# MicroVM image for the repository-analysis sandbox agent (AWS Lambda MicroVMs).
#
# At IMAGE BUILD TIME the agent starts and is snapshotted running (it answers the
# /ready lifecycle hook). At RUN TIME the runtime delivers /run (acked) and the
# off-cluster worker drives /clone, /read_tree, /exec over the microVM endpoint.
#
# MUST build FROM the Lambda MicroVMs managed base (AL2023) so the image boots as a
# Firecracker microVM and the lifecycle-hook plumbing works. A generic Debian python
# image does NOT boot here -- the agent never starts and the /ready hook times out
# ("Ready hook invocation timed out"). Hence dnf (AL2023), not apt.
#
# This Dockerfile is the create_microvm_image `codeArtifact`: it sits at the ROOT of
# the artifact zip alongside agent.py + repo_ops.py, and the MicroVMs build service
# builds it on top of `baseImageArn`. The application's image-packaging script
# stages it flat with agent.py and the *_ops.py modules from europacore.sandbox.
ARG BASE_IMAGE=public.ecr.aws/lambda/microvms:al2023-minimal
FROM ${BASE_IMAGE}

# git to clone the target repo; python3 to run the stdlib-only agent; CA certs for
# HTTPS; findutils because the minimal base has no `find`, which FindTool runs.
RUN dnf install -y --setopt=install_weak_deps=0 python3 git ca-certificates findutils \
    && dnf clean all

# Never prompt for git credentials; the agent listens on 9000 (the MicroVMs hooks
# port convention; HOOK_PORT overrides at runtime) and clones into /workspace.
ENV GIT_TERMINAL_PROMPT=0 \
    AGENT_PORT=9000 \
    AGENT_WORKDIR=/workspace

WORKDIR /workspace

# In-VM agent + the shared repo/service operations it imports (stdlib-only, no
# third-party deps). All sit at the artifact root next to this Dockerfile (header).
COPY repo_ops.py /opt/agent/repo_ops.py
COPY service_ops.py /opt/agent/service_ops.py
COPY env_ops.py /opt/agent/env_ops.py
COPY agent.py /opt/agent/agent.py

EXPOSE 9000

# The agent serves the lifecycle hooks and clone/read_tree/exec on HOOK_PORT
# (default AGENT_PORT=9000). Started at build time so the snapshot captures it
# running and answering the runtime's /ready probe on 9000.
ENTRYPOINT ["python3", "/opt/agent/agent.py"]
