Dockerfile.release

FROM node:current-trixie-slim

# Create user (Debian syntax); matching UID/GID of local user
ARG UID
ARG GID
RUN userdel -r node
RUN if [ -n "$UID" ] && [ -n "$GID" ]; then \
        if getent group "$GID" >/dev/null; then \
            gname=$(getent group "$GID" | cut -d: -f1); \
            useradd -r -u "$UID" -g "$gname" -m -d /home/pi pi; \
        else \
            groupadd -g "$GID" pi && \
            useradd -r -u "$UID" -g pi -m -d /home/pi pi; \
        fi; \
    else \
        groupadd -r pi && \
        useradd -r -g pi -m -d /home/pi pi; \
    fi

# Install stuff (including pi-chat runtime deps: tmux + qemu, JVM tooling for Maven/Gradle/Kotlin,
# and smart-card/HSM tooling)
RUN set -eux; \
    arch="$(dpkg --print-architecture)"; \
    case "$arch" in \
        amd64) qemu_pkgs="qemu-system-x86 ovmf ipxe-qemu" ;; \
        arm64) qemu_pkgs="qemu-system-arm qemu-efi-aarch64 ipxe-qemu" ;; \
        *) echo "Unsupported architecture for pi-chat dependencies: $arch" >&2; exit 1 ;; \
    esac; \
    apt-get update; \
    pcsc_tools_pkg=""; \
    if apt-cache show pcsc-tools >/dev/null 2>&1; then pcsc_tools_pkg="pcsc-tools"; fi; \
    apt-get install -y --no-install-recommends \
    zsh git wget curl jq tree file sudo gosu ripgrep ca-certificates tmux qemu-utils sqlite3 $qemu_pkgs \
    openjdk-21-jdk maven unzip pandoc \
    opensc pcscd $pcsc_tools_pkg libpcsclite1 libpcsclite-dev libccid usbutils softhsm2 && \
    ln -s /usr/lib/jvm/java-21-openjdk-* /opt/openjdk-default && \
    java -version && \
    javac -version && \
    update-ca-certificates && \
    rm -rf /var/lib/apt/lists/*

# Make Debian's OpenJDK 21 package the default JVM.
ENV JAVA_HOME=/opt/openjdk-default
ENV PATH="${JAVA_HOME}/bin:${PATH}"

# Install additional networking/debugging CLIs (latest releases)
RUN set -eux; \
    arch="$(dpkg --print-architecture)"; \
    case "$arch" in \
        amd64) xh_arch="x86_64-unknown-linux-musl"; grpcurl_arch="linux_x86_64"; websocat_arch="x86_64-unknown-linux-musl"; glab_arch="amd64" ;; \
        arm64) xh_arch="aarch64-unknown-linux-musl"; grpcurl_arch="linux_arm64"; websocat_arch="aarch64-unknown-linux-musl"; glab_arch="arm64" ;; \
        *) echo "Unsupported architecture: $arch" >&2; exit 1 ;; \
    esac; \
    tmpdir="$(mktemp -d)"; \
    xh_effective_url="$(curl -fsSL -o /dev/null -w '%{url_effective}' https://github.com/ducaale/xh/releases/latest)"; \
    grpcurl_effective_url="$(curl -fsSL -o /dev/null -w '%{url_effective}' https://github.com/fullstorydev/grpcurl/releases/latest)"; \
    websocat_effective_url="$(curl -fsSL -o /dev/null -w '%{url_effective}' https://github.com/vi/websocat/releases/latest)"; \
    glab_effective_url="$(curl -fsSL -o /dev/null -w '%{url_effective}' https://gitlab.com/gitlab-org/cli/-/releases/permalink/latest)"; \
    case "$xh_effective_url" in */releases/tag/*) xh_tag="${xh_effective_url##*/}" ;; *) echo "Could not resolve latest xh tag from $xh_effective_url" >&2; exit 1 ;; esac; \
    case "$grpcurl_effective_url" in */releases/tag/*) grpcurl_tag="${grpcurl_effective_url##*/}" ;; *) echo "Could not resolve latest grpcurl tag from $grpcurl_effective_url" >&2; exit 1 ;; esac; \
    case "$websocat_effective_url" in */releases/tag/*) websocat_tag="${websocat_effective_url##*/}" ;; *) echo "Could not resolve latest websocat tag from $websocat_effective_url" >&2; exit 1 ;; esac; \
    case "$glab_effective_url" in */-/releases/v*) glab_tag="${glab_effective_url##*/}" ;; *) echo "Could not resolve latest glab tag from $glab_effective_url" >&2; exit 1 ;; esac; \
    xh_url="https://github.com/ducaale/xh/releases/download/${xh_tag}/xh-${xh_tag}-${xh_arch}.tar.gz"; \
    grpcurl_url="https://github.com/fullstorydev/grpcurl/releases/download/${grpcurl_tag}/grpcurl_${grpcurl_tag#v}_${grpcurl_arch}.tar.gz"; \
    websocat_url="https://github.com/vi/websocat/releases/download/${websocat_tag}/websocat.${websocat_arch}"; \
    glab_version="${glab_tag#v}"; \
    glab_url="https://gitlab.com/gitlab-org/cli/-/releases/${glab_tag}/downloads/glab_${glab_version}_linux_${glab_arch}.tar.gz"; \
    curl -fsSL "$xh_url" -o "$tmpdir/xh.tar.gz"; \
    tar -xzf "$tmpdir/xh.tar.gz" -C "$tmpdir"; \
    xh_bin="$(find "$tmpdir" -type f -name xh -print -quit)"; \
    test -n "$xh_bin"; \
    install -m 0755 "$xh_bin" /usr/local/bin/xh; \
    curl -fsSL "$grpcurl_url" -o "$tmpdir/grpcurl.tar.gz"; \
    tar -xzf "$tmpdir/grpcurl.tar.gz" -C "$tmpdir"; \
    grpcurl_bin="$(find "$tmpdir" -type f -name grpcurl -print -quit)"; \
    test -n "$grpcurl_bin"; \
    install -m 0755 "$grpcurl_bin" /usr/local/bin/grpcurl; \
    curl -fsSL "$websocat_url" -o /usr/local/bin/websocat; \
    chmod 0755 /usr/local/bin/websocat; \
    curl -fsSL "$glab_url" -o "$tmpdir/glab.tar.gz"; \
    tar -xzf "$tmpdir/glab.tar.gz" -C "$tmpdir"; \
    glab_bin="$(find "$tmpdir" -type f -name glab -print -quit)"; \
    test -n "$glab_bin"; \
    install -m 0755 "$glab_bin" /usr/local/bin/glab; \
    rm -rf "$tmpdir"

# Allow pi user to use sudo with a password
RUN usermod -aG sudo pi

# Install python stuff
ENV UV_PYTHON_INSTALL_DIR=/usr/local/python
ENV UV_TOOL_DIR=/usr/local/uv-tools
ENV UV_TOOL_BIN_DIR=/usr/local/bin
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/
RUN uv python install --default && \
    ln -sf $(uv python find) /usr/local/bin/python3 && \
    ln -sf /usr/local/bin/python3 /usr/local/bin/python && \
    uv tool install autopep8 && \
    uv tool install pytest && \
    uv tool install mitmproxy && \
    uv tool install markitdown

# Install ghcli
RUN (mkdir -p /usr/share/keyrings && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | tee /usr/share/keyrings/githubcli-archive-keyring.gpg > /dev/null) && \
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null && \
    apt-get update && apt-get install -y gh && \
    curl -sL https://sentry.io/get-cli/ | bash && \
    rm -rf /var/lib/apt/lists/*

# Install pi coding agent (as root)
ARG VERSION=latest
RUN npm install -g @earendil-works/pi-coding-agent@$VERSION @earendil-works/gondolin && \
    npm cache clean --force

# Set up workspace
WORKDIR /workspace
ENV HOME=/home/pi

# Change default shell to zsh for root and pi user
RUN chsh -s /bin/zsh && chsh -s /bin/zsh pi

COPY entrypoint.sh /usr/local/bin/entrypoint.sh
RUN chmod +x /usr/local/bin/entrypoint.sh

# Switch to non-root user for setup
USER pi
RUN wget -O /home/pi/.zshrc https://grml.org/console/zshrc && wget -O /home/pi/.zshrc.local https://grml.org/console/zshrc.local

# Switch back to root for entrypoint (it drops privileges after setup)
USER root

# Entrypoint: pass args through to pi
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]