FROM registry.opensuse.org/opensuse/tumbleweed:latest
MAINTAINER Jan Baier <jbaier@suse.cz>

# Basic metadata
LABEL maintainer="Jan Baier <jbaier@suse.cz>" \
      description="Paddock - Hardened AI sandbox container"

# 1. Install core system packages
RUN zypper --non-interactive refresh && \
    zypper --non-interactive install --no-recommends \
        bash \
        ca-certificates \
        curl \
        diffutils \
        file \
        findutils \
        gawk \
        gemini-cli \
        git \
        gzip \
        jq \
        less \
        nodejs \
        npm \
        opencode \
        openssh-clients \
        openssl \
        python3 \
        sqlite3 \
        starship \
        tar \
        unzip \
        util-linux \
        wget \
        which \
        zip \
    && zypper clean --all \
    && rm -rf /var/cache/zypp/* /tmp/* /var/tmp/*

# 2. Install the Google Cloud CLI globally.
# NOTE: the cloud-sdk repo is x86_64-only, so this image is x86_64-only.
# NOTE: Google signs RPMs and repo metadata with two different keys --
# rpm-package-key.gpg and the repo's own repomd.xml.key -- both are imported.
RUN rpm --import https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg && \
    rpm --import https://packages.cloud.google.com/yum/repos/cloud-sdk-el10-x86_64/repodata/repomd.xml.key && \
    rpm --import https://download.opensuse.org/repositories/SUSE:/CA/openSUSE_Tumbleweed/repodata/repomd.xml.key && \
    zypper --non-interactive addrepo --gpgcheck --refresh --name "Google Cloud CLI" https://packages.cloud.google.com/yum/repos/cloud-sdk-el10-x86_64 google-cloud-cli && \
    zypper --non-interactive addrepo --gpgcheck --refresh https://download.opensuse.org/repositories/SUSE:/CA/openSUSE_Tumbleweed/SUSE:CA.repo && \
    zypper --non-interactive refresh && \
    zypper --non-interactive install --no-recommends ca-certificates-suse google-cloud-cli && \
    zypper clean --all && \
    rm -rf /var/cache/zypp/* /tmp/* /var/tmp/*

# 3. Minimal developer tools; personally override this layer for project-specific tooling.
RUN zypper --non-interactive refresh && \
    zypper --non-interactive install --no-recommends \
        ShellCheck \
        bash-completion \
        make \
        vim \
    && zypper clean --all \
    && rm -rf /var/cache/zypp/* /tmp/* /var/tmp/*

# 4. Create non-root user `ai` with a pristine home directory
RUN groupadd --gid 1000 ai && \
    useradd --uid 1000 --gid 1000 --home-dir /home/ai --shell /bin/bash --no-create-home ai && \
    mkdir -p /home/ai && \
    chown ai:ai /home/ai

# 5. Global configurations
# aaa_base runs tty unconditionally; under krun it fails on /dev/console and prints an error per shell start.
RUN echo 'eval "$(starship init bash)"' >> /etc/bash.bashrc && \
    sed -i 's|GPG_TTY="`tty`"|GPG_TTY="`tty 2>/dev/null`"|' /etc/bash.bashrc && \
    grep -qF 'tty 2>/dev/null' /etc/bash.bashrc

# 6. Copy and setup entrypoint script for secure guest VM privilege dropping
COPY --chmod=755 profile/entrypoint.sh /usr/local/bin/entrypoint.sh

USER ai
ENV HOME=/home/ai \
    LANG=C.UTF-8 \
    LC_ALL=C.UTF-8 \
    PATH=/usr/local/bin:/usr/bin:/bin \
    TERM=xterm-256color

WORKDIR /home/ai

ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
CMD ["bash"]
