FROM artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44

SHELL ["/bin/bash", "-o", "pipefail", "-c"]

# Internal CA over plain HTTP, pinned by the repodata pkgid; HTTPS after this.
ARG CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f44/Packages/unkin-ca-certificates-2026.10.2-1.fc44.x86_64.rpm"
ARG CA_RPM_SHA256="19929d13dd7a0542af3bf1dce736568b87159914b0261d7a9965edfd58dfc9cd"
# hadolint ignore=DL3041
RUN curl -fsSLo /tmp/ca.rpm "$CA_RPM_URL" \
    && echo "$CA_RPM_SHA256  /tmp/ca.rpm" | sha256sum -c - \
    && dnf install -y /tmp/ca.rpm \
    && rm /tmp/ca.rpm \
    && dnf clean all

# hadolint ignore=DL3041
RUN printf '%s\n' '[claude-code]' 'name=claude-code' \
        'baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/claude-code/' \
        'gpgcheck=0' >/etc/yum.repos.d/claude-code.repo \
    && dnf install -y --setopt=install_weak_deps=False \
        bind-utils claude-code curl fuse-overlayfs git-core iproute jq less \
        openssh-clients passt podman procps-ng \
    && dnf clean all

# No setuid binaries; nested rootless podman needs only newuidmap's file caps
# (lost in image layers) and subordinate ids inside keep-id's namespace.
RUN find / -xdev -type f -perm /6000 -exec chmod ug-s {} + \
    && rpm --setcaps shadow-utils \
    && useradd -u 1000 -m claude \
    && echo 'claude:1:999' >/etc/subuid \
    && echo 'claude:1001:64535' >>/etc/subuid \
    && cp /etc/subuid /etc/subgid

COPY containers.conf /etc/containers/containers.conf

USER 1000
WORKDIR /home/claude
CMD ["claude"]