# SPDX-License-Identifier: AGPL-3.0-only
# Essai L115 : l'exécuteur médié dans un conteneur qui imite la VM Compute.
# Même point d'entrée, mêmes chemins et mêmes variables que
# deploy/executor-image/Containerfile ; dsh vient de npm (DSH=npm) ou du
# faux harnais du banc (DSH=faux). Construit depuis la racine du dépôt :
#
#   docker build -f scripts/path-b-trial/Containerfile --build-arg DSH=npm \
#       -t ameesh-executor:essai .
FROM node:22-bookworm-slim
ARG DSH=npm
ARG DSH_VERSION=0.2.0-rc.2
RUN set -eux; apt-get update; \
    apt-get install -y --no-install-recommends python3 python3-pip python3-venv git tini \
        ca-certificates; \
    rm -rf /var/lib/apt/lists/*
COPY tests/fakebin/dsh /usr/local/lib/faux-dsh
RUN if [ "$DSH" = npm ]; then \
        npm install -g --omit=dev "@deepseek-ai/dsh@$DSH_VERSION" && npm cache clean --force \
        && ln -sf "$(npm root -g)/@deepseek-ai/dsh/lib/bin.js" /usr/local/bin/dsh; \
    else \
        sed -i '1s|.*|#!/usr/bin/env python3|' /usr/local/lib/faux-dsh \
        && install -m 0755 /usr/local/lib/faux-dsh /usr/local/bin/dsh; \
    fi
COPY pyproject.toml README.md LICENSE /src/
COPY src /src/src
RUN python3 -m venv /opt/ameesh && /opt/ameesh/bin/pip install --no-cache-dir /src \
        'cryptography>=41' && rm -rf /src
ENV PATH=/opt/ameesh/bin:$PATH
COPY deploy/executor-image/ameesh-executor /usr/local/bin/ameesh-executor
RUN chmod 0755 /usr/local/bin/ameesh-executor \
    && useradd --uid 10001 --user-group --no-create-home --home-dir /var/lib/ameesh-exec \
        --shell /usr/sbin/nologin ameesh \
    && install -d -o 10001 -g 10001 -m 0700 /var/lib/ameesh-exec
ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    HOME=/var/lib/ameesh-exec \
    AMEESH_EXEC_HOME=/var/lib/ameesh-exec \
    AMEESH_STATE=/var/lib/ameesh-exec/state \
    DSH_HOME=/var/lib/ameesh-exec/harness/dsh \
    AMEESH_DSH_BIN=/usr/local/bin/dsh \
    AMEESH_BACKEND=mediated \
    AMEESH_EXEC_SIGNER=cryptography \
    AMEESH_HOST_GATE=file \
    AMEESH_HOST_GATE_PATH=/run/ameesh-gate/state/state.json \
    AMEESH_HOST_GATE_ACK=/run/ameesh-gate/ack/ack.json \
    AMEESH_HOST_GATE_FALLBACK=stopped \
    AMEESH_HOST_GATE_DRAIN=90 \
    AMEESH_EXEC_ENROLL_DIR=/run/ameesh-enroll
VOLUME ["/var/lib/ameesh-exec"]
USER 10001:10001
WORKDIR /var/lib/ameesh-exec
STOPSIGNAL SIGTERM
ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/ameesh-executor"]
CMD ["run"]
