# The agent image a turn's harness runs in (docs/design/agent-isolation.md §2). `flyloft host up` builds it.
FROM debian:bookworm-slim AS opencode
RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates
# podman 4.9 has no ADD --checksum; the digest is GitHub's for this release asset
RUN curl -fsSL -o /tmp/opencode.tar.gz \
        https://github.com/anomalyco/opencode/releases/download/v2.2.5/opencode-linux-x64.tar.gz \
    && echo "09f44302c10fd036912f59c81fd1aef5df45dd06f649197f9dfc9bbe2a79614e  /tmp/opencode.tar.gz" | sha256sum -c - \
    && tar -xzf /tmp/opencode.tar.gz -C /usr/local/bin opencode

FROM debian:bookworm-slim AS claude
RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates
# the digest is the release manifest's: downloads.claude.ai/claude-code-releases/2.1.312/manifest.json
RUN curl -fsSL -o /usr/local/bin/claude \
        https://downloads.claude.ai/claude-code-releases/2.1.312/linux-x64/claude \
    && echo "4f4178ce41d83e23341ebfbaecdbcf8ea6bf7baea0690025abe49eeec3a5d01d  /usr/local/bin/claude" | sha256sum -c - \
    && chmod 755 /usr/local/bin/claude

FROM debian:bookworm-slim
RUN apt-get update \
    && apt-get install -y --no-install-recommends git ripgrep python3 ca-certificates \
    && rm -rf /var/lib/apt/lists/*
COPY --from=opencode /usr/local/bin/opencode /usr/local/bin/opencode
COPY --from=claude /usr/local/bin/claude /usr/local/bin/claude
ENV DISABLE_AUTOUPDATER=1
COPY --chmod=755 bridge.py /usr/local/bin/flyloft-bridge
COPY --chmod=755 prepare.py /usr/local/bin/flyloft-prepare
