# syntax=docker/dockerfile:1
# IMAGE_NAME=livecodebench_pro

# Adapted from https://github.com/YanagiOrigami/LightCPVerifier at commit
# f6637f470f7c3d7d879986dc6ee057cdc5e7b0ac, with changes documented in the comments
FROM ubuntu:22.04@sha256:0a9887931b0e38af2e3487ed39e29436b0535c4f3f52e57745baaf79d1898956

ENV DEBIAN_FRONTEND=noninteractive

# Install base dependencies and language toolchains
RUN apt-get update && apt-get install -y --no-install-recommends \
  ca-certificates \
  curl \
  jq \
  git \
  unzip \
  zip \
  build-essential \
  pkg-config \
  python3 \
  python3-pip \
  pypy3 \
  openjdk-17-jdk \
  kotlin \
  rustc \
  cargo \
  golang \
  && rm -rf /var/lib/apt/lists/*

# Change 4: Node.js and go-judge are pinned release tarballs verified against the
# SHA-256 sums their projects publish (nodejs.org SHASUMS256.txt, go-judge
# checksums.txt), instead of the NodeSource setup script and go-judge's latest
# release. The versions are the ones the 2026-08-21 image was built with. Node.js
# is unpacked into /usr, where the NodeSource package put it.
ARG NODE_VERSION=20.20.2
ARG GO_JUDGE_VERSION=1.12.2
RUN set -eux; \
  arch="$(uname -m)"; \
  case "$arch" in \
  x86_64) \
  node_arch="x64"; node_sha256="19e56f0825510207dd904f087fe52faa0a4eb6b2aab5f0ea7a33830d04888b8b"; \
  gj_arch="amd64v2"; gj_sha256="a1ee15c321066b5c21a12228693487783835cf9c38418db9a150030d5f414e91" ;; \
  aarch64) \
  node_arch="arm64"; node_sha256="47ef73d543ecf6eb19435f6c03a0ac4809b3bf0dd6b26c7c571efc2a6572a74d"; \
  gj_arch="arm64"; gj_sha256="af02946728a993842e9c4a9da125d119110c9943572bfeee350bbba6a2a5638a" ;; \
  *) echo "Unsupported arch: $arch" && exit 1 ;; \
  esac; \
  curl -fsSL -o /tmp/node.tar.gz \
  "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${node_arch}.tar.gz"; \
  echo "${node_sha256}  /tmp/node.tar.gz" | sha256sum -c -; \
  tar -xzf /tmp/node.tar.gz -C /usr --strip-components=1 --no-same-owner \
  --exclude='*/CHANGELOG.md' --exclude='*/LICENSE' --exclude='*/README.md'; \
  curl -fsSL -o /tmp/go-judge.tar.gz \
  "https://github.com/criyle/go-judge/releases/download/v${GO_JUDGE_VERSION}/go-judge_${GO_JUDGE_VERSION}_linux_${gj_arch}.tar.gz"; \
  echo "${gj_sha256}  /tmp/go-judge.tar.gz" | sha256sum -c -; \
  tar -xzf /tmp/go-judge.tar.gz -C /usr/local/bin go-judge; \
  chmod +x /usr/local/bin/go-judge; \
  rm /tmp/node.tar.gz /tmp/go-judge.tar.gz

# Change 1: npm@latest requires a newer Node engine than 20.x and fails to install
RUN npm install -g npm@10.9.9

# Change 2: Fetch the app source from upstream at a pinned commit rather than vendoring it,
# so this Dockerfile stays reproducible against a known-good LightCPVerifier revision
WORKDIR /app

RUN git clone https://github.com/YanagiOrigami/LightCPVerifier.git /tmp/lcv \
  && cd /tmp/lcv \
  && git checkout f6637f470f7c3d7d879986dc6ee057cdc5e7b0ac \
  && cp package.json package-lock.json* /app/ \
  && cp server.js entrypoint.sh /app/ \
  && cp -r src/ /app/src/ \
  && cp -r include/ /app/include/ \
  && cp -r config/ /app/config/ \
  && cp -r include/ /lib/testlib/ \
  && rm -rf /tmp/lcv

RUN npm ci --omit=dev --ignore-scripts

RUN chmod +x entrypoint.sh && sed -i 's/\r$//' entrypoint.sh

# Change 3: Hardcoded rather than $(nproc): Dockerfile ENV does not perform shell substitution
ENV PORT=8081 \
  GJ_ADDR=http://127.0.0.1:5050 \
  JUDGE_WORKERS=8 \
  GJ_PARALLELISM=8

ENTRYPOINT ["/app/entrypoint.sh"]
