Dockerfile.worker

# ─── Deckent Worker Container ──────────────────────────────────────────────
# Lightweight container for isolated worker execution.
# Each worker runs in its own container with:
#   - Claude CLI (or Codex/Gemini CLI)
#   - Git for diff operations
#   - Node.js for tsc/vitest verification
#   - Project mounted read-only, .tasks/ mounted read-write

FROM node:24-trixie-slim

# Install essential tools
# ca-certificates (Sprint 252 PSL-1 verify): REQUIRED for non-claude provider CLIs
# in-container. The codex CLI is a Rust binary whose TLS/websocket client uses the
# SYSTEM root CA store; without ca-certificates it fails with "no native root CA
# certificates found" connecting to chatgpt.com (Sprint 252 codex-in-docker verify).
# (Node-based CLIs like gemini bundle their own CAs, so this was previously latent.)
RUN apt-get update && apt-get install -y --no-install-recommends \
    git \
    curl \
    ca-certificates \
    util-linux \
    && rm -rf /var/lib/apt/lists/*

# Install the exact Claude Code release admitted by the built-in model catalog.
# Claude Fable 5.1 rejects clients older than 2.1.251; 2.1.259 is the host- and
# Docker-proven release for this catalog revision (2026-09-03). Pinning keeps a
# cached rebuild from silently retaining an older, presence-only CLI.
ARG CLAUDE_CODE_VERSION=2.1.259
RUN npm i -g @anthropic-ai/claude-code@$CLAUDE_CODE_VERSION

# Optional provider CLIs — default lean (Claude-only). Opt-in via build args:
#   docker build --build-arg INSTALL_CODEX=true ...
#   docker build --build-arg INSTALL_GEMINI=true ...
#   docker build --build-arg INSTALL_OLLAMA=true ...
#   docker build --build-arg INSTALL_CURSOR=true ...
# Manual uncomment alternative (without build args):
# RUN npm i -g @openai/codex
# RUN npm i -g @google/gemini-cli
# RUN curl -fsSL https://ollama.ai/install.sh | sh
# RUN curl https://cursor.com/install -fsS | bash
ARG INSTALL_CODEX=false
ARG CODEX_VERSION=0.148.0
ARG INSTALL_GEMINI=false
ARG INSTALL_OLLAMA=false
ARG INSTALL_CURSOR=false
RUN if [ "$INSTALL_CODEX" = "true" ]; then npm i -g "@openai/codex@$CODEX_VERSION"; fi
RUN if [ "$INSTALL_GEMINI" = "true" ]; then npm i -g @google/gemini-cli; fi
RUN if [ "$INSTALL_OLLAMA" = "true" ]; then curl -fsSL https://ollama.ai/install.sh | sh; fi
# cursor-agent is binary-only (src/core/provider-packages.ts:71 — not an npm
# package); the official installer (cursor.com/cli) drops the binary under
# $HOME/.local/bin. HOME is reassigned to /tmp/deckent-home later in this
# file (non-root writable home), so the binary is symlinked into
# /usr/local/bin here — already on PATH for every user — instead of relying
# on HOME-relative PATH entries that would break after the reassignment.
RUN if [ "$INSTALL_CURSOR" = "true" ]; then \
      curl https://cursor.com/install -fsS | bash && \
      ln -sf "$HOME/.local/bin/cursor-agent" /usr/local/bin/cursor-agent; \
    fi

# Create writable home directory for non-root execution
# spawn-backend-docker.ts uses --tmpfs /tmp/deckent-home, but this ensures
# the base path exists even without tmpfs (e.g., docker exec debugging)
RUN mkdir -p /tmp/deckent-home && chmod 777 /tmp/deckent-home
ENV HOME=/tmp/deckent-home

# Set workspace directory
WORKDIR /workspace

# Health check: verify claude CLI is available
HEALTHCHECK --interval=30s --timeout=5s --retries=1 \
  CMD claude --version || exit 1

# No entrypoint — command passed by DockerSpawnBackend
CMD ["echo", "deckent-worker ready"]