2026-10-05 20:40:13 +02:00
|
|
|
# syntax=docker/dockerfile:1
|
|
|
|
|
# Supply digests from plane/task-base.digest; deliberately no floating fallback.
|
|
|
|
|
ARG TASK_BROWSER_TAG=base-unpublished-browser
|
|
|
|
|
ARG TASK_BROWSER_DIGEST
|
|
|
|
|
FROM ghcr.io/norandom/ousast-task-base:${TASK_BROWSER_TAG}@${TASK_BROWSER_DIGEST}
|
2026-10-05 14:26:43 +02:00
|
|
|
USER root
|
2026-10-05 15:00:25 +02:00
|
|
|
# Dedicated identity for artefacts, apps and Chromium; the verifier keeps root.
|
|
|
|
|
RUN groupadd --gid 10001 search \
|
|
|
|
|
&& useradd --create-home --uid 10001 --gid 10001 search
|
2026-10-05 20:40:13 +02:00
|
|
|
# Upstream's public CPython signing fingerprint trips the credential guard.
|
2026-10-05 17:42:03 +02:00
|
|
|
ENV GPG_KEY=
|
2026-10-05 20:40:13 +02:00
|
|
|
WORKDIR /app
|
|
|
|
|
COPY pyproject.toml README.md LICENSE ./
|
|
|
|
|
COPY src ./src
|
|
|
|
|
RUN --mount=type=cache,target=/root/.cache/pip \
|
|
|
|
|
/venv/bin/pip install --no-deps --no-cache-dir .
|
|
|
|
|
# Entrypoints and verifier-owned recipes/oracles are included in src.
|
2026-10-05 15:00:25 +02:00
|
|
|
USER root
|
2026-10-05 20:40:13 +02:00
|
|
|
# Preserve the AX runner ENTRYPOINT and CMD.
|
