# syntax=docker/dockerfile:1.7
# Runtime image built from a pre-compiled `baseplate` binary (built `--features cli`) — no source,
# no toolchain. CI (.github/workflows/release.yml) extracts each release tarball into
# dist/linux/<arch>/baseplate and builds this with `buildx --platform linux/amd64,linux/arm64`;
# buildx selects the matching binary per platform via $TARGETARCH, producing a multi-arch
# manifest with no QEMU emulation.
#
# Manual single-arch build:
#   mkdir -p dist/linux/amd64
#   tar -xzf baseplate-x86_64-unknown-linux-gnu.tar.gz -C dist/linux/amd64/
#   docker build -f Dockerfile.dist -t baseplate .
#
# The `baseplate` query CLI is self-contained (no network) — it exposes the substrate's genuinely
# out-of-process ops (java-test / patterns / registry). Run it network-free:
#   echo '{"paths":["src/test/java/x/FooTest.java"]}' \
#     | docker run --rm -i --network none baseplate java-test analyze
#
# This is a standalone consumable image. By design NO other component image derives FROM it
# (dependents stay FROM ubuntu@digest for an independent release cadence — ADR-0049/0054); the
# substrate's type-provider role stays a compile-time crate dependency, not a base layer.
FROM ubuntu:24.04@sha256:786a8b558f7be160c6c8c4a54f9a57274f3b4fb1491cf65146521ae77ff1dc54

LABEL org.opencontainers.image.source="https://github.com/Barnett-Studios/baseplate" \
      org.opencontainers.image.description="Agentic-harness substrate — its invocable query ops (java-test/patterns/registry) as a one-shot CLI" \
      org.opencontainers.image.licenses="MIT OR Apache-2.0"

RUN useradd --uid 10001 --create-home --user-group baseplate

# Populated by CI (or a manual tar extraction) before build; buildx sets TARGETARCH.
ARG TARGETARCH
COPY --chmod=755 dist/linux/${TARGETARCH}/baseplate /usr/local/bin/baseplate

USER 10001
WORKDIR /work
ENTRYPOINT ["baseplate"]