# Dockerfile - Web Terminal Sandbox (Compliant)
# No SSH, no hardcoded passwords, only web terminal on 7860
FROM ubuntu:22.04

ENV DEBIAN_FRONTEND=noninteractive
ENV TZ=UTC

RUN apt-get update && apt-get upgrade -y && \
    apt-get install -y --no-install-recommends \
    bash curl wget git vim nano \
    htop tmux screen \
    net-tools iputils-ping \
    unzip zip tree jq \
    python3 python3-pip python3-venv \
    build-essential \
    ca-certificates \
    && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

# ttyd - web terminal
ADD https://github.com/tsl0922/ttyd/releases/download/1.7.7/ttyd.x86_64 /usr/local/bin/ttyd
RUN chmod +x /usr/local/bin/ttyd

# Create non-root user for safety
RUN useradd -m -s /bin/bash user && \
    echo 'user ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers

WORKDIR /home/user

COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

EXPOSE 7860

ENTRYPOINT ["/entrypoint.sh"]