# The nisse-dev agent as a container image (Development Plan M1.5, X4).
#
# Stateless: the state store and SSH known-hosts live in a volume
# (/var/lib/nisse-dev); configuration is mounted read-only
# (/etc/nisse-dev/nisse-dev.yaml); secrets come as environment variables
# (docker --env-file); SSH and deploy keys are mounted read-only wherever the
# configuration says. The agent runs no model-chosen command here (L13):
# those go to build VMs over SSH.
#
#   docker build -t nisse-dev .                  the agent
#   docker build --target test -t nisse-dev:test .   plus the tests, for
#                                                   scripts/e2e.sh --image

FROM python:3.12-slim AS build
COPY --from=ghcr.io/astral-sh/uv:0.12.10 /uv /usr/local/bin/uv
ENV UV_PROJECT_ENVIRONMENT=/opt/nisse UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy
WORKDIR /src
COPY pyproject.toml uv.lock ./
COPY nisse-core nisse-core
COPY nisse-dev nisse-dev
COPY nisse-ops nisse-ops
# The agent and what it needs, installed (not editable): the source tree
# isn't part of the image.
RUN uv sync --frozen --no-dev --package nisse-dev --no-editable

FROM python:3.12-slim AS runtime
ARG VERSION=dev
LABEL org.opencontainers.image.title=nisse-dev org.opencontainers.image.version=$VERSION
RUN apt-get update \
    && apt-get install -y --no-install-recommends openssh-client \
    && rm -rf /var/lib/apt/lists/* \
    && useradd --create-home --uid 10001 nisse \
    && mkdir -p /var/lib/nisse-dev /etc/nisse-dev \
    && chown nisse /var/lib/nisse-dev
COPY --from=build /opt/nisse /opt/nisse
ENV PATH=/opt/nisse/bin:$PATH \
    NISSE_CONFIG=/etc/nisse-dev/nisse-dev.yaml \
    NISSE_ENV=/run/nisse-dev/.env
VOLUME /var/lib/nisse-dev
USER nisse
ENTRYPOINT ["nisse-dev"]

# The image's own package plus the tests, so the end-to-end suite runs
# against what was built, not the source tree.
FROM runtime AS test
USER root
RUN apt-get update \
    && apt-get install -y --no-install-recommends git openssh-server \
    && rm -rf /var/lib/apt/lists/* \
    && mkdir -p /run/sshd
COPY --from=build /usr/local/bin/uv /usr/local/bin/uv
WORKDIR /src
COPY pyproject.toml uv.lock ./
COPY nisse-core nisse-core
COPY nisse-dev nisse-dev
COPY nisse-ops nisse-ops
COPY tests tests
COPY scripts scripts
COPY conftest.py ./
ENV UV_PROJECT_ENVIRONMENT=/opt/nisse
# Test tools too, all installed (not editable), and `uv run` never re-syncs:
# the tests import the package as built, not the source tree beside them.
RUN uv sync --frozen --all-packages --no-editable --inexact
ENV UV_NO_SYNC=1
ENTRYPOINT []

# The default target: the agent itself.
FROM runtime AS agent