# pi-docker-sandbox base image — a small but useful Debian developer sandbox.
#
# Build with:  /sandbox-build   (or: docker build -t pi-sandbox:debian-slim image/)
#
# The image creates an unprivileged `sandbox` user. Arbitrary model-generated
# code runs as that user; only the optional setup phase runs as root.

FROM debian:bookworm-slim

# Install a reasonably small developer environment. Avoid turning this into a
# giant general-purpose distro.
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        bash \
        coreutils \
        findutils \
        git \
        curl \
        wget \
        ca-certificates \
        python3 \
        python3-pip \
        python3-venv \
        nodejs \
        npm \
        build-essential \
        pkg-config \
        jq \
        ripgrep \
        procps \
        zip \
        unzip \
    && rm -rf /var/lib/apt/lists/*

# Create the unprivileged sandbox user.
RUN useradd --create-home --shell /bin/bash --uid 1000 sandbox

# Export boundary for artifacts the user/model explicitly wants out.
RUN mkdir -p /output && chown sandbox:sandbox /output

# The host project is bind-mounted read-only at /workspace by the runner.
# /workspace, /output, and /tmp are created/managed by the container runtime.

USER sandbox
WORKDIR /workspace