1# opencode (1.18.23) in tmux, served as a web terminal by ttyd, driving DeepSeek V4.1 Flash2# on OpenRouter. Same opencode setup as opencode-dsflash-openrouter-gb10. aarch64 only (the3# ttyd binary below). At run time m64 puts the container on an internal network whose4# only egress is its gate (HTTP(S)_PROXY), allowing openrouter.ai:443; the gate adds the5# OpenRouter key to plain http://openrouter.ai requests, so the key never enters the container.6#7# Base: node:22-bookworm-slim (Node 22.23.2), pinned by its multi-arch index digest.8FROM node@sha256:48e4b67d85f87bd551df43704e24d252f56cc5f8e9718841aace50f19948f0f9910# tmux pinned to the bookworm version (3.3a-3). The image's ncurses-base has tmux-256color.11RUN apt-get update -qq && apt-get install -y --no-install-recommends \12      ca-certificates git ripgrep jq curl python3 python3-venv python3-pip \13      build-essential procps less file unzip tmux=3.3a-3 \14    && rm -rf /var/lib/apt/lists/*1516# ttyd 1.7.7: the official static aarch64 release binary, checked against the sha256 in17# the release's SHA256SUMS (https://github.com/tsl0922/ttyd/releases/tag/1.7.7).18RUN curl -fsSL -o /usr/local/bin/ttyd \19      https://github.com/tsl0922/ttyd/releases/download/1.7.7/ttyd.aarch64 \20    && echo "b38acadd89d1d396a0f5649aa52c539edbad07f4bc7348b27b4f4b7219dd4165  /usr/local/bin/ttyd" | sha256sum -c - \21    && chmod 0755 /usr/local/bin/ttyd2223RUN npm install -g opencode-ai@1.18.23 && npm cache clean --force2425# Everything opencode would otherwise fetch at run time (models.dev catalogue, LSP servers,26# self-update) is disabled. The npm packages it installs on a project's first use are27# warmed here, where the build has network (warm_opencode.sh); start.sh copies them into28# the throwaway HOME.29ENV OPENCODE_DISABLE_AUTOUPDATE=1 \30    OPENCODE_DISABLE_LSP_DOWNLOAD=1 \31    OPENCODE_DISABLE_MODELS_FETCH=1 \32    OPENCODE_DISABLE_SHARE=133COPY opencode.json /etc/opencode/opencode.json34COPY warm_opencode.sh /tmp/warm_opencode.sh35RUN bash /tmp/warm_opencode.sh && rm /tmp/warm_opencode.sh3637USER node38WORKDIR /scratch