# Production must supply a digest-pinned base, e.g. ubuntu:24.04@sha256:...
ARG BASE_IMAGE=ubuntu:24.04
FROM ${BASE_IMAGE}
ARG DEBIAN_FRONTEND=noninteractive
ARG PNPM_VERSION=11.6.0
ARG DEVELOPER_UID=10001
ARG DEVELOPER_GID=10001
RUN apt-get update && apt-get install -y --no-install-recommends \
  bash ca-certificates git gh zip unzip grep sed gawk findutils jq yq procps vim nano \
  make cmake ninja-build gcc g++ clang python3 python3-pip python3-venv pipx nodejs npm \
  golang-go rustc cargo openjdk-21-jdk maven gradle php-cli composer ruby-full bundler r-base \
  pandoc weasyprint tmux texlive-full biber latexmk && \
  npm install -g pnpm@${PNPM_VERSION} tsx@4.23.11 && \
  rm -rf /var/lib/apt/lists/*
# Keep the large distro/toolchain layer above stable so staging upgrades can
# reuse its Docker cache. Ubuntu 24.04 currently supplies Node 18, while pnpm
# 11 requires Node >=22.13. Overlay a pinned Node 22 binary distribution and
# verify its published SHA-256 before making it the runtime Node installation.
ARG NODE_VERSION=22.20.0
RUN apt-get update && apt-get install -y --no-install-recommends xz-utils && rm -rf /var/lib/apt/lists/*
RUN set -eux; \
  case "$(dpkg --print-architecture)" in \
    amd64) node_arch='x64' ;; \
    arm64) node_arch='arm64' ;; \
    *) echo "Unsupported Node.js architecture: $(dpkg --print-architecture)" >&2; exit 1 ;; \
  esac; \
  archive="node-v${NODE_VERSION}-linux-${node_arch}.tar.xz"; \
  dist="https://nodejs.org/dist/v${NODE_VERSION}"; \
  DIST="$dist" ARCHIVE="$archive" python3 -c 'import os,urllib.request; base=os.environ["DIST"]; a=os.environ["ARCHIVE"]; urllib.request.urlretrieve(f"{base}/{a}",f"/tmp/{a}"); urllib.request.urlretrieve(f"{base}/SHASUMS256.txt","/tmp/node-SHASUMS256.txt")'; \
  expected="$(awk -v file="$archive" '$2 == file { print $1; exit }' /tmp/node-SHASUMS256.txt)"; \
  test -n "$expected"; \
  printf '%s  %s\n' "$expected" "/tmp/$archive" | sha256sum --check --strict -; \
  tar -xJf "/tmp/$archive" -C /usr/local --strip-components=1 --no-same-owner; \
  rm -f "/tmp/$archive" /tmp/node-SHASUMS256.txt; \
  node --version; \
  npm --version; \
  npm install -g pnpm@${PNPM_VERSION} tsx@4.23.11
# Networking is entitlement-controlled at the container boundary. The standard
# image deliberately omits general-purpose network client/diagnostic binaries;
# package managers and Git use the controlled egress policy when enabled.
# Keep the certified scientific Python stack in the same unified image used by
# Compile & Run and the Interactive Terminal. A dedicated virtual environment
# avoids modifying Ubuntu's externally-managed system Python while remaining
# available to every non-root sandbox process through PATH.
COPY requirements-scientific.txt /tmp/requirements-scientific.txt
RUN python3 -m venv /opt/learnitive-venv && \
  /opt/learnitive-venv/bin/python -m pip install --no-cache-dir --upgrade pip setuptools wheel && \
  /opt/learnitive-venv/bin/python -m pip install --no-cache-dir --only-binary=:all: -r /tmp/requirements-scientific.txt && \
  /opt/learnitive-venv/bin/python -c 'import numpy,scipy,pandas,matplotlib,sympy' && \
  rm -f /tmp/requirements-scientific.txt
ENV VIRTUAL_ENV=/opt/learnitive-venv
ENV PATH=/opt/learnitive-venv/bin:${PATH}

RUN set -eux; \
  apt-get update; \
  apt-get purge -y --auto-remove curl wget openssh-client telnet inetutils-telnet ftp lftp netcat-openbsd netcat-traditional ncat socat iputils-ping traceroute mtr-tiny dnsutils whois rsync 2>/dev/null || true; \
  rm -rf /var/lib/apt/lists/*; \
  for cmd in curl wget ssh scp sftp telnet ftp lftp nc netcat ncat socat ping traceroute tracepath mtr dig nslookup host whois rsync; do \
    if command -v "$cmd" >/dev/null 2>&1; then echo "Forbidden network utility present: $cmd" >&2; exit 1; fi; \
  done
COPY toolchain-smoke.sh /usr/local/bin/learnitive-toolchain-smoke
COPY sandbox-init.sh /usr/local/bin/learnitive-sandbox-init
RUN chmod 0755 /usr/local/bin/learnitive-toolchain-smoke /usr/local/bin/learnitive-sandbox-init && \
  /usr/local/bin/learnitive-toolchain-smoke && \
  groupadd -g "${DEVELOPER_GID}" developer && \
  useradd -m -u "${DEVELOPER_UID}" -g "${DEVELOPER_GID}" -s /bin/bash developer && \
  install -d -m 0755 -o "${DEVELOPER_UID}" -g "${DEVELOPER_GID}" /home/developer
WORKDIR /workspace
USER ${DEVELOPER_UID}:${DEVELOPER_GID}
ENV HOME=/home/developer
CMD ["/bin/bash"]