# opencode (1.18.23) in tmux, served as a web terminal by ttyd, driving DeepSeek V4.1 Flash
# on OpenRouter. Same opencode setup as opencode-dsflash-openrouter-gb10. aarch64 only (the
# ttyd binary below). At run time m64 puts the container on an internal network whose
# only egress is its gate (HTTP(S)_PROXY), allowing openrouter.ai:443; the gate adds the
# OpenRouter key to plain http://openrouter.ai requests, so the key never enters the container.
#
# Base: node:22-bookworm-slim (Node 22.23.2), pinned by its multi-arch index digest.
FROM node@sha256:48e4b67d85f87bd551df43704e24d252f56cc5f8e9718841aace50f19948f0f9

# tmux pinned to the bookworm version (3.3a-3). The image's ncurses-base has tmux-256color.
RUN apt-get update -qq && apt-get install -y --no-install-recommends \
      ca-certificates git ripgrep jq curl python3 python3-venv python3-pip \
      build-essential procps less file unzip tmux=3.3a-3 \
    && rm -rf /var/lib/apt/lists/*

# ttyd 1.7.7: the official static aarch64 release binary, checked against the sha256 in
# the release's SHA256SUMS (https://github.com/tsl0922/ttyd/releases/tag/1.7.7).
RUN curl -fsSL -o /usr/local/bin/ttyd \
      https://github.com/tsl0922/ttyd/releases/download/1.7.7/ttyd.aarch64 \
    && echo "b38acadd89d1d396a0f5649aa52c539edbad07f4bc7348b27b4f4b7219dd4165  /usr/local/bin/ttyd" | sha256sum -c - \
    && chmod 0755 /usr/local/bin/ttyd

RUN npm install -g opencode-ai@1.18.23 && npm cache clean --force

# Everything opencode would otherwise fetch at run time (models.dev catalogue, LSP servers,
# self-update) is disabled. The npm packages it installs on a project's first use are
# warmed here, where the build has network (warm_opencode.sh); start.sh copies them into
# the throwaway HOME.
ENV OPENCODE_DISABLE_AUTOUPDATE=1 \
    OPENCODE_DISABLE_LSP_DOWNLOAD=1 \
    OPENCODE_DISABLE_MODELS_FETCH=1 \
    OPENCODE_DISABLE_SHARE=1
COPY opencode.json /etc/opencode/opencode.json
COPY warm_opencode.sh /tmp/warm_opencode.sh
RUN bash /tmp/warm_opencode.sh && rm /tmp/warm_opencode.sh

USER node
WORKDIR /scratch