# syntax=docker/dockerfile:1
#
# Harness container images for scsh. This file IS the source of truth: scsh reads it
# verbatim (include_str!) and streams it to the container builder's stdin — it is never
# written to disk. PLATFORM-AGNOSTIC: every architecture-specific download resolves the
# target arch at build time (dpkg --print-architecture -> amd64|arm64).
#
# Two final images share one base (`scsh-base`): `scsh-opencode` and `scsh-claude`. Each
# installs its harness CLI last. scsh builds only the image(s) a run needs (`--target`).
FROM debian:bookworm-slim AS scsh-base
LABEL scsh.generated=true
ARG AGENT_UID=1000
ARG AGENT_GID=1000
ARG TZ=UTC
ENV DEBIAN_FRONTEND=noninteractive
# 1. Base dev/CLI userland from apt.
RUN set -eux; \
apt-get update; \
apt-get install -y --no-install-recommends \
ca-certificates curl wget gnupg \
git git-lfs openssh-client \
bash less tree file procps psmisc \
tar gzip xz-utils zip unzip patch diffutils \
locales tzdata \
build-essential pkg-config libssl-dev cmake \
python3 python3-venv \
perl gawk \
jq sqlite3 postgresql-client \
ripgrep shellcheck \
protobuf-compiler \
iputils-ping traceroute bind9-dnsutils netcat-openbsd iproute2 whois socat; \
rm -rf /var/lib/apt/lists/*
# 2. UTF-8 locale + the builder host's timezone.
RUN set -eux; \
ln -snf "/usr/share/zoneinfo/${TZ:-UTC}" /etc/localtime; \
echo "${TZ:-UTC}" > /etc/timezone
# 3. Single-binary / apt-repo CLIs into /usr/local.
RUN set -eux; \
arch="$(dpkg --print-architecture)"; \
case "$arch" in \
amd64) uvarch=x86_64 ;; \
arm64) uvarch=aarch64 ;; \
*) echo "scsh: unsupported architecture '$arch'" >&2; exit 1 ;; \
esac; \
tmp="$(mktemp -d)"; \
curl -fsSL "https://github.com/astral-sh/uv/releases/latest/download/uv-${uvarch}-unknown-linux-gnu.tar.gz" \
| tar xz -C "$tmp" --strip-components=1; \
install -m 0755 "$tmp/uv" "$tmp/uvx" /usr/local/bin/; rm -rf "$tmp"; \
curl -fsSL "https://github.com/mikefarah/yq/releases/latest/download/yq_linux_${arch}" -o /usr/local/bin/yq; \
chmod +x /usr/local/bin/yq; \
curl -fsSL "https://dl.k8s.io/release/$(curl -fsSL https://dl.k8s.io/release/stable.txt)/bin/linux/${arch}/kubectl" \
-o /usr/local/bin/kubectl; \
chmod +x /usr/local/bin/kubectl; \
install -d -m 0755 /etc/apt/keyrings; \
curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
-o /etc/apt/keyrings/githubcli-archive-keyring.gpg; \
chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg; \
echo "deb [arch=${arch} signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
> /etc/apt/sources.list.d/github-cli.list; \
apt-get update; apt-get install -y --no-install-recommends gh; rm -rf /var/lib/apt/lists/*; \
uv --version; yq --version; kubectl version --client; gh --version
# 4. Go toolchain.
RUN set -eux; \
arch="$(dpkg --print-architecture)"; \
GO_VER="$(curl -fsSL 'https://go.dev/VERSION?m=text' | head -1)"; \
curl -fsSL "https://go.dev/dl/${GO_VER}.linux-${arch}.tar.gz" | tar xz -C /usr/local; \
/usr/local/go/bin/go version
# 5. Rust toolchain.
RUN set -eux; \
export CARGO_HOME=/usr/local/cargo RUSTUP_HOME=/usr/local/rustup; \
curl -fsSL https://sh.rustup.rs | sh -s -- -y --no-modify-path --profile minimal; \
chmod -R a+rwX /usr/local/cargo; \
/usr/local/cargo/bin/rustc --version; /usr/local/cargo/bin/cargo --version
# 6. AWS CLI v2.
RUN set -eux; \
case "$(dpkg --print-architecture)" in \
amd64) awsarch=x86_64 ;; \
arm64) awsarch=aarch64 ;; \
*) echo "scsh: unsupported architecture" >&2; exit 1 ;; \
esac; \
curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-${awsarch}.zip" -o /tmp/awscliv2.zip; \
unzip -q /tmp/awscliv2.zip -d /tmp; /tmp/aws/install; rm -rf /tmp/aws /tmp/awscliv2.zip; \
aws --version
# 7. Google Cloud CLI.
RUN set -eux; \
case "$(dpkg --print-architecture)" in \
amd64) gclarch=x86_64 ;; \
arm64) gclarch=arm ;; \
*) echo "scsh: unsupported architecture" >&2; exit 1 ;; \
esac; \
curl -fsSL "https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-linux-${gclarch}.tar.gz" \
| tar xz -C /usr/local; \
/usr/local/google-cloud-sdk/install.sh --quiet --usage-reporting=false --path-update=false --command-completion=false; \
ln -snf /usr/local/google-cloud-sdk/bin/gcloud /usr/local/bin/gcloud; \
ln -snf /usr/local/google-cloud-sdk/bin/gsutil /usr/local/bin/gsutil; \
gcloud --version
# 8. Non-root agent user; repo mount is a subdirectory of home.
RUN set -eu; \
uid="${AGENT_UID:-1000}"; gid="${AGENT_GID:-1000}"; \
groupadd -g "$gid" agent 2>/dev/null || groupadd agent 2>/dev/null || true; \
useradd -u "$uid" -g "$gid" -m -d /home/agent -s /bin/sh agent 2>/dev/null \
|| useradd -g "$gid" -m -d /home/agent -s /bin/sh agent 2>/dev/null || true; \
mkdir -p /home/agent/repo; chown -R "$uid:$gid" /home/agent
WORKDIR /home/agent/repo
ENV SCSH=1
ENV HOME=/home/agent
ENV LANG=C.UTF-8
ENV LC_ALL=C.UTF-8
ENV TZ=${TZ}
ENV CARGO_HOME=/usr/local/cargo
ENV RUSTUP_HOME=/usr/local/rustup
ENV PATH=/usr/local/go/bin:/usr/local/cargo/bin:/usr/local/bin:$PATH
ENV SCSH_RUN_LOG=/home/agent/repo/tmp/scsh-run.log
# --- OpenCode harness image (install harness last) ---
FROM scsh-base AS scsh-opencode
RUN set -eux; \
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -; \
apt-get install -y --no-install-recommends nodejs; \
rm -rf /var/lib/apt/lists/*; \
npm install -g opencode-ai; \
chmod -R a+rX "$(npm root -g)"; \
opencode --version
ENV OPENCODE_YOLO=true
ENV OPENCODE_DANGEROUSLY_SKIP_PERMISSIONS=true
ENV XDG_DATA_HOME=/home/agent/repo/tmp/.xdg-data
USER agent
# --- Claude Code harness image (install harness last) ---
FROM scsh-base AS scsh-claude
RUN set -eux; \
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -; \
apt-get install -y --no-install-recommends nodejs; \
rm -rf /var/lib/apt/lists/*; \
npm install -g @anthropic-ai/claude-code; \
chmod -R a+rX "$(npm root -g)"; \
claude --version
USER agent