# Canonical OpenEnv runtime layer: a self-contained CPython (python-build-standalone) with the pinned
# OpenEnv release and its server dependencies at /opt/openenv. It contains no environment code.
# Any OpenEnv image, on any glibc Linux base, can take it with
#   COPY --link --from=<this image>@sha256:... / /
# so every image that does carries the same layer bytes.
FROM python:3.12-slim-bookworm AS build
RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates && rm -rf /var/lib/apt/lists/* \
    && pip install --no-cache-dir uv==0.9.5
ENV UV_PYTHON_INSTALL_DIR=/opt/openenv/python UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy UV_NO_CACHE=1
RUN uv python install 3.12 \
    && uv venv --seed --python 3.12 --python-preference only-managed /opt/openenv/venv \
    && uv pip install --python /opt/openenv/venv/bin/python \
        "openenv @ git+https://github.com/meta-pytorch/OpenEnv.git@86a180ede21e044f7929b9a7783ad83aa67d83a3" \
    && /opt/openenv/venv/bin/python -c "import openenv, fastapi, uvicorn"

RUN mkdir -p /opt/openenv/www && echo "OpenEnv runtime layer for Arena (pinned OpenEnv 86a180ede21e)." > /opt/openenv/www/index.html

FROM busybox:1.36.1-musl AS busybox

# The image holds nothing but the runtime tree, so `COPY --link --from=<this image> / /` adds exactly
# these files with exactly these timestamps: the copied layer comes out the same in every build.
# A static busybox serves one page so the Space itself can run without a base OS.
FROM scratch
COPY --from=build /opt/openenv /opt/openenv
COPY --from=busybox /bin/busybox /opt/openenv/bin/busybox
EXPOSE 7860
CMD ["/opt/openenv/bin/busybox", "httpd", "-f", "-p", "7860", "-h", "/opt/openenv/www"]