VERSION=22
ARG UV_VERSION=0.8
FROM ghcr.io/astral-sh/uv:${UV_VERSION}-alpine AS uv
FROM node:${NODE_VERSION}-alpine AS node
FROM python:${PYTHON_VERSION}-alpine

ARG AGENT_CLIENT_NPM=@anthropic-ai/claude-code

ENV HOME=/home/agent \
    UV_PYTHON_DOWNLOADS=never \
    UV_LINK_MODE=copy \
    USE_BUILTIN_RIPGREP=0

COPY --from=uv /usr/local/bin/uv /usr/local/bin/uvx /usr/local/bin/
COPY --from=node /usr/local/bin/node /usr/local/bin/node
COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules

RUN apk add --no-cache bash git jq ca-certificates coreutils findutils grep sed gawk \
      diffutils util-linux tar libgcc libstdc++ ripgrep \
 && ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
 && ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \
 && if [ -n "$AGENT_CLIENT_NPM" ]; then npm install -g --no-fund --no-audit $AGENT_CLIENT_NPM; fi \
 && npm cache clean --force \
 && rm -rf "$HOME" && mkdir -p "$HOME" && chmod 1777 "$HOME"

WORKDIR /workspace
CMD ["bash"]
