# syntax=docker/dockerfile:1
# Supply digests from plane/task-base.digest; deliberately no floating fallback.
ARG TASK_BROWSER_TAG=base-unpublished-browser
ARG TASK_BROWSER_DIGEST
FROM ghcr.io/norandom/ousast-task-base:${TASK_BROWSER_TAG}@${TASK_BROWSER_DIGEST}
USER root
# Dedicated identity for artefacts, apps and Chromium; the verifier keeps root.
RUN groupadd --gid 10001 search \
 && useradd --create-home --uid 10001 --gid 10001 search
# Upstream's public CPython signing fingerprint trips the credential guard.
ENV GPG_KEY=
WORKDIR /app
COPY pyproject.toml README.md LICENSE ./
COPY src ./src
RUN --mount=type=cache,target=/root/.cache/pip \
    /venv/bin/pip install --no-deps --no-cache-dir .
# Entrypoints and verifier-owned recipes/oracles are included in src.
USER root
# Preserve the AX runner ENTRYPOINT and CMD.