# Routemark recipe: python. A project kind, as text: Python with uv, and no Node.
#
# Routemark ships this file and never an image. You build it on your own machine with your own `docker build`
# (the README beside this file gives the command), and a project whose `routemark.toml` says
# `containment = "image"` runs its delegate and its checks in a container from what you built.
#
# The tools are pinned exactly, each by its version (the README's table says which). The Debian packages are
# pinned by the base image's Debian release alone: what it ships on the day of the build, its fixes included.
#
# What it holds, and why:
# - python:3.13.16-slim-trixie: Debian 13 with Python 3.13.
# - uv and uvx from uv's own published image, by version: one static binary each, nothing run from the internet.
# - OpenCode, by version: npm installs it in a first stage, and only its program is copied into this image, so
#   there is no Node here and an MCP server started with `npx` does not run inside (the README says how to add it).
# - No compilers: a project whose lock file needs a source build fails `uv sync` here; add build-essential
#   to the apt-get line below if yours does.

FROM node:22.23.4-trixie-slim AS harness

ARG OPENCODE_VERSION=2.1.3

RUN npm install -g "@opencode/cli@${OPENCODE_VERSION}" \
    && npm cache clean --force

FROM python:3.13.16-slim-trixie


ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl git \
    && rm -rf /var/lib/apt/lists/*

COPY --from=ghcr.io/astral-sh/uv:0.10.7 /uv /uvx /usr/local/bin/
COPY --from=harness /usr/local/lib/node_modules/@opencode/cli/bin/opencode.exe /usr/local/bin/opencode

# The delegate's home is private to one run: Routemark mounts an empty folder of the run's here, and the
# harness's own settings read-only inside it. The four XDG folders are pinned under it so the harness keeps its
# state there and nowhere else.
ENV HOME=/home/delegate \
    XDG_CONFIG_HOME=/home/delegate/.config \
    XDG_DATA_HOME=/home/delegate/.local/share \
    XDG_CACHE_HOME=/home/delegate/.cache \
    XDG_STATE_HOME=/home/delegate/.local/state \
    UV_CACHE_DIR=/home/delegate/.cache/uv \
    OPENCODE_DISABLE_AUTOUPDATE=1

RUN mkdir -p /home/delegate /work

# The run's copy of the project is mounted here, read-write.
WORKDIR /work
