# Supply a reviewed Debian 13 Node 24 image pinned by sha256; no mutable default.
ARG ENGINE_NODE_IMAGE
FROM ${ENGINE_NODE_IMAGE}
ARG ENGINE_NODE_IMAGE
RUN node -e "const fs=require('node:fs'); if(!/@sha256:[a-f0-9]{64}$/.test(process.argv[1])||process.versions.node.split('.')[0]!=='24'||!/^VERSION_ID=\"?13\"?$/m.test(fs.readFileSync('/etc/os-release','utf8'))) process.exit(1)" "$ENGINE_NODE_IMAGE"
WORKDIR /opt/aiws
COPY engine/src ./engine/src
COPY engine/web ./engine/web
COPY spec/engine-v1/wire.schema.json spec/engine-v1/dynamic-controls.schema.json spec/engine-v1/readiness.schema.json ./spec/engine-v1/
RUN mkdir -p /var/lib/aiws /etc/aiws && chown 10001:10001 /var/lib/aiws && chmod 700 /var/lib/aiws
USER 10001:10001
ENTRYPOINT ["node", "engine/src/deployment-host.ts"]
CMD ["/etc/aiws/host.mjs"]
