# Base sandbox image: Python + the preinstalled libraries.
# The sheath runtime/ helpers are NOT baked in -- they are mounted read-only at /runtime,
# so the image never drifts from the installed sheath version.
# PYTHON_VERSION is set by the builder to the host interpreter's major.minor, so the image
# tag and the pip-layer cache key (both keyed on the host version) describe the interpreter
# that actually runs sandboxed code.
ARG PYTHON_VERSION=3.12
FROM python:${PYTHON_VERSION}-slim
ARG PREINSTALLED="pandas pyarrow numpy httpx"
RUN pip install --no-cache-dir ${PREINSTALLED}
