1# opencode (1.18.23) + a small control gateway, driving DeepSeek V4.1 Flash on OpenRouter.2# Adapted from an earlier opencode sandbox Dockerfile. No GPU; builds the same on3# aarch64 and x86_64. At run time m64 puts the container on an internal network whose4# only egress is its gate (HTTP(S)_PROXY), allowing openrouter.ai:443; the gate adds the5# OpenRouter key to plain http://openrouter.ai requests, so the key never enters the container.6#7# Base: node:22-bookworm-slim (Node 22.23.2), pinned by its multi-arch index digest.8FROM node@sha256:48e4b67d85f87bd551df43704e24d252f56cc5f8e9718841aace50f19948f0f9910RUN apt-get update -qq && apt-get install -y --no-install-recommends \11      ca-certificates git ripgrep jq curl python3 python3-venv python3-pip \12      build-essential procps less file unzip \13    && rm -rf /var/lib/apt/lists/*1415RUN npm install -g opencode-ai@1.18.23 && npm cache clean --force1617# Gateway deps: fastapi 0.115 / uvicorn 0.32 / httpx 0.28, resolved once in this image18# (Python 3.11) and pinned with every transitive dependency.19RUN python3 -m venv /opt/gateway && /opt/gateway/bin/pip install --no-cache-dir \20      fastapi==0.115.14 uvicorn==0.32.1 httpx==0.28.1 \21      starlette==0.46.2 pydantic==2.14.1 pydantic_core==2.50.1 annotated-types==0.8.0 \22      typing_extensions==4.16.0 typing-inspection==0.4.4 anyio==4.15.1 idna==3.20 \23      certifi==2026.10.23 httpcore==1.0.9 h11==0.16.0 click==8.5.02425# Everything opencode would otherwise fetch at run time (models.dev catalogue, LSP servers,26# self-update) is disabled. The npm packages it installs on a project's first use are27# warmed here, where the build has network (warm_opencode.sh); start.sh copies them into28# the throwaway HOME. Without this, every run would log a blocked registry.npmjs.org.29ENV OPENCODE_DISABLE_AUTOUPDATE=1 \30    OPENCODE_DISABLE_LSP_DOWNLOAD=1 \31    OPENCODE_DISABLE_MODELS_FETCH=1 \32    OPENCODE_DISABLE_SHARE=133COPY opencode.json /etc/opencode/opencode.json34COPY warm_opencode.sh /tmp/warm_opencode.sh35RUN bash /tmp/warm_opencode.sh && rm /tmp/warm_opencode.sh3637USER node38WORKDIR /scratch