DockerFile

# For the plain agent environment
FROM alpine:latest

ARG AGENT_RUNTIMES=codex
ARG AGENT_DEFAULT_RUNTIME=codex
ARG AGENT_FEATURES=""
ARG BUILD_TIME=""

# --- Core tooling ---
RUN apk add --no-cache \
        bash zsh file curl git perl ripgrep jq util-linux bubblewrap nodejs npm libgcc libstdc++

# --- Add user ---
RUN addgroup -S coder \
 && adduser  -S -G coder -h /home/coder -s /bin/bash coder \
 && mkdir -p /home/coder/.codex /home/coder/.local/bin /workdir \
      /opt/agentctl/bin /opt/agentctl/codex /opt/agentctl/claude /opt/agentctl/opencode /opt/agentctl/qwen /opt/agentctl/pi \
 && chown -R coder:coder /home/coder /workdir /opt/agentctl

# Make sure HOME is correct for subsequent RUNs when we switch user
ENV HOME=/home/coder \
    IMAGE_NAME=agent-plain \
    AGENTCTL_TOOLS_HOME=/opt/agentctl \
    PATH=/opt/agentctl/bin:/home/coder/.local/bin:$PATH

# Copy tracked defaults, then apply optional host-local overrides.
COPY --chown=coder:coder defaults/codex/ /home/coder/.codex/
COPY --chown=coder:coder defaults.local/codex/ /home/coder/.codex/
COPY VERSION /etc/agentctl/image-version
COPY VERSION /etc/agentctl/tooling-version
COPY defaults/ /etc/agentctl/
COPY defaults.local/ /etc/agentctl/
COPY agentctl-path.sh /etc/profile.d/agentctl-path.sh

# Install the generic runtime launcher and runtime registry
COPY agent.sh /usr/local/bin/agent.sh
COPY runtimes /usr/local/lib/agentctl/runtimes
COPY runtimes.d /etc/agentctl/runtimes.d
COPY features /usr/local/lib/agentctl/features
COPY features.d /etc/agentctl/features.d
RUN chmod 0755 /usr/local/bin/agent.sh \
 && chmod 0644 /etc/profile.d/agentctl-path.sh /etc/agentctl/claude/settings.json \
 && rm -f /home/coder/.codex/.gitkeep \
 && find /etc/agentctl -name .gitkeep -delete \
 && find /etc/agentctl -type f -exec chmod 0644 {} + \
 && find /usr/local/lib/agentctl/runtimes -type f -name '*.sh' -exec chmod 0644 {} + \
 && find /usr/local/lib/agentctl/features -type f -name '*.sh' -exec chmod 0644 {} + \
 && mkdir -p /etc/agentctl

RUN if [ -n "$AGENT_FEATURES" ]; then \
      AGENT_FEATURES="$AGENT_FEATURES" bash -lc 'set -euo pipefail; IFS="," read -r -a features <<<"$AGENT_FEATURES"; for feature in "${features[@]}"; do bash /usr/local/bin/agent.sh feature install "$feature"; done'; \
    fi

USER coder

# --- Install the configured runtimes via agent.sh ---
RUN HOME=/home/coder \
    XDG_CONFIG_HOME=/home/coder/.config \
    AGENTCTL_SKIP_PREFERRED_SET=1 \
    AGENT_RUNTIMES="$AGENT_RUNTIMES" \
    AGENT_DEFAULT_RUNTIME="$AGENT_DEFAULT_RUNTIME" \
    bash -lc 'set -euo pipefail; IFS="," read -r -a runtimes <<<"$AGENT_RUNTIMES"; [ "${#runtimes[@]}" -gt 0 ] || { echo "No runtimes configured for image build" >&2; exit 1; }; for runtime in "${runtimes[@]}"; do bash /usr/local/bin/agent.sh runtime install "$runtime"; done'

USER root

RUN printf "%s\n" "$AGENT_DEFAULT_RUNTIME" > /etc/agentctl/preferred-runtime \
 && chown -R coder:coder /home/coder /workdir

RUN BUILD_TIME="${BUILD_TIME:-$(date -u +%Y-%m-%dT%H:%M:%SZ)}" \
 && cat > /etc/agentctl/image.md <<EOF
You are running inside the \`agent-plain\` default image.

Environment:
- containerized Alpine Linux (package manager \`apk\`)
- running as the non-root user \`coder\`
- shared host workspace at \`/workdir\`
- architecture: check with \`uname -m\` if needed

Image metadata:
- image: \`agent-plain\`
- built_at_utc: \`${BUILD_TIME}\`

Built-in CLI tools:
- base tools: \`bash\`, \`zsh\`, \`git\`, \`curl\`, \`file\`, \`jq\`, \`rg\`, \`bwrap\`
- control tools: \`agent.sh\`
- programming tools: \`node\`, \`npm\`

Use this image for general shell work, Git operations, repository maintenance, and light scripting.
EOF
RUN ln -sf /etc/agentctl/image.md /home/coder/.codex/AGENTS.md

# From here on, run as coder.
USER coder
WORKDIR /workdir

# Configure git
RUN git config --global user.email "codex@localhost" \
 && git config --global user.name "Codex CLI" \
 && git config --global init.defaultBranch "main" \
 && git config --global --add safe.directory /workdir

# Hardened entrypoint
ENTRYPOINT ["setpriv","--inh-caps=-all","--ambient-caps=-all","--no-new-privs","--"]
CMD ["/usr/local/bin/agent.sh","run"]