1# opencode-inside image: opencode 1.18.23 + a small control gateway.2#3# m64 builds this file the first time the capsule is served (no network at run4# time, so everything is installed here, at build time, where there is network).5# `m64 check` refuses anything unpinned: FROM by digest, npm and pip by version.6# No GPU; it builds the same on aarch64 and x86_64. At run time the container's only7# way out is m64's gate (HTTP(S)_PROXY), which allows openrouter.ai:443 and adds the8# OpenRouter key to plain http://openrouter.ai requests.9#10# Base: node:22-bookworm-slim (Node 22.23.2), pinned by its multi-arch index digest.11FROM node@sha256:48e4b67d85f87bd551df43704e24d252f56cc5f8e9718841aace50f19948f0f91213RUN apt-get update -qq && apt-get install -y --no-install-recommends \14      ca-certificates git ripgrep jq curl python3 python3-venv python3-pip \15      build-essential procps less file unzip \16    && rm -rf /var/lib/apt/lists/*1718RUN npm install -g opencode-ai@1.18.23 && npm cache clean --force1920# Gateway deps: fastapi 0.115 / uvicorn 0.32 / httpx 0.28, resolved once in this image21# (Python 3.11) and pinned with every transitive dependency.22RUN python3 -m venv /opt/gateway && /opt/gateway/bin/pip install --no-cache-dir \23      fastapi==0.115.14 uvicorn==0.32.1 httpx==0.28.1 \24      starlette==0.46.2 pydantic==2.14.1 pydantic_core==2.50.1 annotated-types==0.8.0 \25      typing_extensions==4.16.0 typing-inspection==0.4.4 anyio==4.15.1 idna==3.20 \26      certifi==2026.10.23 httpcore==1.0.9 h11==0.16.0 click==8.5.02728# Everything opencode would otherwise fetch at run time (models.dev catalogue, LSP servers,29# self-update) is disabled. The npm packages it installs on a project's first use are30# warmed here, where the build has network (warm_opencode.sh); start.sh copies them into31# the throwaway HOME. Without this, every run would log a blocked registry.npmjs.org.32ENV OPENCODE_DISABLE_AUTOUPDATE=1 \33    OPENCODE_DISABLE_LSP_DOWNLOAD=1 \34    OPENCODE_DISABLE_MODELS_FETCH=1 \35    OPENCODE_DISABLE_SHARE=136COPY opencode.json /etc/opencode/opencode.json37COPY warm_opencode.sh /tmp/warm_opencode.sh38RUN bash /tmp/warm_opencode.sh && rm /tmp/warm_opencode.sh3940USER node41WORKDIR /scratch