agent.Dockerfile

FROM node:24

ARG CLAUDE_CODE_VERSION=stable

# Install development tools, iptables for firewall, and .NET dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    git \
    curl \
    sudo \
    iptables \
    iproute2 \
    jq \
    gh \
    vim \
    less \
    procps \
    ca-certificates \
    unzip \
    openssh-client \
    zip \
    python3 \
    make \
    ripgrep \
    libicu-dev \
    libssl-dev \
    zlib1g \
    && apt-get clean && rm -rf /var/lib/apt/lists/*

# Install PowerShell (tarball method — works on both amd64 and arm64)
ARG POWERSHELL_VERSION=7.4.7
RUN ARCH=$(uname -m) && \
    if [ "$ARCH" = "x86_64" ]; then PS_ARCH="x64"; elif [ "$ARCH" = "aarch64" ]; then PS_ARCH="arm64"; else echo "Unsupported arch: $ARCH" && exit 1; fi && \
    curl -fsSL "https://github.com/PowerShell/PowerShell/releases/download/v${POWERSHELL_VERSION}/powershell-${POWERSHELL_VERSION}-linux-${PS_ARCH}.tar.gz" -o /tmp/powershell.tar.gz && \
    mkdir -p /opt/microsoft/powershell/7 && \
    tar -xzf /tmp/powershell.tar.gz -C /opt/microsoft/powershell/7 && \
    chmod +x /opt/microsoft/powershell/7/pwsh && \
    ln -s /opt/microsoft/powershell/7/pwsh /usr/local/bin/pwsh && \
    rm /tmp/powershell.tar.gz

# Install .NET 8 and .NET 10 SDKs
ENV DOTNET_ROOT=/usr/share/dotnet
RUN curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh && \
    chmod +x /tmp/dotnet-install.sh && \
    /tmp/dotnet-install.sh --channel 8.0 --install-dir "$DOTNET_ROOT" && \
    /tmp/dotnet-install.sh --channel 10.0 --install-dir "$DOTNET_ROOT" && \
    rm /tmp/dotnet-install.sh && \
    ln -s "$DOTNET_ROOT/dotnet" /usr/local/bin/dotnet
ENV DOTNET_CLI_TELEMETRY_OPTOUT=1
ENV DOTNET_NOLOGO=1

# Install AWS CLI v2 (needed for Bedrock authentication)
RUN ARCH=$(uname -m) && \
    curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-${ARCH}.zip" -o /tmp/awscliv2.zip && \
    unzip -q /tmp/awscliv2.zip -d /tmp && \
    /tmp/aws/install && \
    rm -rf /tmp/aws /tmp/awscliv2.zip

# Create workspace and config directories
RUN mkdir -p /workspace /home/node/.claude /home/node/.local/bin && \
    chown -R node:node /workspace /home/node/.claude /home/node/.local

WORKDIR /workspace

# Install Claude Code and .NET tools (as node user)
USER node
ENV PATH="/home/node/.local/bin:/home/node/.dotnet/tools:$PATH"
RUN curl -fsSL https://claude.ai/install.sh | bash -s -- ${CLAUDE_CODE_VERSION}
RUN dotnet tool install -g dotnet-ef

# Copy firewall and entrypoint scripts (needs root)
USER root
COPY init-firewall.sh /usr/local/bin/
COPY entrypoint.sh /usr/local/bin/
RUN chmod 0555 /usr/local/bin/init-firewall.sh && \
    chown root:root /usr/local/bin/init-firewall.sh && \
    chmod +x /usr/local/bin/entrypoint.sh && \
    echo "node ALL=(root) NOPASSWD: /usr/local/bin/init-firewall.sh" > /etc/sudoers.d/node-firewall && \
    chmod 0440 /etc/sudoers.d/node-firewall

USER node

ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
CMD ["claude"]