# The sandbox base image (harness_servers.sandbox, #11): Python with the harness servers, git, the user 10001 with
# its home /home/sandbox, and /workspace. Products build their sandbox on it and add their toolchains:
#   FROM git.knurz.com/developer/harness-sandbox:<version>
# Build from the repository root, with the version from git (the build context has no .git):
#   docker build -f servers/Dockerfile -t harness-sandbox \
#     --build-arg HARNESS_VERSION="$(uv run python scripts/versions.py python)" .
# Dependencies come from uv.lock with their hashes, so the image has exactly the packages the tests ran with.

# The base images by digest (#153): a build gets the same bases on every machine, whatever its daemon holds.
ARG PYTHON_IMAGE=python:3.12-slim-bookworm@sha256:935c3c5b12357a7e10caa9c1e6ca5692344d97cf229832ef584be2cec9fc03df
ARG UV_IMAGE=ghcr.io/astral-sh/uv:0.9.10@sha256:29bd45092ea8902c0bbb7f0a338f0494a382b1f4b18355df5be270ade679ff1d

FROM ${UV_IMAGE} AS uv

FROM ${PYTHON_IMAGE} AS build
COPY --from=uv /uv /usr/local/bin/uv
ARG HARNESS_VERSION
RUN test -n "$HARNESS_VERSION" || (echo "pass --build-arg HARNESS_VERSION (scripts/versions.py python)" && exit 1)
# hatch-vcs reads the version from git; without .git it takes this one.
ENV SETUPTOOLS_SCM_PRETEND_VERSION=${HARNESS_VERSION}
WORKDIR /src
COPY pyproject.toml uv.lock ./
COPY packages ./packages
COPY servers ./servers
COPY apps ./apps
COPY samples ./samples
RUN mkdir -p /out \
 && uv export --frozen --no-dev --package knurz-harness-servers --no-emit-workspace -o /out/requirements.txt \
 && uv build --package knurz-harness-servers --wheel --out-dir /out/wheels

FROM ${PYTHON_IMAGE}
RUN apt-get update \
 && apt-get install --yes --no-install-recommends git \
 && rm -rf /var/lib/apt/lists/* \
 && useradd --uid 10001 --user-group --create-home --home-dir /home/sandbox --shell /bin/bash sandbox \
 && install --directory --owner 10001 --group 10001 /workspace
# The dependencies first, checked against the hashes of uv.lock: this layer stays cached while only the code changes.
COPY --from=build /out/requirements.txt /tmp/requirements.txt
RUN pip install --no-cache-dir --require-hashes -r /tmp/requirements.txt \
 && rm /tmp/requirements.txt
COPY --from=build /out/wheels /tmp/wheels
RUN pip install --no-cache-dir --no-deps /tmp/wheels/*.whl \
 && rm -rf /tmp/wheels
USER 10001
WORKDIR /workspace
ENV HOME=/home/sandbox \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1
# The version and the commit last: every commit changes them, and a layer after them would be built again each time.
ARG HARNESS_VERSION
ARG HARNESS_REVISION=unknown
LABEL org.opencontainers.image.title="harness-sandbox" \
      org.opencontainers.image.version="${HARNESS_VERSION}" \
      org.opencontainers.image.revision="${HARNESS_REVISION}" \
      org.opencontainers.image.source="https://git.knurz.com/developer/harness" \
      org.opencontainers.image.licenses="LicenseRef-Proprietary"
CMD ["sleep", "infinity"]
