FROM archlinux:latest

ARG USERNAME=dev
ARG UID=1000
ARG GID=1000

RUN pacman -Syu --noconfirm \
        base-devel \
        git \
        ca-certificates \
        bash \
        less \
        ripgrep \
        nodejs \
        npm \
        curl \
        sudo && \
    groupadd -g ${GID} ${USERNAME} && \
    useradd -m -u ${UID} -g ${GID} -s /bin/bash ${USERNAME} && \
    echo "${USERNAME} ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && \
    pacman -Scc --noconfirm

# OpenCode, Claude Code, and Pi are intentionally NOT baked into the image:
# an install into $HOME at build time would be shadowed by the container-home
# bind mount, and system-wide installs are root-owned and not self-updatable.
# On first use, agent-container.py runs each tool's official installer (no
# sudo) against the persistent container home instead, so `pi update`,
# `claude update`, and `opencode upgrade` work inside the container and
# survive image rebuilds and container recreation. See _bootstrap_tool() in
# agent-container.py.
USER ${USERNAME}

WORKDIR /home/${USERNAME}