# Web Applications workspace image: Rust (Tauri 2 / gRPC), Bun + Node/pnpm,
# Python + CV/ONNX prototyping, and DB CLI clients baked in at build time so
# workspace start doesn't pay for a from-scratch toolchain install.
#
# Built by templates/web/main.tf via the docker provider's `build` block
# (context = this directory), not pulled from a registry.
FROM ubuntu:24.04

ARG DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y --no-install-recommends \
        locales sudo ca-certificates gnupg curl wget \
    && locale-gen en_US.UTF-8 \
    && rm -rf /var/lib/apt/lists/*

ENV LANG=en_US.UTF-8 \
    LANGUAGE=en_US:en \
    LC_ALL=en_US.UTF-8

# Google Chrome (stable), for the Browse Lite VS Code extension's embedded
# browser preview. Ubuntu's own `chromium-browser` apt package is just a
# snap wrapper and doesn't work in a container (no snapd) - Google's own
# .deb is the reliable way to get a real Chrome binary here. amd64 only
# (Google doesn't publish a Chrome .deb for arm64), which matches this
# repo's single x86_64 Docker host.
RUN curl -fsSL https://dl.google.com/linux/linux_signing_key.pub \
        | gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg \
    && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" \
        > /etc/apt/sources.list.d/google-chrome.list \
    && apt-get update && apt-get install -y google-chrome-stable \
    && rm -rf /var/lib/apt/lists/*

# Core build toolchain, crypto/DB headers, Tauri 2 / WebKit GUI prerequisites,
# X11 dev libs, DB CLI clients, Python + OpenCV, protobuf compiler.
RUN apt-get update && apt-get install -y --no-install-recommends \
        build-essential pkg-config cmake clang llvm \
        git git-lfs jq unzip tar file htop tree tmux zsh openssh-client \
        libssl-dev libpq-dev libsqlite3-dev \
        libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev libxdo-dev \
        libgtk-3-dev libsoup-3.0-dev \
        libx11-dev libxext-dev libxrender-dev libxtst-dev libxi-dev \
        postgresql-client redis-tools sqlite3 \
        python3 python3-pip python3-venv python3-dev \
        libopencv-dev \
        protobuf-compiler \
    && git lfs install --system \
    && rm -rf /var/lib/apt/lists/*

# Node.js LTS (22.x) plus npm/pnpm/yarn as root so global bins land on the
# system PATH for every user.
RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
    && apt-get install -y --no-install-recommends nodejs \
    && npm install -g pnpm yarn \
    && rm -rf /var/lib/apt/lists/*

# Global Python prototyping packages: CV, ONNX runtime, CPU-only torch wheel.
# Ubuntu 24.04's system Python is PEP 668 externally-managed; this is a
# throwaway container image, so --break-system-packages is the right call
# instead of forcing every user into a venv for basic prototyping. Not
# upgrading pip itself first: the Debian-packaged pip 24.0 has no RECORD
# file (dpkg-installed, not pip-installed), so `pip install --upgrade pip`
# fails trying to uninstall it in place - and it's unneeded anyway, the
# packages below install fine under the stock version.
RUN python3 -m pip install --break-system-packages --no-cache-dir \
        numpy opencv-python-headless onnxruntime \
    && python3 -m pip install --break-system-packages --no-cache-dir \
        torch --index-url https://download.pytorch.org/whl/cpu

# Standard non-root dev user with passwordless sudo. Ubuntu 24.04's base
# image already ships a default `ubuntu` user/group at uid/gid 1000, which
# collides with the explicit --uid 1000 below - drop it first so `coder`
# can take that uid.
RUN userdel -r ubuntu 2>/dev/null; \
    groupdel ubuntu 2>/dev/null; \
    useradd --uid 1000 --create-home --shell /bin/bash coder \
    && echo "coder ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/coder \
    && chmod 0440 /etc/sudoers.d/coder

ENV RUST_BACKTRACE=1 \
    RUSTUP_HOME=/home/coder/.rustup \
    CARGO_HOME=/home/coder/.cargo \
    BUN_INSTALL=/home/coder/.bun \
    PNPM_HOME=/home/coder/.local/share/pnpm \
    PATH=/home/coder/.cargo/bin:/home/coder/.bun/bin:/home/coder/.local/share/pnpm:/home/coder/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

USER coder
WORKDIR /home/coder

# Rust via rustup: stable toolchain, rust-analyzer/clippy/rustfmt/rust-src,
# native + musl targets for x86_64/aarch64, and cargo helper utilities.
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y \
        --default-toolchain stable --profile default \
    && rustup component add rustfmt clippy rust-analyzer rust-src \
    && rustup target add \
        x86_64-unknown-linux-gnu \
        x86_64-unknown-linux-musl \
        aarch64-unknown-linux-gnu \
        aarch64-unknown-linux-musl \
    && cargo install --locked cargo-watch cargo-edit cross bacon

# Bun: global runtime for the ElysiaJS backend and fast scripting.
RUN curl -fsSL https://bun.sh/install | bash

RUN mkdir -p /home/coder/workspace
WORKDIR /home/coder/workspace