# Tactus Sandbox Container (PyPI-based)
#
# Builds a sandbox image by installing Tactus from PyPI. This is intended for
# environments where the Tactus source tree is not available (e.g., pip install tactus).

FROM python:3.11-slim

# Labels for image management
ARG TACTUS_VERSION=dev
LABEL tactus.version="${TACTUS_VERSION}"
LABEL maintainer="Anthus <info@anthus.ai>"
LABEL description="Tactus sandbox container for secure procedure execution (PyPI)"

# Install system dependencies
# - Node.js for JavaScript/TypeScript MCP servers
# - git for any git operations
# - build-essential for native Python packages
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl \
    git \
    build-essential \
    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
    && apt-get install -y --no-install-recommends nodejs \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

# Create non-root user for security
RUN useradd -m -s /bin/bash tactus
WORKDIR /app

# Install Tactus from PyPI
RUN pip install --no-cache-dir "tactus==${TACTUS_VERSION}"

# Create workspace and mcp-servers directories
RUN mkdir -p /workspace /mcp-servers && \
    chown -R tactus:tactus /workspace /mcp-servers

# Copy entrypoint script
COPY tactus/docker/entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

# Switch to non-root user
USER tactus

# Set working directory for procedure execution
WORKDIR /workspace

# Default entrypoint runs the sandbox entrypoint module
ENTRYPOINT ["/entrypoint.sh"]
