# Cloud Computer image: the production browser worker plus a usable desktop.
#
# Plan: common-docs/projects/cloud-computer/PLAN.md (P1a). Build context is the
# monorepo root, like the browser worker:
#
#   docker buildx build --platform linux/amd64 \
#     -f packages/matrx-scraper/docker/cloud-computer/Dockerfile \
#     --build-arg BROWSER_WORKER_IMAGE=<ecr>/matrx-browser-worker:<sha> \
#     -t <ecr>/matrx-cloud-computer:<sha> .
#
# BASE: an exact, already-built browser-worker image (Chrome, Xvfb, Selkies,
# fonts, the uv environment). It is never rebuilt here, so the heavy layers stay
# byte-identical to the fleet's. On top: the smallest desktop that a person
# taking control can use without help (Openbox + a tint2 taskbar with three
# launchers: terminal, files, Chrome), sudo so agents can install software on
# the writable root filesystem, scrot/xdotool for whole-desktop screenshots and
# input, and the CURRENT worker source so a machine never lags the repo.
ARG BROWSER_WORKER_IMAGE
FROM ${BROWSER_WORKER_IMAGE}

USER root

RUN apt-get update && apt-get install -y --no-install-recommends \
        openbox tint2 lxterminal pcmanfm adwaita-icon-theme \
        sudo scrot xdotool x11-xserver-utils dbus-x11 \
    && rm -rf /var/lib/apt/lists/* /usr/share/doc/* /usr/share/man/* \
    && echo 'browser-worker ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/90-cloud-computer \
    && chmod 0440 /etc/sudoers.d/90-cloud-computer \
    && visudo -cf /etc/sudoers.d/90-cloud-computer \
    && command -v openbox tint2 lxterminal pcmanfm scrot xdotool

# Current worker source over the base image's editable install, plus the
# browser-worker entrypoint that carries the desktop-session hook. Modes are
# set by COPY --chmod so no later RUN rewrites (and so duplicates) a layer.
COPY --chmod=a+rX packages/matrx-scraper/matrx_scraper /app/packages/matrx-scraper/matrx_scraper
COPY --chmod=0755 packages/matrx-scraper/docker/browser-worker-entrypoint.sh /usr/local/bin/browser-worker-entrypoint
COPY --chmod=0755 packages/matrx-scraper/docker/cloud-computer/cloud-computer-entrypoint.sh /usr/local/bin/cloud-computer-entrypoint
COPY --chmod=0755 packages/matrx-scraper/docker/cloud-computer/cloud-computer-desktop.sh /usr/local/bin/cloud-computer-desktop
COPY --chmod=0755 packages/matrx-scraper/docker/cloud-computer/cloud-computer-chrome.sh /usr/local/bin/cloud-computer-chrome
COPY --chmod=0644 packages/matrx-scraper/docker/cloud-computer/tint2rc /etc/xdg/cloud-computer/tint2rc
COPY --chmod=0644 packages/matrx-scraper/docker/cloud-computer/cloud-computer-chrome.desktop /usr/share/applications/cloud-computer-chrome.desktop
# Build-time proof the copied source imports; writes nothing but bytecode.
RUN cd /app && UV_NO_CACHE=1 uv run --no-sync python -c "import matrx_scraper.cloud_browser.worker.server" 2>&1 | grep -q "BROWSER_WORKER_ID is required"

# The browser-worker entrypoint starts this after Xvfb answers. The stream
# offers clipboard sync on a person's machine (off in the browser fleet).
ENV BROWSER_WORKER_DESKTOP_SESSION=/usr/local/bin/cloud-computer-desktop \
    BROWSER_WORKER_STREAM_CLIPBOARD=1 \
    MATRX_CLOUD_COMPUTER=1

ENTRYPOINT ["/usr/local/bin/cloud-computer-entrypoint"]
CMD []
