# =====================================================
#  AI Agents Sandbox — Unique Containerfile Multi-stage
# =====================================================

# ================
# Global arguments
# ----------------
ARG BASE_IMAGE="registry.opensuse.org/home/vlefebvre/container-images/containers/opensuse/ai-agents-sandbox-base:latest"
ARG TARGET_STAGE="${BASE_IMAGE}"

# ============================================
# "From scratch" stage to build the base image
# --------------------------------------------
FROM registry.opensuse.org/opensuse/tumbleweed:latest AS from-scratch

ARG AI_USER=aiuser
ARG AI_UID=1000
ARG AI_GID=1000

USER root

# Repositories
RUN zypper --non-interactive addrepo \
        https://download.opensuse.org/repositories/home:/vlefebvre/openSUSE_Tumbleweed/ \
        home_vlefebvre && \
    zypper --non-interactive addrepo \
        https://download.opensuse.org/repositories/home:/val4oss/openSUSE_Tumbleweed/ \
        home_val4oss && \
    zypper --non-interactive --gpg-auto-import-keys refresh

# System Package
RUN zypper --non-interactive update && \
    zypper --non-interactive install --no-recommends \
        bash ca-certificates coreutils curl customize-ps1 diffutils figlet file \
        findutils gawk grep git gzip iproute2 iputils jq less nodejs npm patch \
        procps python3 python3-pip sed shadow ShellCheck sindrai \
        sindrai-skills-go-cve-investigation sindrai-skills-packaging \
        sindrai-skills-shell-scripting socat tar toilet unzip util-linux \
        vim-small wget which xclip && \
    zypper clean --all && \
    rm -rf /var/cache/zypp/* /tmp/* /var/tmp/*

# Create non-root user
RUN groupadd --gid $AI_GID $AI_USER && \
    useradd \
      --uid $AI_UID \
      --gid $AI_GID \
      --home-dir /home/$AI_USER \
      --shell /bin/bash \
      --create-home \
      $AI_USER

# Scripts for init and skel setup
COPY --chmod=755 scripts/entrypoint.sh /usr/local/bin/entrypoint.sh
COPY --chown=$AI_UID:$AI_GID --chmod=744 \
    agents /usr/share/ai-agents-sandbox/agents
COPY --chown=$AI_UID:$AI_GID --chmod=744 \
    skel   /usr/share/ai-agents-sandbox/skel


# ==========================================================
# Final stage to build customized image with selected agents
# ----------------------------------------------------------
FROM ${TARGET_STAGE} AS final

ARG BUILD_AGENTS="copilot gemini claude opencode antigravity hermes-agent"
ARG IMG_TAG="0.0.0"
ARG AI_USER=aiuser
ARG REPOS=""
ARG PKGS=""
ARG HOOKS_BUILD="hooks/build"

LABEL maintainer="val4oss" \
      description="AI Agents sandbox - ${BUILD_AGENTS}, rootless" \
      version="${IMG_TAG}" \
      security.caps="none" \
      security.network="pasta" \
      security.credentials="runtime-only"

USER root

# Optional Repositories
RUN if [ -n "$REPOS" ]; then \
        for _repo in ${REPOS}; do \
            zypper --non-interactive ar "${_repo}"; \
        done; \
    fi
RUN zypper --non-interactive --gpg-auto-import-keys refresh

# Optional System Packages
RUN if [ -n "$PKGS" ]; then \
        zypper --non-interactive refresh && \
        zypper --non-interactive update && \
        zypper --non-interactive install --no-recommends ${PKGS} && \
        zypper clean --all && \
        rm -rf /var/cache/zypp/* /tmp/* /var/tmp/*; \
    fi

# GitHub CLI (gh) - installed when BUILD_AGENTS contains copilot
RUN case " $BUILD_AGENTS " in \
    *\ copilot\ *) \
        zypper --non-interactive addrepo \
            https://cli.github.com/packages/rpm/gh-cli.repo && \
        zypper --non-interactive --gpg-auto-import-keys refresh gh-cli && \
        zypper --non-interactive install --no-recommends gh && \
        zypper clean --all && \
        rm -rf /var/cache/zypp/* \
    ;; \
    esac

# Google Cloud SDK - installed when BUILD_AGENTS contains claude or opencode
RUN case " $BUILD_AGENTS " in \
    *\ claude\ *|*\ opencode\ *) \
        REPO_ARCH=$(uname -m) && \
        rpm --import https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg && \
        zypper refresh && \
        zypper --non-interactive addrepo \
            https://packages.cloud.google.com/yum/repos/cloud-sdk-el10-${REPO_ARCH} \
            google-cloud-cli && \
        zypper --non-interactive --gpg-auto-import-keys refresh google-cloud-cli && \
        zypper --non-interactive install --no-recommends google-cloud-cli && \
        zypper clean --all && \
        rm -rf /var/cache/zypp/* \
    ;; \
    esac

# AI agents - installed selectively based on BUILD_AGENTS list
RUN case " $BUILD_AGENTS " in *" gemini "*) \
        command -v gemini >/dev/null 2>&1 ||\
            npm install -g --prefix /usr/local @google/gemini-cli ;; esac && \
    case " $BUILD_AGENTS " in *" claude "*) \
        command -v claude >/dev/null 2>&1 ||\
            npm install -g --prefix /usr/local \
                --allow-scripts=@anthropic-ai/claude-code \
                @anthropic-ai/claude-code ;; esac && \
    case " $BUILD_AGENTS " in *" opencode "*) \
        command -v opencode >/dev/null 2>&1 ||\
            npm install -g --prefix /usr/local opencode-ai ;; esac && \
    case " $BUILD_AGENTS " in *" copilot "*) \
        command -v copilot >/dev/null 2>&1 ||\
            wget -qO- https://gh.io/copilot-install | bash ;; esac && \
    case " $BUILD_AGENTS " in *" antigravity "*) \
        command -v agy >/dev/null 2>&1 ||\
            curl -fsSL https://antigravity.google/cli/install.sh | \
            bash -s -- -d "/usr/local/bin" ;; esac && \
    case " $BUILD_AGENTS " in *" hermes-agent "*) \
        command -v hermes-agent >/dev/null 2>&1 ||\
            curl -fsSL https://hermes-agent.nousresearch.com/install.sh | \
            bash -s -- --skip-setup --non-interactive --skip-browser ;; esac

# Installers run as root and may write files in the user HOME
RUN chown -R "${AI_USER}:" "/home/${AI_USER}"

# Build script ingestion
COPY --chmod=555 ${HOOKS_BUILD}/ /usr/local/bin/ai-agents-sandbox-build-hooks/
RUN set -e;\
    if [ -d "/usr/local/bin/ai-agents-sandbox-build-hooks/" ]; then \
        for script in $(find /usr/local/bin/ai-agents-sandbox-build-hooks/ \
                        -type f \
                        -name "*.sh" | sort); do\
            sh "$script" || exit 1; \
        done; \
    fi

# Exec config
USER $AI_USER

ENV HOME=/home/aiuser \
    HOSTNAME=ai-sandbox \
    CONTAINER_ID=ai-sandbox \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    GH_CONFIG_DIR=/home/aiuser/.config/gh \
    NPM_CONFIG_PREFIX=/home/aiuser/.npm-global \
    TERM=xterm-256color \
    AGENT="${BUILD_AGENTS}"

WORKDIR /home/$AI_USER

ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
CMD ["bash", "--login"]
