# syntax=docker/dockerfile:1.7
FROM debian@sha256:76b6251aaac0ebb6aca1afbc780717aab7e455038c07cb0cb23facb33d241c7d
ARG NODE_VERSION=24.18.0
ARG NODE_SHA256=55aa7153f9d88f28d765fcdad5ae6945b5c0f98a36881703817e4c450fa76742
ARG PNPM_VERSION=11.5.2
ARG BUN_VERSION=1.3.14
ARG BUN_SHA256=951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f
ARG UV_VERSION=0.12.2
ARG UV_SHA256=d66e96b5f1ca3b99806eee283a8125d33a0bd669e6e6d9bc4ab7ffda63c41bf4
ARG PI_VERSION=0.80.3
ENV DEBIAN_FRONTEND=noninteractive HOME=/home/factory FACTORY_REPOSITORY_REGISTRY=/opt/repository-registry/repositories.v1.json PYTHONPATH=/opt/factory COREPACK_ENABLE_DOWNLOAD_PROMPT=0 COREPACK_HOME=/opt/corepack
RUN apt-get update \
 && apt-get install -y --no-install-recommends build-essential ca-certificates curl git netcat-openbsd openssh-client openssl python3 tini tinyproxy unzip \
 && rm -rf /var/lib/apt/lists/*
RUN curl -fsSLo /tmp/node.tar.xz "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \
 && echo "${NODE_SHA256}  /tmp/node.tar.xz" | sha256sum -c - \
 && tar -xJf /tmp/node.tar.xz -C /usr/local --strip-components=1 \
 && rm /tmp/node.tar.xz \
 && corepack enable --install-directory /usr/local/bin \
 && corepack prepare "pnpm@${PNPM_VERSION}" --activate \
 && npm install --global --ignore-scripts "@earendil-works/pi-coding-agent@${PI_VERSION}"
RUN curl -fsSLo /tmp/bun.zip "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-x64.zip" \
 && echo "${BUN_SHA256}  /tmp/bun.zip" | sha256sum -c - \
 && unzip -q /tmp/bun.zip -d /tmp/bun \
 && install -m 0755 /tmp/bun/bun-linux-x64/bun /usr/local/bin/bun \
 && ln -s /usr/local/bin/bun /usr/local/bin/bunx \
 && rm -rf /tmp/bun.zip /tmp/bun
RUN curl -fsSLo /tmp/uv.tar.gz "https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-x86_64-unknown-linux-gnu.tar.gz" \
 && echo "${UV_SHA256}  /tmp/uv.tar.gz" | sha256sum -c - \
 && tar -xzf /tmp/uv.tar.gz -C /tmp \
 && install -m 0755 /tmp/uv-x86_64-unknown-linux-gnu/uv /usr/local/bin/uv \
 && rm -rf /tmp/uv.tar.gz /tmp/uv-x86_64-unknown-linux-gnu
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc /workspace/repo/
RUN pnpm install --frozen-lockfile --lockfile-only \
      --dir /workspace/repo \
 && pnpm fetch --frozen-lockfile \
      --dir /workspace/repo \
      --store-dir /opt/factory-dependencies/overdeck/pnpm-store \
 && mkdir -p \
      /opt/factory-dependencies/overdeck/input \
      /opt/factory-dependencies/overdeck/pnpm-cache \
 && cp /workspace/repo/package.json \
      /workspace/repo/pnpm-lock.yaml \
      /workspace/repo/pnpm-workspace.yaml \
      /workspace/repo/.npmrc \
      /opt/factory-dependencies/overdeck/input/ \
 && install -m 0444 \
      /home/factory/.cache/pnpm/lockfile-verified.jsonl \
      /opt/factory-dependencies/overdeck/pnpm-cache/lockfile-verified.jsonl \
 && rm -rf /workspace/repo
COPY modules/harness/factory /opt/factory
COPY modules/repository-registry/repositories.v1.json /opt/repository-registry/repositories.v1.json
RUN uv sync --frozen --project /opt/factory \
 && install -m 0755 /opt/factory/kubernetes/factory-kubernetes-worker /usr/local/bin/factory-kubernetes-worker \
 && python3 -c 'from adw_modules import repository_registry' \
 && groupadd --gid 1000 factory \
 && useradd --uid 1000 --gid 1000 --no-create-home --home-dir /home/factory factory \
 && mkdir -p /home/factory/.pi/agent /home/factory/state /workspace \
 && chown -R 1000:1000 /home/factory /workspace
USER 1000:1000
WORKDIR /workspace
ENTRYPOINT ["/usr/bin/tini","--"]
CMD ["/usr/local/bin/factory-kubernetes-worker"]