Dockerfile.worker

FROM node:24-slim

# This is a single user's dev environment -- one of these containers gets
# created per authenticated user by the gateway's dispatch-to-worker script.
# It gets --privileged (for its own private Docker-in-Docker daemon) but
# never the host's docker.sock, so it has no path to the host or to any
# other user's container.
RUN apt-get update && apt-get install -y \
    git \
    curl \
    sudo \
    gosu \
    tmux \
    docker.io \
    gh \
    sqlite3 \
    dnsutils \
    whois \
    jq \
    && rm -rf /var/lib/apt/lists/*

# Install Claude Code globally
RUN npm install -g @anthropic-ai/claude-code

# Install watch-gh-build helper script
COPY scripts/watch-gh-build /usr/local/bin/watch-gh-build
RUN chmod +x /usr/local/bin/watch-gh-build

# Install the VS Code CLI, used to run "code tunnel" for VS Code Remote
# Tunnels (browser or desktop VS Code access without any inbound port).
RUN curl -fL 'https://update.code.visualstudio.com/latest/cli-linux-x64/stable' --output /tmp/vscode_cli.tar.gz && \
    tar -xf /tmp/vscode_cli.tar.gz -C /usr/local/bin && \
    chmod +x /usr/local/bin/code && \
    rm /tmp/vscode_cli.tar.gz

# ttyd-session is run on demand by the gateway (`docker exec -it ... ttyd-session`)
# rather than by this container's own entrypoint -- each connection gets an
# independent tmux session by default, with the option to attach to
# (mirror) an existing one.
COPY scripts/ttyd-session /usr/local/bin/ttyd-session
RUN chmod +x /usr/local/bin/ttyd-session

# Create non-root user with /workspace as home
RUN useradd -m -d /workspace -s /bin/bash claude && \
    passwd -l claude && \
    echo "claude ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers

COPY entrypoint-worker.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

ENTRYPOINT ["/entrypoint.sh"]