# The image the Docker sandbox runs commands in (DATALYN_SANDBOX_MODE=docker).
#
# Built automatically on first use, tagged datalyn-sandbox:<hash of this file>, so editing this
# file triggers a rebuild. No COPY: the build needs no context (the Dockerfile is sent on stdin).
# The workspace is copied in at run time (or bind-mounted with --docker-mount); nothing from the
# host, and no environment variable of the host, goes into the image.
FROM python:3.12-slim

RUN apt-get update \
    && apt-get install -y --no-install-recommends bash git ripgrep procps ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# pytest for Python projects: the container has no network at run time (I135), so it cannot be
# installed then (the evals' tasks run their tests in the sandbox).
RUN pip install --no-cache-dir "pytest==8.4.*"

# A non-root user owns the workspace; commands run as this user.
RUN useradd --create-home --uid 1000 --shell /bin/bash agent \
    && mkdir -p /workspace \
    && chown agent:agent /workspace \
    && git config --system --add safe.directory '*'

USER agent
ENV HOME=/home/agent
WORKDIR /workspace

# The container only waits; every command is a fresh `docker exec` (fresh-exec).
CMD ["sleep", "infinity"]
