# syntax=docker/dockerfile:1.4

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# The static sandbox binary is staged at:
#   deploy/docker/.build/prebuilt-binaries/<arch>/openshell-sandbox
#
# Alpine supplies nftables and iptables for pod-namespace egress enforcement.

FROM alpine:3.22 AS supervisor

ARG TARGETARCH

# Refresh base packages too: adding firewall tools does not upgrade OpenSSL.
RUN apk upgrade --no-cache \
    && apk add --no-cache nftables iptables iptables-legacy

# Keep the binary root-owned for Podman image-volume mounts and executable by
# the Kubernetes network sidecar's non-root proxy UID.
COPY --chmod=0555 deploy/docker/.build/prebuilt-binaries/${TARGETARCH}/openshell-sandbox /openshell-sandbox

ENTRYPOINT ["/openshell-sandbox"]