# Workspace image for the editor's opt-in "Run in container" mode: a shell, git and common runtimes.
#
# Security notes (INT-A32):
# - Processes run as the unprivileged `dev` user (uid 1001); nothing in the image needs root at runtime.
# - The clone URL carries a short-lived read token only while `git clone` runs; `git remote set-url` replaces
#   it before any terminal opens.
# - Egress: the container is started with `enableInternet: true` so package managers work. Cloudflare
#   Containers cannot reach the Worker's bindings (D1/KV/R2/DOs) or other tenants' containers; only the public
#   internet is routable. Nothing in the forge trusts requests that originate from a container, and forge APIs
#   on the editor origin return 404.
FROM node:24-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates curl unzip jq python3 bsdutils procps less nano && rm -rf /var/lib/apt/lists/*
RUN groupadd --gid 1001 dev && useradd --uid 1001 --gid dev --create-home --shell /bin/bash dev \
  && mkdir -p /workspace && chown dev:dev /workspace
USER dev
ENV HOME=/home/dev
RUN curl -fsSL https://bun.sh/install | bash
ENV PATH="/home/dev/.bun/bin:${PATH}"
ENV TERM=xterm-256color
WORKDIR /workspace
CMD ["sleep", "infinity"]