FROM node:22-bookworm-slim@sha256:83f487e0a63425e5b4d146fb5e5be574bcbe1b7b843d3ebafdd95eaf7767a7e5 AS build
WORKDIR /opt/agent
COPY package.json package-lock.json ./
RUN npm ci --ignore-scripts
COPY tsconfig.json *.ts ./
RUN npm run build && npm prune --omit=dev --ignore-scripts

FROM node:22-bookworm-slim@sha256:83f487e0a63425e5b4d146fb5e5be574bcbe1b7b843d3ebafdd95eaf7767a7e5
# Snapshot fixes apt dependency selection; no runtime installations or downloads.
RUN printf 'deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20260901T000000Z bookworm main\n' > /etc/apt/sources.list \
    && rm -f /etc/apt/sources.list.d/debian.sources \
    && apt-get -o Acquire::Check-Valid-Until=false update \
    && apt-get install -y --no-install-recommends python3 bash coreutils findutils grep sed gawk procps util-linux \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd -g 10001 agent && useradd -u 10001 -g 10001 -d /home/agent -M agent \
    && mkdir -p /work /home/agent /opt/agent && chown 10001:10001 /work /home/agent
COPY --from=build /opt/agent/node_modules /opt/agent/node_modules
COPY --from=build /opt/agent/dist /opt/agent/dist
COPY supervisor /opt/agent/supervisor
RUN chmod 0555 /opt/agent/supervisor
ENV HOME=/home/agent LANG=C.UTF-8
USER 10001:10001
WORKDIR /work
ENTRYPOINT ["/usr/bin/python3", "/opt/agent/supervisor"]