FROM python:3.14-slim

# Install the uv binary for package management. See: https://docs.astral.sh/uv/guides/integration/docker/#installing-uv
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/

# Create a non-root user for enhanced container security.
RUN useradd -m sandbox

USER sandbox
WORKDIR /sandbox

# Create a virtual environment for package isolation
RUN uv venv /home/sandbox/.venv

ENV PATH="/home/sandbox/.venv/bin:/bin:${PATH}"
ENV VIRTUAL_ENV="/home/sandbox/.venv"
ENV UV_CACHE_DIR="/home/sandbox/.cache/uv"
ENV UV_LINK_MODE=copy
# Have uv compile packages to .pyc Python bytecode at installation time, improving
# application runtime performance
ENV UV_COMPILE_BYTECODE=1
# Point tempfile/uv/pip at /tmp so they use the bounded tmpfs mounted at runtime
ENV TMPDIR=/tmp

# Copy daemon and relay scripts
COPY daemon.py /sandbox/daemon.py
COPY relay.py /sandbox/relay.py

# Run daemon on internal Unix socket (no TCP port needed)
CMD ["python", "/sandbox/daemon.py", "--socket", "/tmp/sandbox.sock"]
