Dockerfile.package

# Dockerfile.package — Lightweight agent packaging (no Rust compilation).
# Expects pre-built binaries at build context paths:
#   ./bin/openab          (required for all targets)
#   ./bin/openab-agent    (required for native target)
#   ./bin/agy-acp         (required for antigravity target)
#
# Usage: docker build --target <agent> -f Dockerfile.package --build-context bins=./bin .

# =============================================================================
# Stage: bins — pre-built binaries passed in via build context
# =============================================================================
FROM scratch AS bins
COPY openab openab-agent* agy-acp* /

# =============================================================================
# Stage: base-debian — shared runtime base for debian-based agents
# =============================================================================
FROM debian:trixie-slim AS base-debian
RUN apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates curl procps ripgrep tini git unzip \
    && rm -rf /var/lib/apt/lists/*
RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
      -o /usr/share/keyrings/githubcli-archive-keyring.gpg && \
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
      > /etc/apt/sources.list.d/github-cli.list && \
    apt-get update && apt-get install -y --no-install-recommends gh && \
    rm -rf /var/lib/apt/lists/*
RUN useradd -m -s /bin/bash -u 1000 agent

# =============================================================================
# Stage: base-node — shared runtime base for node-based agents
# =============================================================================
FROM node:22-trixie-slim AS base-node
RUN apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates curl procps ripgrep tini bubblewrap socat unzip git \
    && rm -rf /var/lib/apt/lists/*
RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
      -o /usr/share/keyrings/githubcli-archive-keyring.gpg && \
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
      > /etc/apt/sources.list.d/github-cli.list && \
    apt-get update && apt-get install -y --no-install-recommends gh && \
    rm -rf /var/lib/apt/lists/*

# =============================================================================
# Target: kiro (default)
# =============================================================================
FROM base-debian AS kiro
ARG KIRO_CLI_VERSION=2.25.0
# Optional immutable content identifiers for the nightly `latest` path. Release
# and pre-beta builds leave these empty and retain their pinned SHA256 checks.
ARG KIRO_ETAG_AMD64=
ARG KIRO_ETAG_ARM64=
ARG KIRO_SHA256_AMD64=3e924de9697717b99891bb5f7d2a4bd9c768b8bfa1c498b35b3d242948512984
ARG KIRO_SHA256_ARM64=cc8a2df90cd354b569b81ed4653db4796c86a69866568b4eb7fa7906afc95309
RUN ARCH=$(dpkg --print-architecture) && \
    if [ "$ARCH" = "arm64" ]; then \
      URL="https://prod.download.cli.kiro.dev/stable/${KIRO_CLI_VERSION}/kirocli-aarch64-linux.zip"; \
      ETAG="$KIRO_ETAG_ARM64"; \
      SHA256="$KIRO_SHA256_ARM64"; \
    else \
      URL="https://prod.download.cli.kiro.dev/stable/${KIRO_CLI_VERSION}/kirocli-x86_64-linux.zip"; \
      ETAG="$KIRO_ETAG_AMD64"; \
      SHA256="$KIRO_SHA256_AMD64"; \
    fi && \
    if [ -n "$ETAG" ]; then \
      curl --proto '=https' --tlsv1.2 -sSf --retry 3 --retry-delay 5 \
        -H "If-Match: \"$ETAG\"" "$URL" -o /tmp/kirocli.zip; \
    else \
      curl --proto '=https' --tlsv1.2 -sSf --retry 3 --retry-delay 5 \
        "$URL" -o /tmp/kirocli.zip; \
    fi && \
    if [ -n "$SHA256" ]; then \
      echo "$SHA256  /tmp/kirocli.zip" | sha256sum -c -; \
    elif [ -z "$ETAG" ]; then \
      echo "Kiro download requires SHA256 or a strong ETag" >&2; exit 1; \
    fi && \
    unzip /tmp/kirocli.zip -d /tmp && \
    cp /tmp/kirocli/bin/* /usr/local/bin/ && \
    chmod +x /usr/local/bin/kiro-cli* && \
    rm -rf /tmp/kirocli /tmp/kirocli.zip
RUN mkdir -p /home/agent/.local/share/kiro-cli /home/agent/.kiro && \
    chown -R agent:agent /home/agent
ENV HOME=/home/agent
WORKDIR /home/agent
COPY --from=bins --chown=agent:agent /openab /usr/local/bin/openab
USER agent
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="kiro-cli acp --trust-all-tools"
ENV OPENAB_AGENT_AUTH_COMMAND="kiro-cli login --use-device-flow"
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

# =============================================================================
# Target: claude
# =============================================================================
FROM base-node AS claude
ARG CLAUDE_AGENT_ACP_VERSION=0.84.0
ARG CLAUDE_CODE_VERSION=2.1.284
RUN npm install -g @agentclientprotocol/claude-agent-acp@${CLAUDE_AGENT_ACP_VERSION} @anthropic-ai/claude-code@${CLAUDE_CODE_VERSION} --retry 3
ENV CLAUDE_CODE_EXECUTABLE=/usr/local/bin/claude
ENV HOME=/home/node
WORKDIR /home/node
COPY --from=bins --chown=node:node /openab /usr/local/bin/openab
RUN mkdir -p /home/node/.claude && chown -R node:node /home/node
USER node
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="claude-agent-acp"
ENV OPENAB_AGENT_AUTH_COMMAND="claude auth login"
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

# =============================================================================
# Target: codex
# =============================================================================
FROM base-node AS codex
ARG CODEX_ACP_VERSION=2.0.0
ARG CODEX_VERSION=0.159.0
RUN npm install -g @agentclientprotocol/codex-acp@${CODEX_ACP_VERSION} @openai/codex@${CODEX_VERSION} --fetch-retries=3
ENV HOME=/home/node
WORKDIR /home/node
COPY --from=bins --chown=node:node /openab /usr/local/bin/openab
RUN mkdir -p /home/node/.codex && chown -R node:node /home/node
USER node
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="codex-acp"
ENV OPENAB_AGENT_AUTH_COMMAND="codex login --device-auth"
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

# =============================================================================
# Target: kimi
# =============================================================================
FROM node:24-trixie-slim AS kimi
RUN apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates curl procps ripgrep tini bubblewrap socat unzip git \
    && rm -rf /var/lib/apt/lists/*
RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
      -o /usr/share/keyrings/githubcli-archive-keyring.gpg && \
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
      > /etc/apt/sources.list.d/github-cli.list && \
    apt-get update && apt-get install -y --no-install-recommends gh && \
    rm -rf /var/lib/apt/lists/*
ARG KIMI_CODE_VERSION=2.1.1
RUN npm install -g @moonshot-ai/kimi-code@${KIMI_CODE_VERSION} --retry 3
ENV HOME=/home/node
WORKDIR /home/node
COPY --from=bins --chown=node:node /openab /usr/local/bin/openab
RUN mkdir -p /home/node/.kimi-code && chown -R node:node /home/node
USER node
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="kimi acp"
ENV OPENAB_AGENT_AUTH_COMMAND="kimi"
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

# =============================================================================
# Target: copilot
# =============================================================================
FROM base-node AS copilot
ARG COPILOT_VERSION=1.0.89
RUN npm install -g @github/copilot@${COPILOT_VERSION} --retry 3
ENV HOME=/home/node
WORKDIR /home/node
COPY --from=bins --chown=node:node /openab /usr/local/bin/openab
RUN mkdir -p /home/node/.copilot && chown -R node:node /home/node
USER node
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="copilot --acp --stdio"
ENV OPENAB_AGENT_AUTH_COMMAND="copilot login"
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

# =============================================================================
# Target: cursor
# =============================================================================
FROM base-debian AS cursor
ARG CURSOR_VERSION=2026.09.28-64d2043
RUN ARCH=$(dpkg --print-architecture) && \
    if [ "$ARCH" = "arm64" ]; then ARCH=arm64; else ARCH=x64; fi && \
    curl -fSL "https://downloads.cursor.com/lab/${CURSOR_VERSION}/linux/${ARCH}/agent-cli-package.tar.gz" \
      -o /tmp/cursor.tar.gz && \
    tar xzf /tmp/cursor.tar.gz -C /opt && \
    mv /opt/dist-package /opt/cursor-agent && \
    ln -s /opt/cursor-agent/cursor-agent /usr/local/bin/cursor-agent && \
    rm /tmp/cursor.tar.gz
ENV HOME=/home/agent
WORKDIR /home/agent
COPY --from=bins --chown=agent:agent /openab /usr/local/bin/openab
RUN mkdir -p /home/agent/.cursor && chown -R agent:agent /home/agent
USER agent
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="cursor-agent acp"
ENV OPENAB_AGENT_AUTH_COMMAND="cursor-agent login"
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

# =============================================================================
# Target: gemini
# =============================================================================
FROM base-node AS gemini
ARG GEMINI_CLI_VERSION=0.61.0
RUN npm install -g @google/gemini-cli@${GEMINI_CLI_VERSION} --retry 3
ENV HOME=/home/node
WORKDIR /home/node
COPY --from=bins --chown=node:node /openab /usr/local/bin/openab
RUN mkdir -p /home/node/.gemini && chown -R node:node /home/node
USER node
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="gemini --acp"
ENV OPENAB_AGENT_AUTH_COMMAND="gemini auth"
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

# =============================================================================
# Target: grok
# =============================================================================
FROM base-debian AS grok
ARG GROK_VERSION=1.0.44
ARG GROK_SHA256_AMD64=f76431873efc5c8a50892d1e1247eaee23f6664bca385fbd55a06a8e7d3caedc
ARG GROK_SHA256_ARM64=a31506d73b4454bbf70c3c2821e41a042fa7838058ba1b271b009a926d175239
# Explicit opt-in for the nightly TLS-only path. Empty SHA values fail closed
# for every other caller, including release and pre-beta builds.
ARG ALLOW_UNVERIFIED_NIGHTLY_DOWNLOADS=false
ARG TARGETPLATFORM
RUN set -eux; \
    case "${TARGETPLATFORM:-linux/amd64}" in \
      "linux/amd64") arch=x86_64; sha="${GROK_SHA256_AMD64}" ;; \
      "linux/arm64") arch=aarch64; sha="${GROK_SHA256_ARM64}" ;; \
      *) echo "Unsupported platform: ${TARGETPLATFORM}" >&2; exit 1 ;; \
    esac; \
    curl -fsSL "https://storage.googleapis.com/grok-build-public-artifacts/cli/grok-${GROK_VERSION}-linux-${arch}" \
      -o /tmp/grok && \
    if [ -n "$sha" ]; then \
      echo "${sha}  /tmp/grok" | sha256sum -c -; \
    elif [ "$ALLOW_UNVERIFIED_NIGHTLY_DOWNLOADS" != "true" ]; then \
      echo "Grok download requires SHA256 unless the nightly-only opt-in is true" >&2; exit 1; \
    fi && \
    install -m 0755 /tmp/grok /usr/local/bin/grok && \
    rm /tmp/grok
ENV HOME=/home/agent
WORKDIR /home/agent
COPY --from=bins --chown=agent:agent /openab /usr/local/bin/openab
RUN mkdir -p /home/agent/.grok && chown -R agent:agent /home/agent
USER agent
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="grok agent stdio"
ENV OPENAB_AGENT_AUTH_COMMAND="grok login --device-auth"
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

# =============================================================================
# Target: mimocode
# =============================================================================
FROM base-node AS mimocode
ARG MIMOCODE_VERSION=0.1.15
RUN npm install -g @mimo-ai/cli@${MIMOCODE_VERSION} --retry 3
ENV HOME=/home/node
WORKDIR /home/node
COPY --from=bins --chown=node:node /openab /usr/local/bin/openab
RUN mkdir -p /home/node/.mimo && chown -R node:node /home/node
USER node
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="mimo acp"
ENV OPENAB_AGENT_AUTH_COMMAND="mimo auth login --provider mimo --method \"MiMo Auto (free)\""
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

# =============================================================================
# Target: opencode
# =============================================================================
FROM base-node AS opencode
ARG OPENCODE_VERSION=1.18.33
RUN npm install -g opencode-ai@${OPENCODE_VERSION} --retry 3
ENV HOME=/home/node
WORKDIR /home/node
COPY --from=bins --chown=node:node /openab /usr/local/bin/openab
RUN mkdir -p /home/node/.opencode && chown -R node:node /home/node
USER node
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="opencode acp"
ENV OPENAB_AGENT_AUTH_COMMAND="opencode auth login"
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

# =============================================================================
# Target: devin
# =============================================================================
FROM base-debian AS devin
ARG DEVIN_VERSION=3000.11.3
ARG DEVIN_SHA256_AMD64=83b3b113c01bf2a3e9e100db08d77e6b086806a7754f091e20831bdfe215157e
ARG DEVIN_SHA256_ARM64=21a2d7a8dea67987067cde7eb3fe7193a48daa8f8c3d50d414c603c4a2b67f15
ARG TARGETPLATFORM
RUN set -eux; \
    case "${TARGETPLATFORM:-linux/amd64}" in \
      "linux/amd64") arch=x86_64-unknown-linux; sha="${DEVIN_SHA256_AMD64}" ;; \
      "linux/arm64") arch=aarch64-unknown-linux; sha="${DEVIN_SHA256_ARM64}" ;; \
      *) echo "Unsupported platform: ${TARGETPLATFORM}" >&2; exit 1 ;; \
    esac; \
    curl -fsSL "https://static.devin.ai/cli/${DEVIN_VERSION}/devin-${DEVIN_VERSION}-${arch}.tar.gz" \
      -o /tmp/devin.tar.gz && \
    echo "${sha}  /tmp/devin.tar.gz" | sha256sum -c - && \
    tar xzf /tmp/devin.tar.gz -C /tmp && \
    install -m 0755 /tmp/bin/devin /usr/local/bin/devin && \
    rm -rf /tmp/devin* /tmp/bin /tmp/share
ENV HOME=/home/agent
WORKDIR /home/agent
COPY --from=bins --chown=agent:agent /openab /usr/local/bin/openab
RUN chown -R agent:agent /home/agent
USER agent
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="devin acp"
ENV OPENAB_AGENT_AUTH_COMMAND="devin auth login --force-manual-token-flow"
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

# =============================================================================
# Target: antigravity
# =============================================================================
FROM base-debian AS antigravity
# One overridable pin drives the download and all persisted image metadata.
ARG AGY_VERSION=1.2.13
ENV AGY_VERSION="${AGY_VERSION}"
LABEL dev.openab.agy.version="${AGY_VERSION}"
ARG AGY_SHA256_AMD64=b0f195d37973be7b08c3b705d7fbbcd948dacb4a3c2176ee52ca29f7159bdc21
ARG AGY_SHA256_ARM64=43bf59be5895475f8a32d4f94f1241f665986ea41a3622579e03b74e1b63dcfb
# Explicit opt-in for the nightly TLS-only path. Empty SHA values fail closed
# for every other caller, including release and pre-beta builds.
ARG ALLOW_UNVERIFIED_NIGHTLY_DOWNLOADS=false
RUN ARCH=$(dpkg --print-architecture) && \
    case "$ARCH" in \
      amd64) ASSET="agy_cli_linux_x64.tar.gz"; sha="${AGY_SHA256_AMD64}" ;; \
      arm64) ASSET="agy_cli_linux_arm64.tar.gz"; sha="${AGY_SHA256_ARM64}" ;; \
      *) echo "unsupported arch: $ARCH" && exit 1 ;; \
    esac && \
    curl -fsSL "https://github.com/google-antigravity/antigravity-cli/releases/download/${AGY_VERSION}/${ASSET}" \
      -o /tmp/agy.tar.gz && \
    if [ -n "$sha" ]; then \
      echo "${sha}  /tmp/agy.tar.gz" | sha256sum -c -; \
    elif [ "$ALLOW_UNVERIFIED_NIGHTLY_DOWNLOADS" != "true" ]; then \
      echo "Antigravity download requires SHA256 unless the nightly-only opt-in is true" >&2; exit 1; \
    fi && \
    tar -xzf /tmp/agy.tar.gz -C /usr/local/bin && \
    rm /tmp/agy.tar.gz && \
    mv /usr/local/bin/antigravity /usr/local/bin/agy && \
    chmod +x /usr/local/bin/agy
ENV HOME=/home/agent
WORKDIR /home/agent
COPY --from=bins --chown=agent:agent /openab /usr/local/bin/openab
COPY --from=bins --chown=agent:agent /agy-acp /usr/local/bin/agy-acp
RUN mkdir -p /home/agent/.agy && chown -R agent:agent /home/agent
USER agent
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="agy-acp"
ENV OPENAB_AGENT_AUTH_COMMAND="agy auth"
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

# =============================================================================
# Target: pi
# =============================================================================
FROM base-node AS pi
ARG PI_ACP_VERSION=0.0.31
ARG PI_CODING_AGENT_VERSION=0.79.9
RUN npm install -g pi-acp@${PI_ACP_VERSION} @earendil-works/pi-coding-agent@${PI_CODING_AGENT_VERSION} --retry 3
ENV HOME=/home/node
WORKDIR /home/node
COPY --from=bins --chown=node:node /openab /usr/local/bin/openab
RUN mkdir -p /home/node/.pi && chown -R node:node /home/node
USER node
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="openab-agent"
ENV OPENAB_AGENT_AUTH_COMMAND="pi /login"
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

# =============================================================================
# Target: native
# =============================================================================
FROM base-debian AS native
ENV HOME=/home/agent
WORKDIR /home/agent
COPY --from=bins --chown=agent:agent /openab /usr/local/bin/openab
COPY --from=bins --chown=agent:agent /openab-agent /usr/local/bin/openab-agent
RUN mkdir -p /home/agent/.openab && chown -R agent:agent /home/agent
USER agent
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD pgrep -x openab || exit 1
ENV OPENAB_AGENT_COMMAND="openab-agent"
ENV OPENAB_AGENT_AUTH_COMMAND="openab-agent auth codex-oauth --no-browser"
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]

# =============================================================================
# Target: agentcore (minimal — no agent CLI bundled)
# =============================================================================
FROM debian:trixie-slim AS agentcore
RUN apt-get update && apt-get install -y --no-install-recommends \
      ca-certificates tini \
    && rm -rf /var/lib/apt/lists/*
RUN useradd -m -s /bin/bash -u 1000 agent
ENV HOME=/home/agent
WORKDIR /home/agent
COPY --from=bins --chown=agent:agent /openab /usr/local/bin/openab
USER agent
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD pgrep -x openab || exit 1
ENTRYPOINT ["tini", "--"]
CMD ["openab", "run", "-c", "/etc/openab/config.toml"]