# Purpose: an image for running a coding agent with nothing in it except the agent, a
#          Python toolchain and the project you mount. No credentials, no host home
#          directory, no container socket, and a non-root user by default.
# Platform: spark, strix, nvidia (Docker Engine or Podman); mac through Docker Desktop
# Minimum memory: 8 GB; the model runs outside this container, on the host or elsewhere
# Assumes: built with `docker build -f agent-sandbox.Dockerfile -t agent-sandbox .` and
#          run through compose-sandbox.yaml, which supplies the mounts, the network policy
#          and the resource limits. Nothing here needs a GPU: the agent talks to your
#          gateway over HTTP and the weights never enter this image.

FROM python:3.12-slim

# Build-time network access is used here and nowhere else. Everything the agent needs is
# installed now, so that the running container can be cut off from the internet entirely.
RUN apt-get update \
    && apt-get install --no-install-recommends --yes \
        git \
        ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# The test toolchain the task uses, plus one agent. Pin what you install: an agent that
# updates itself inside a sandbox is a sandbox whose contents you did not choose.
RUN pip install --no-cache-dir \
        "pytest==8.3.4" \
        "aider-chat==0.86.0"

# A non-root user with a home directory that is not a host path. Docker's own guidance is
# that the best way to prevent privilege escalation from inside a container is to run the
# application as an unprivileged user, and this is the cheapest half of that.
RUN useradd --create-home --home-dir /agent --shell /bin/bash --uid 10001 agent

# The only directory the agent is expected to write to. compose-sandbox.yaml mounts your
# project here and mounts nothing else.
WORKDIR /work

# Two habits that make the boundary visible from inside. HOME is not a host path, and the
# shell history goes to a tmpfs that disappears with the container.
ENV HOME=/agent \
    HISTFILE=/tmp/.bash_history \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PYTHONDONTWRITEBYTECODE=1

USER agent

CMD ["/bin/bash"]