# Bounded executor image (NK-WP-0056-T13). Build context: the repository root.
#   docker build -f bounded-executor/Containerfile .
# lldap_set_password comes from the same pinned LLDAP image production runs, so OPAQUE matches.
FROM docker.io/lldap/lldap@sha256:9e605a66c02514bfcffd1b67cafb1e98d50992216bb2871d7ae44622047dd09d AS lldap
FROM python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9
RUN useradd --create-home --uid 10001 executor
WORKDIR /app
COPY --from=lldap /app/lldap_set_password /app/lldap_set_password
COPY bounded-executor/requirements.txt /app/bounded-executor/requirements.txt
RUN python -m pip install --no-cache-dir --require-hashes -r /app/bounded-executor/requirements.txt
# The executed files keep their repository paths: admissions pin them by path and sha256.
COPY canon/schemas/bounded-execution-admission_v0.1.schema.json /app/canon/schemas/
COPY tools/bounded-execution-admission/validate.py /app/tools/bounded-execution-admission/
COPY sso-mfa/k8s/synthetic-journey/journey.py /app/sso-mfa/k8s/synthetic-journey/
COPY bounded-executor/executor.py bounded-executor/operations.py bounded-executor/clients.py bounded-executor/cli.py /app/bounded-executor/
USER 10001:10001
ENV PYTHONDONTWRITEBYTECODE=1
ENTRYPOINT ["python", "/app/bounded-executor/cli.py"]
