FROM node:20-slim

# Install minimal runtime dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
        git \
        curl \
        ca-certificates \
        bash \
        ttyd \
    && rm -rf /var/lib/apt/lists/*

# Entrypoint used by the webui service (ttyd wrapping claude)
COPY --chmod=755 webui-entrypoint.sh /usr/local/bin/webui-entrypoint.sh

# Create non-root user
RUN groupadd -g 1000 claude \
    && useradd -u 1000 -g claude -m -s /bin/bash claude

# Install Claude Code globally (runs as root for npm -g, then drops)
RUN npm install -g @anthropic-ai/claude-code

# Workspace directory owned by claude user
RUN mkdir -p /workspace && chown claude:claude /workspace

USER claude
WORKDIR /workspace

# Proxy traffic through sidecar — override at runtime if needed
ENV HTTP_PROXY=http://proxy:3128
ENV HTTPS_PROXY=http://proxy:3128
ENV ALL_PROXY=http://proxy:3128
ENV NO_PROXY=localhost,127.0.0.1

ENTRYPOINT ["claude"]