# claude-code-runner — sidecar container.
#
# Includes node.js + the official Claude Code CLI so the runner can
# spawn `claude` subprocesses end-to-end without external mounts.
#
# Base image comes from AWS ECR Public (a mirror of the Docker Hub official
# `python` image), NOT Docker Hub directly — CodeBuild's shared egress IPs
# hit Docker Hub's anonymous pull rate limit (HTTP 429). ECR Public has no
# such limit from within AWS, and resolves identically for a local build.
FROM public.ecr.aws/docker/library/python:3.12-slim AS base

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PIP_NO_CACHE_DIR=1

# System deps: git (for cloning repos at job time), node (for claude CLI),
# coreutils basics.
RUN apt-get update && apt-get install -y --no-install-recommends \
    git \
    curl \
    ca-certificates \
    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
    && apt-get install -y --no-install-recommends nodejs \
    && npm install -g @anthropic-ai/claude-code \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# pyproject.toml declares `readme = "README.md"`, so hatchling needs the
# README present at build time — copy it alongside the manifest.
COPY pyproject.toml README.md /app/
COPY runner /app/runner

RUN pip install --no-cache-dir .

# Default workdir for jobs (tmpfs-friendly path).
RUN mkdir -p /tmp/spryng-runs

EXPOSE 8088

# Use uvicorn directly so we get clean SIGTERM handling for graceful
# shutdown of in-flight jobs.
CMD ["uvicorn", "runner.main:app", \
     "--host", "0.0.0.0", \
     "--port", "8088", \
     "--proxy-headers", \
     "--forwarded-allow-ips", "*"]
