FROM debian@sha256:76b6251aaac0ebb6aca1afbc780717aab7e455038c07cb0cb23facb33d241c7d
ARG NODE_VERSION=24.18.0
ARG NODE_SHA256=55aa7153f9d88f28d765fcdad5ae6945b5c0f98a36881703817e4c450fa76742
ARG UV_VERSION=0.12.2
ARG UV_SHA256=d66e96b5f1ca3b99806eee283a8125d33a0bd669e6e6d9bc4ab7ffda63c41bf4
ARG PI_VERSION=0.80.3
ENV DEBIAN_FRONTEND=noninteractive HOME=/home/factory
RUN apt-get update \
 && apt-get install -y --no-install-recommends build-essential ca-certificates curl git python3 tini \
 && rm -rf /var/lib/apt/lists/*
RUN curl -fsSLo /tmp/node.tar.xz "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \
 && echo "${NODE_SHA256}  /tmp/node.tar.xz" | sha256sum -c - \
 && tar -xJf /tmp/node.tar.xz -C /usr/local --strip-components=1 \
 && rm /tmp/node.tar.xz \
 && npm install --global --ignore-scripts "@earendil-works/pi-coding-agent@${PI_VERSION}"
RUN curl -fsSLo /tmp/uv.tar.gz "https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-x86_64-unknown-linux-gnu.tar.gz" \
 && echo "${UV_SHA256}  /tmp/uv.tar.gz" | sha256sum -c - \
 && tar -xzf /tmp/uv.tar.gz -C /tmp \
 && install -m 0755 /tmp/uv-x86_64-unknown-linux-gnu/uv /usr/local/bin/uv \
 && rm -rf /tmp/uv.tar.gz /tmp/uv-x86_64-unknown-linux-gnu
COPY . /opt/factory
RUN uv sync --frozen --project /opt/factory \
 && install -m 0755 /opt/factory/kubernetes/factory-kubernetes-worker /usr/local/bin/factory-kubernetes-worker \
 && groupadd --gid 1000 factory \
 && useradd --uid 1000 --gid 1000 --no-create-home --home-dir /home/factory factory \
 && mkdir -p /home/factory/.pi/agent /home/factory/state /workspace \
 && chown -R 1000:1000 /home/factory /workspace
USER 1000:1000
WORKDIR /workspace
ENTRYPOINT ["/usr/bin/tini","--"]
CMD ["/usr/local/bin/factory-kubernetes-worker"]
