# w4c-workflows — one image, two entrypoints:
#   - api     : control plane (default entrypoint)
#   - worker  : per-tenant execution worker (override command with ["--worker"])
#
# The worker sandbox needs node, python and esbuild at runtime. The C# executor
# (Roslyn) ships inside the published app as a NuGet package — no SDK needed in
# the runtime image. Build on the SDK image and copy the app into the runtime.
FROM mcr.microsoft.com/dotnet/sdk:11.0-preview AS build
WORKDIR /src
COPY *.csproj .
RUN dotnet restore
COPY . .
RUN dotnet publish -c Release -o /app

FROM mcr.microsoft.com/dotnet/aspnet:11.0-preview
WORKDIR /app
COPY --from=build /app .

# Worker sandbox runtimes: python3 + node + esbuild. The api image does not
# strictly need them, but keeping them makes the image a true drop-in worker.
RUN apt-get update \
    && apt-get install -y --no-install-recommends python3 nodejs npm ca-certificates git \
    && npm install -g esbuild \
    && rm -rf /var/lib/apt/lists/*

# Run as an unprivileged user (defense-in-depth: the container is the sandbox
# boundary and subprocess/Roslyn execute as this user). /tmp stays world-writable
# for the TypeScript executor's esbuild bundle; the workflow code checkout is
# mounted read-only (see compose) and only read, never written.
RUN useradd --uid 10001 --create-home --shell /usr/sbin/nologin appuser \
    && mkdir -p /data/workflow-tenants \
    && chown -R appuser:appuser /data
USER appuser

EXPOSE 5259
ENV ASPNETCORE_URLS=http://+:5259
ENTRYPOINT ["dotnet", "w4c-workflows-api.dll"]