Containerfile

# localdev - Lightweight development container (DEFAULT)
# Optimized for fast startup - no Java, no Atlassian CLI
# For full container with Java and Atlassian CLI, see Dockerfile.full
# Multi-arch: supports linux/amd64 and linux/arm64
FROM debian:bookworm-slim

# OCI annotations for image metadata
LABEL org.opencontainers.image.title="localdev" \
      org.opencontainers.image.description="Lightweight isolated development container for Claude Code and AI assistants with Node.js LTS, Go, and essential tools" \
      org.opencontainers.image.url="https://github.com/gherlein/localdev" \
      org.opencontainers.image.source="https://github.com/gherlein/localdev" \
      org.opencontainers.image.documentation="https://github.com/gherlein/localdev/blob/main/README.md" \
      org.opencontainers.image.licenses="MIT" \
      org.opencontainers.image.vendor="Greg Herlein" \
      org.opencontainers.image.authors="Greg Herlein"

# Install dependencies
RUN apt-get update && apt-get install -y \
    sudo \
    curl \
    git \
    unzip \
    build-essential \
    cmake \
    squashfs-tools \
    zip \
    file \
    xxd \
    ffmpeg \
    qpdf \
    imagemagick \
    libpcap-dev \
    jq \
    gosu \
    python3 \
    python3-pip \
    tree \
    tmux \
    mg \
    rsync \
    zoxide \
    keychain \
    direnv \
    ca-certificates \
    zstd && rm -rf /var/lib/apt/lists/*

# Install pandoc and WeasyPrint runtime dependencies for markdown -> PDF
RUN apt-get update && apt-get install -y \
    pandoc \
    libpango-1.0-0 \
    libpangoft2-1.0-0 \
    libharfbuzz0b \
    libcairo2 \
    libgdk-pixbuf-2.0-0 \
    libffi8 \
    shared-mime-info \
    fonts-dejavu \
    fonts-liberation && rm -rf /var/lib/apt/lists/*

# Install Node.js LTS only using nvm
ENV NVM_DIR=/usr/local/nvm

RUN mkdir -p $NVM_DIR && \
    curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash && \
    . $NVM_DIR/nvm.sh && \
    nvm install --lts && \
    nvm alias default node && \
    nvm use default

# Add nvm to PATH - source nvm in subsequent RUN commands
ENV NODE_PATH="$NVM_DIR/versions/node"
SHELL ["/bin/bash", "-c"]

# Set PATH to include the default Node.js version installed by nvm
# Also create a symlink for consistent path across node version updates
RUN . $NVM_DIR/nvm.sh && \
    ln -s "$NVM_DIR/versions/node/$(nvm version default)" "$NVM_DIR/default" && \
    echo "export PATH=\"$NVM_DIR/default/bin:\$PATH\"" >> /etc/environment

# Add node to PATH at container level (required for scripts like clauded)
ENV PATH="$NVM_DIR/default/bin:${PATH}"

# Install Podman
RUN apt-get update && apt-get install -y \
    podman \
    uidmap \
    fuse-overlayfs \
    slirp4netns && \
    rm -rf /var/lib/apt/lists/*

# Configure Podman for rootless operation
RUN mkdir -p /etc/containers && \
    echo '[containers]' > /etc/containers/containers.conf && \
    echo 'netns="host"' >> /etc/containers/containers.conf && \
    echo 'userns="host"' >> /etc/containers/containers.conf && \
    echo 'ipcns="host"' >> /etc/containers/containers.conf && \
    echo 'utsns="host"' >> /etc/containers/containers.conf && \
    echo 'cgroupns="host"' >> /etc/containers/containers.conf && \
    echo 'cgroups="disabled"' >> /etc/containers/containers.conf && \
    echo 'devices=["/dev/null"]' >> /etc/containers/containers.conf && \
    echo '[engine]' >> /etc/containers/containers.conf && \
    echo 'cgroup_manager="cgroupfs"' >> /etc/containers/containers.conf && \
    echo 'events_logger="file"' >> /etc/containers/containers.conf && \
    echo 'runtime="crun"' >> /etc/containers/containers.conf

# Install GitHub CLI
RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg && \
    chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg && \
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null && \
    apt-get update && \
    apt-get install -y gh && \
    rm -rf /var/lib/apt/lists/*

# Install Go
ARG GO_VERSION=1.25.0
ARG TARGETARCH
RUN echo "TARGETARCH: ${TARGETARCH}" && \
    GOARCH="${TARGETARCH}" && \
    if [ "${TARGETARCH}" = "amd64" ]; then GOARCH=amd64; fi && \
    if [ "${TARGETARCH}" = "arm64" ]; then GOARCH=arm64; fi && \
    echo "GOARCH: ${GOARCH}" && \
    curl -fsSL https://dl.google.com/go/go${GO_VERSION}.linux-${GOARCH}.tar.gz | tar --no-same-permissions --no-same-owner -xzC /usr/local

# Set Go environment variables
ENV GOROOT=/usr/local/go
ENV GOPATH=/home/developer/go
ENV PATH="${GOROOT}/bin:${GOPATH}/bin:${PATH}"

# Install TinyGo
ARG TINYGO_VERSION=0.40.1
RUN TINYGO_ARCH="${TARGETARCH}" && \
    if [ "${TARGETARCH}" = "amd64" ]; then TINYGO_ARCH=amd64; fi && \
    if [ "${TARGETARCH}" = "arm64" ]; then TINYGO_ARCH=arm64; fi && \
    echo "TINYGO_ARCH: ${TINYGO_ARCH}" && \
    curl -fsSL "https://github.com/tinygo-org/tinygo/releases/download/v${TINYGO_VERSION}/tinygo_${TINYGO_VERSION}_${TINYGO_ARCH}.deb" -o /tmp/tinygo.deb && \
    dpkg -i /tmp/tinygo.deb && \
    rm /tmp/tinygo.deb


# Create a new user with UID/GID 1000 to match host user
RUN (groupadd -g 1000 developer 2>/dev/null || groupmod -n developer $(getent group 1000 | cut -d: -f1)) && \
    (useradd -m -u 1000 -g 1000 -s /bin/bash developer 2>/dev/null || \
    usermod -l developer -d /home/developer -m $(getent passwd 1000 | cut -d: -f1) 2>/dev/null || true) && \
    echo 'developer ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers

# Fix permissions for developer user
RUN mkdir -p /home/developer/go/{bin,src,pkg} && \
    chown -R 1000:1000 /home/developer

# Install essential npm tools only (Claude Code installed later as developer user)
RUN . $NVM_DIR/nvm.sh && \
    NODE_OPTIONS="--max-old-space-size=4096" npm install -g \
    typescript \
    ts-node \
    pnpm \
    eslint \
    prettier && \
    npm cache clean --force

# Setup lazy-load nvm in bash for all users (loads on first use)
RUN echo 'export NVM_DIR=/usr/local/nvm' >> /etc/bash.bashrc && \
    echo '# Lazy-load nvm for faster shell startup' >> /etc/bash.bashrc && \
    echo 'nvm() { unset -f nvm node npm npx; . "$NVM_DIR/nvm.sh"; nvm "$@"; }' >> /etc/bash.bashrc && \
    echo 'node() { unset -f nvm node npm npx; . "$NVM_DIR/nvm.sh"; node "$@"; }' >> /etc/bash.bashrc && \
    echo 'npm() { unset -f nvm node npm npx; . "$NVM_DIR/nvm.sh"; npm "$@"; }' >> /etc/bash.bashrc && \
    echo 'npx() { unset -f nvm node npm npx; . "$NVM_DIR/nvm.sh"; npx "$@"; }' >> /etc/bash.bashrc && \
    echo '# Add default node to PATH for non-interactive use' >> /etc/bash.bashrc && \
    echo 'export PATH="$NVM_DIR/versions/node/$(cat $NVM_DIR/alias/default 2>/dev/null || echo "v22")/bin:$PATH" 2>/dev/null || true' >> /etc/bash.bashrc && \
    echo '# Add user npm global binaries to PATH' >> /etc/bash.bashrc && \
    echo 'export PATH="$HOME/.npm-global/bin:$PATH"' >> /etc/bash.bashrc && \
    echo '# Alias emacs to mg' >> /etc/bash.bashrc && \
    echo 'alias emacs=mg' >> /etc/bash.bashrc && \
    echo '# Claude dangerous mode alias (backup - also in dotfiles)' >> /etc/bash.bashrc && \
    echo 'alias clauded="claude --dangerously-skip-permissions"' >> /etc/bash.bashrc

# Install stow for dotfiles management
RUN apt-get update && apt-get install -y stow && rm -rf /var/lib/apt/lists/*

# Stow dotfiles and source user bash config at shell startup
RUN echo '# Stow dotfiles from /external/dotfiles if present (bash package handled separately)' >> /etc/bash.bashrc && \
    echo 'if [[ -d /external/dotfiles ]]; then' >> /etc/bash.bashrc && \
    echo '  for _dotpkg_dir in /external/dotfiles/*/; do' >> /etc/bash.bashrc && \
    echo '    _dotpkg=$(basename "$_dotpkg_dir")' >> /etc/bash.bashrc && \
    echo '    [[ "$_dotpkg" == "bash" ]] && continue' >> /etc/bash.bashrc && \
    echo '    stow --no-folding --dir=/external/dotfiles --target="$HOME" "$_dotpkg" 2>/dev/null || true' >> /etc/bash.bashrc && \
    echo '  done' >> /etc/bash.bashrc && \
    echo '  unset _dotpkg_dir _dotpkg' >> /etc/bash.bashrc && \
    echo '  [[ -f /external/dotfiles/bash/.bashrc ]] && source /external/dotfiles/bash/.bashrc' >> /etc/bash.bashrc && \
    echo '  [[ -f /external/dotfiles/bash/.bash_profile ]] && source /external/dotfiles/bash/.bash_profile' >> /etc/bash.bashrc && \
    echo 'fi' >> /etc/bash.bashrc && \
    echo '# Keep ~/bin available but at the end of PATH so container-installed tools' >> /etc/bash.bashrc && \
    echo '# take precedence over host-mounted binaries built for a different arch.' >> /etc/bash.bashrc && \
    echo 'export PATH="$(printf "%s" "$PATH" | tr ":" "\n" | grep -v "^/home/developer/bin$" | tr "\n" ":" | sed "s/:$//"):/home/developer/bin"' >> /etc/bash.bashrc && \
    echo '# Return to workspace after dotfiles may have changed directory' >> /etc/bash.bashrc && \
    echo '[[ -n "$WORKSPACE" && -d "$WORKSPACE" ]] && cd "$WORKSPACE"' >> /etc/bash.bashrc

# Container identity marker for the shell prompt. Appended AFTER the dotfiles
# sourcing block above so it wins over any PS1 the user's stowed dotfiles set.
RUN echo '# --- localdev container indicator (must run after dotfiles sourcing) ---' >> /etc/bash.bashrc && \
    echo 'export LOCALDEV=1' >> /etc/bash.bashrc && \
    echo 'export container=podman' >> /etc/bash.bashrc && \
    echo 'export debian_chroot=localdev' >> /etc/bash.bashrc && \
    echo '__localdev_tag="\[\e[1;33m\][localdev]\[\e[0m\] "' >> /etc/bash.bashrc && \
    echo 'case "$PS1" in *"[localdev]"*) ;; *) PS1="${__localdev_tag}${PS1}";; esac' >> /etc/bash.bashrc

WORKDIR /home/developer

# Install udev and USB libraries for device access
RUN apt-get update && apt-get install -y \
    udev \
    libusb-1.0-0 \
    libusb-1.0-0-dev \
    usbutils \
    && rm -rf /var/lib/apt/lists/*

# Install networking, wireless, and SDR (software-defined radio) tooling.
# Preseed wireshark-common BEFORE installing tshark so the debconf setuid
# prompt is answered "no" -- non-superusers must NOT be able to capture packets.
RUN echo 'wireshark-common wireshark-common/install-setuid boolean false' | debconf-set-selections && \
    apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
    nmap \
    tshark \
    avahi-utils \
    iw \
    net-tools \
    iproute2 \
    iperf3 \
    aircrack-ng \
    gpsd \
    gpsd-clients \
    hackrf \
    libhackrf-dev \
    rtl-sdr \
    librtlsdr-dev \
    soapysdr-tools \
    soapysdr-module-rtlsdr \
    soapysdr-module-hackrf \
    libhamlib-utils \
    libhamlib-dev \
    ax25-tools \
    ax25-apps \
    libax25 \
    libpcap-dev \
    && rm -rf /var/lib/apt/lists/*

# Switch to developer user
USER developer

# Update PATH to include user-local npm binaries
ENV PATH="/home/developer/.npm-global/bin:${PATH}"

# Configure npm prefix for developer user
RUN mkdir -p "$HOME/.npm-global" && \
    npm config set prefix "$HOME/.npm-global"

# Install Claude Code using native installer
RUN curl -fsSL https://claude.ai/install.sh | bash

# Install opencode
RUN curl -fsSL https://opencode.ai/install | bash

# Add opencode to PATH for non-interactive use
ENV PATH="/home/developer/.opencode/bin:${PATH}"

# install uv with retry logic
RUN for i in 1 2 3; do \
    curl -LsSf https://astral.sh/uv/install.sh | sh && break || \
    (echo "Attempt $i failed, retrying..." && sleep 5); \
    done

# Add uv to PATH
ENV PATH="/home/developer/.local/bin:${PATH}"

# Install oh-my-pi (omp) coding agent into ~/.local/bin.
# --binary is explicit: the installer's default path would fall back to a bun
# source build, and this image has no bun. The prebuilt glibc releases cover
# both linux-x64 and linux-arm64, matching the image's target platforms.
RUN curl -fsSL https://omp.sh/install | sh -s -- --binary && \
    omp --version

# Add the host-mounted ~/bin to PATH at the container level so it is available to
# ALL shells -- login, non-login, and the non-interactive shells that AI agents use
# to run commands (these never source /etc/bash.bashrc, which is why tools like
# gplogin were "command not found"). Appended at the END so container-installed
# tools take precedence over host binaries that may target a different architecture.
ENV PATH="${PATH}:/home/developer/bin"

# Install WeasyPrint as an isolated uv tool (used by pandoc --pdf-engine=weasyprint)
RUN /home/developer/.local/bin/uv tool install weasyprint

# Install essential Go tools only
RUN go install golang.org/x/tools/cmd/goimports@latest && \
    go install golang.org/x/tools/gopls@latest && \
    go install github.com/go-delve/delve/cmd/dlv@latest && \
    go install github.com/mark3labs/kit/cmd/kit@latest

# Install golangci-lint from the pinned release tarball with checksum
# verification. NOT `go install`: the v2 line lives at module path
# .../golangci-lint/v2/..., so `@latest` on the old path silently resolves to
# v1.64.x. Installed to ~/.local/bin, which precedes $GOPATH/bin on PATH.
ARG GOLANGCI_LINT_VERSION=2.12.2
RUN set -euo pipefail && \
    ARCH="${TARGETARCH:-$(dpkg --print-architecture)}" && \
    A="golangci-lint-${GOLANGCI_LINT_VERSION}-linux-${ARCH}" && \
    SUMS="golangci-lint-${GOLANGCI_LINT_VERSION}-checksums.txt" && \
    BASE="https://github.com/golangci/golangci-lint/releases/download/v${GOLANGCI_LINT_VERSION}" && \
    mkdir -p "$HOME/.local/bin" /tmp/golangci && cd /tmp/golangci && \
    curl -fsSL -O "${BASE}/${A}.tar.gz" && \
    curl -fsSL -O "${BASE}/${SUMS}" && \
    grep " ${A}.tar.gz\$" "${SUMS}" | sha256sum -c - && \
    tar -xzf "${A}.tar.gz" "${A}/golangci-lint" && \
    install -m 755 "${A}/golangci-lint" "$HOME/.local/bin/" && \
    cd /home/developer && rm -rf /tmp/golangci && \
    golangci-lint --version

# Install gofi UniFi utilities (gofips, gofimac). The module path declared in
# go.mod (github.com/unifi-go/gofi) does not match the public repo, so a plain
# `go install ...@latest` cannot resolve it -- clone and build directly instead.
# `cd` to a known-good dir first: `go build` calls getwd and the RUN shell's
# inherited cwd is not usable here (the go install steps above avoid getwd).
RUN cd /home/developer && \
    git clone --depth 1 https://github.com/emergingrobotics/gofi gofi-src && \
    cd gofi-src && \
    go build -o "${GOPATH}/bin/gofips" ./utilities/gofips && \
    go build -o "${GOPATH}/bin/gofimac" ./utilities/gofimac && \
    cd /home/developer && rm -rf gofi-src && \
    go clean -cache

# Switch back to root so the entrypoint can remap UID/GID at runtime
USER root

# Copy launcher scripts into container for easy extraction
COPY localdev localdevnet localdevpull localdev-mounts.sh localdev-mounts.toml.example /opt/localdev/bin/
RUN chmod +x /opt/localdev/bin/localdev /opt/localdev/bin/localdevnet /opt/localdev/bin/localdevpull

COPY docker-entrypoint.sh /docker-entrypoint.sh
RUN chmod +x /docker-entrypoint.sh

ENTRYPOINT ["/docker-entrypoint.sh"]
CMD ["/bin/bash"]