# Minimal Mosaic Stack POC agent image.
# Base: maintained Node.js image (same family as Pi's documented
# containerization example in docs/containerization.md).
# Q284 / #470: use the patched release and immutable multi-platform image.
# Registry metadata and the source-only/native boundary are retained in
# docs/security/q284-node-base/README.md.
FROM node:24.22.2-bookworm-slim@sha256:c86ecead9e55a5210ac1727de38a4ca840bf03dcaf34dc9749addbf383b1920c

# Tools Pi's documented container image expects (bash, CA certs, git, ripgrep).
RUN apt-get update \
    && apt-get install -y --no-install-recommends bash ca-certificates git ripgrep \
    && rm -rf /var/lib/apt/lists/*

# Non-root user: the maintained node image ships a 'node' user at
# uid/gid 1000, which matches the host user that owns the runtime
# state directory mounted at /var/lib/mosaic. It is reused as-is.

# Pinned Pi install: package.json pins the exact version and
# package-lock.json is installed with npm ci. No unversioned installs.
WORKDIR /opt/app
COPY package.json package-lock.json ./
RUN npm ci --ignore-scripts

# Immutable contract fixtures (required location), runtime scripts, and
# runtime adapters.
COPY contracts /opt/mosaic/contracts
COPY src /opt/mosaic/src
COPY packages/processing-control/src/state.mjs packages/processing-control/src/entrypoint.mjs /opt/mosaic/processing-control/
COPY adapters /opt/mosaic/adapters
RUN chmod 0555 /opt/mosaic/contracts /opt/mosaic/contracts/* \
    && chmod 0555 /opt/mosaic/src /opt/mosaic/src/*.sh \
    && chmod 0555 /opt/mosaic/adapters /opt/mosaic/adapters/*/adapter.sh

# Private per-container prompt/output paths, the fixed narrow-mount targets,
# workspace, and pi agent directory (auth.json is bind-mounted read-only at
# runtime; no host data root is mounted).
RUN mkdir -p /var/lib/mosaic/private /var/lib/mosaic/input/user /var/lib/mosaic/input/skills /var/lib/mosaic/control /var/lib/mosaic/session /workspace /home/node/.pi/agent \
    && touch /var/lib/mosaic/input/task.json /var/lib/mosaic/input/mission.json /var/lib/mosaic/input/agent-soul.md /var/lib/mosaic/input/session-fork.jsonl /var/lib/mosaic/control/processing.json \
    && chown -R node:node /var/lib/mosaic /workspace /home/node /opt/app \
    && chmod 0700 /var/lib/mosaic/private /var/lib/mosaic/control

USER node
WORKDIR /workspace
ENV HOME=/home/node \
    PATH="/opt/app/node_modules/.bin:${PATH}" \
    PI_OFFLINE=1

# One-shot agent: args form the user request (default is the startup
# verification request defined in compose.yaml).
ENTRYPOINT ["/opt/mosaic/src/run-agent.sh"]