DockerFile.swift

# For Swift Development
FROM swift:latest

ARG AGENT_RUNTIMES=codex
ARG AGENT_DEFAULT_RUNTIME=codex
ARG AGENT_FEATURES=""
ARG BUILD_TIME=""

# --- Core dev tooling (keep lean, no recommends) ---
RUN DEBIAN_FRONTEND=noninteractive \
    apt-get update && \
    apt-get install -y --no-install-recommends \
        zsh file curl perl ripgrep jq util-linux bubblewrap \
        nodejs npm \
        make \
        python-is-python3 \
  && rm -rf /var/lib/apt/lists/*

# --- Wrapper scripts (swift-format is already in swift:latest) ---
RUN printf '%s\n' \
  '#!/usr/bin/env bash' \
  'set -euo pipefail' \
  '' \
  '# Prefer Sources/Tests if present, otherwise format whole repo' \
  'if [ -d Sources ] || [ -d Tests ]; then' \
  '  swift-format format -i -r Sources Tests 2>/dev/null || true' \
  'else' \
  '  swift-format format -i -r .' \
  'fi' \
  > /usr/local/bin/format \
  && chmod +x /usr/local/bin/format

RUN printf '%s\n' \
  '#!/usr/bin/env bash' \
  'set -euo pipefail' \
  '' \
  '# swift-format lint exits non-zero on violations' \
  'if [ -d Sources ] || [ -d Tests ]; then' \
  '  swift-format lint -r Sources Tests 2>/dev/null || swift-format lint -r .' \
  'else' \
  '  swift-format lint -r .' \
  'fi' \
  > /usr/local/bin/lint \
  && chmod +x /usr/local/bin/lint

# --- Add user ---
RUN groupadd coder \
 && useradd -m -g coder -d /home/coder -s /bin/bash coder \
 && mkdir -p /home/coder/.codex /workdir \
      /opt/agentctl/bin /opt/agentctl/codex /opt/agentctl/claude /opt/agentctl/opencode /opt/agentctl/qwen /opt/agentctl/pi \
 && chown -R coder:coder /home/coder /workdir /opt/agentctl

# Make sure HOME is correct for subsequent RUNs when we switch user
ENV HOME=/home/coder \
    IMAGE_NAME=agent-swift \
    AGENTCTL_TOOLS_HOME=/opt/agentctl \
    SWIFTLY_HOME_DIR=/home/coder/.swiftly \
    SWIFTLY_BIN_DIR=/home/coder/.local/bin \
    PATH=/opt/agentctl/bin:/home/coder/.local/bin:$PATH

# Copy tracked defaults, then apply optional host-local overrides.
COPY --chown=coder:coder defaults/codex/ /home/coder/.codex/
COPY --chown=coder:coder defaults.local/codex/ /home/coder/.codex/
COPY VERSION /etc/agentctl/image-version
COPY VERSION /etc/agentctl/tooling-version
COPY defaults/ /etc/agentctl/
COPY defaults.local/ /etc/agentctl/
COPY agentctl-path.sh /etc/profile.d/agentctl-path.sh

# Install the generic runtime launcher and runtime registry
COPY agent.sh /usr/local/bin/agent.sh
COPY runtimes /usr/local/lib/agentctl/runtimes
COPY runtimes.d /etc/agentctl/runtimes.d
COPY features /usr/local/lib/agentctl/features
COPY features.d /etc/agentctl/features.d
RUN chmod 0755 /usr/local/bin/agent.sh \
 && chmod 0644 /etc/profile.d/agentctl-path.sh /etc/agentctl/claude/settings.json \
 && rm -f /home/coder/.codex/.gitkeep \
 && find /etc/agentctl -name .gitkeep -delete \
 && find /etc/agentctl -type f -exec chmod 0644 {} + \
 && find /usr/local/lib/agentctl/runtimes -type f -name '*.sh' -exec chmod 0644 {} + \
 && find /usr/local/lib/agentctl/features -type f -name '*.sh' -exec chmod 0644 {} + \
 && mkdir -p /etc/agentctl

RUN if [ -n "$AGENT_FEATURES" ]; then \
      AGENT_FEATURES="$AGENT_FEATURES" bash -lc 'set -euo pipefail; IFS="," read -r -a features <<<"$AGENT_FEATURES"; for feature in "${features[@]}"; do bash /usr/local/bin/agent.sh feature install "$feature"; done'; \
    fi

RUN mkdir -p /home/coder/.local/bin /home/coder/.swiftly \
 && chown -R coder:coder /home/coder/.local /home/coder/.swiftly

USER coder

# --- Install the configured runtimes via agent.sh ---
RUN HOME=/home/coder \
    XDG_CONFIG_HOME=/home/coder/.config \
    AGENTCTL_SKIP_PREFERRED_SET=1 \
    AGENT_RUNTIMES="$AGENT_RUNTIMES" \
    AGENT_DEFAULT_RUNTIME="$AGENT_DEFAULT_RUNTIME" \
    bash -lc 'set -euo pipefail; IFS="," read -r -a runtimes <<<"$AGENT_RUNTIMES"; [ "${#runtimes[@]}" -gt 0 ] || { echo "No runtimes configured for image build" >&2; exit 1; }; for runtime in "${runtimes[@]}"; do bash /usr/local/bin/agent.sh runtime install "$runtime"; done'

USER root

RUN printf "%s\n" "$AGENT_DEFAULT_RUNTIME" > /etc/agentctl/preferred-runtime \
 && chown -R coder:coder /home/coder /workdir

RUN BUILD_TIME="${BUILD_TIME:-$(date -u +%Y-%m-%dT%H:%M:%SZ)}" \
 && cat > /etc/agentctl/image.md <<EOF
You are running inside the \`agent-swift\` image.

Environment:
- containerized Ubuntu-based Linux (package manager \`apt-get\`, package tools \`dpkg\`)
- running as the non-root user \`coder\`
- shared host workspace at \`/workdir\`
- architecture: check with \`uname -m\` if needed

Image metadata:
- image: \`agent-swift\`
- built_at_utc: \`${BUILD_TIME}\`

Built-in CLI tools:
- base tools: \`bash\`, \`zsh\`, \`curl\`, \`file\`, \`jq\`, \`rg\`, \`bwrap\`
- control tools: \`agent.sh\`
- programming tools: \`node\`, \`npm\`, \`make\`, \`python\`, \`swift\`, \`swift-format\`, \`swiftly\`, plus the wrapper commands \`format\` and \`lint\`

Programming environments:
- Node.js with npm
- Swift on Linux
- Python

Assume Linux Swift toolchains and Linux build behavior. Do not assume access to macOS, Xcode, iOS SDKs, or Apple simulator frameworks inside this container.
EOF
RUN ln -sf /etc/agentctl/image.md /home/coder/.codex/AGENTS.md

# From here on, run as coder so swiftly writes user-owned files
USER coder
WORKDIR /workdir

# --- Add swiftly to manage swift toolchains (no extra toolchain install) ---
RUN curl -fsSL https://download.swift.org/swiftly/linux/swiftly-$(uname -m).tar.gz \
    | tar -xz -C /tmp \
 && /tmp/swiftly init \
    --quiet-shell-followup \
    --no-modify-profile \
    --skip-install \
    --assume-yes \
 && rm -rf /tmp/swiftly

# Configure git
RUN git config --global user.email "codex@localhost" \
 && git config --global user.name "Codex CLI" \
 && git config --global init.defaultBranch "main" \
 && git config --global --add safe.directory /workdir

# Hardened entrypoint
ENTRYPOINT ["setpriv","--inh-caps=-all","--ambient-caps=-all","--no-new-privs","--"]
CMD ["/usr/local/bin/agent.sh","run"]