# Cursor Remote-SSH / personal devbox: OpenSSH + docker CLI (DinD sidecar at runtime).
FROM ubuntu:latest

ARG KUBECTL_VERSION=v1.31.2
ARG FLUX_VERSION=2.9.4

ENV DEBIAN_FRONTEND=noninteractive \
    LANG=C.UTF-8

RUN apt-get update && apt-get install -y --no-install-recommends \
        bash \
        ca-certificates \
        chromium \
        curl \
        docker.io \
        git \
        golang \
        jq \
        nodejs \
        npm \
        openssh-server \
        python3 \
        python3-venv \
        ripgrep \
        rustc \
        sudo \
        unzip \
        vim-tiny \
        wget \
    && rm -rf /var/lib/apt/lists/* \
    && mkdir -p /var/run/sshd /etc/ssh/sshd_config.d /usr/share/devbox-http \
    && echo 'devbox ok' > /usr/share/devbox-http/index.html

# kubectl (same pattern as services/devops-ai)
RUN curl -fsSL --retry 5 --retry-all-errors --retry-delay 3 \
        "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
        -o /usr/local/bin/kubectl \
    && chmod +x /usr/local/bin/kubectl

# flux CLI
RUN curl -fsSL --retry 5 --retry-all-errors --retry-delay 3 \
        "https://github.com/fluxcd/flux2/releases/download/v${FLUX_VERSION}/flux_${FLUX_VERSION}_linux_amd64.tar.gz" \
        | tar -xz -C /usr/local/bin flux \
    && chmod +x /usr/local/bin/flux

# Passwordless sudo for the interactive developer user.
# Official ubuntu images ship uid 1000 as user "ubuntu" — rename it.
RUN usermod -l developer ubuntu \
    && groupmod -n developer ubuntu \
    && usermod -d /home/developer -m developer \
    && echo 'developer ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/developer \
    && chmod 440 /etc/sudoers.d/developer

# SSH hardening: keys only, no root login.
RUN printf '%s\n' \
      'PasswordAuthentication no' \
      'KbdInteractiveAuthentication no' \
      'PermitRootLogin no' \
      'AllowUsers developer' \
      'PubkeyAuthentication yes' \
      'X11Forwarding no' \
      'AllowTcpForwarding yes' \
      'ClientAliveInterval 30' \
      'ClientAliveCountMax 3' \
      > /etc/ssh/sshd_config.d/99-devbox.conf \
    && ssh-keygen -A

RUN curl -L https://github.com/dolthub/dolt/releases/latest/download/install.sh | bash \
    && curl -fsSL https://raw.githubusercontent.com/gastownhall/beads/main/scripts/install.sh | bash

COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

EXPOSE 22 8080
USER root
ENTRYPOINT ["/entrypoint.sh"]