# A general-purpose dev sandbox image: git + Python + Node + build tools, configured to run
# NON-ROOT under a READ-ONLY root filesystem (the two constraints podsandbox's hardening imposes).
# Swap it for whatever your workload needs -the library only requires a POSIX shell with
# printf/base64/find/cat/mkdir. Whatever you install here, `exec` can run.
FROM debian:bookworm-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
        git ca-certificates curl \
        python3 python3-venv \
        nodejs npm \
        build-essential \
    && rm -rf /var/lib/apt/lists/*

# Run as an unprivileged user (uid 1000) -the pod securityContext sets runAsNonRoot.
RUN useradd --create-home --uid 1000 --shell /bin/bash sandbox
USER sandbox
WORKDIR /workspace

# The container just idles; podsandbox drives it entirely over `kubectl exec`.
CMD ["sleep", "infinity"]
