# Firecracker infra VM image (PRD 0070 Stage B).
#
# The shared rootfs both firecracker infra VMs boot: the gateway data plane +
# the orchestrator control plane + the in-VM agent-image builder. A `bb_role=`
# kernel-cmdline arg selects which plane the guest init starts (see
# `infra_vm._infra_init`), so there is one artifact to build/publish/pull.
#
# `Dockerfile.orchestrator` is the single definition of the orchestrator
# content (the lean `bot_bottle` package on trixie `python:3.12-slim`); it's
# pulled in via `COPY --from` (multi-`FROM` can't union two bases). Both images
# share the trixie base, so the copy is clean.
#
# The Firecracker backend builds users' agent Dockerfiles *inside the
# orchestrator VM* with buildah (rootless, daemonless) instead of on the host —
# no host Docker daemon, no root-equivalent `docker` group. Requires the trixie
# base from bot-bottle-gateway (buildah 1.39: bookworm's 1.28 can't parse the
# Dockerfile heredocs agent images use). `crun` is the OCI runtime; `netavark` +
# `aardvark-dns` are the network backend for `FROM` pulls + `RUN` egress. `vfs` +
# `chroot`: buildah works as root in the bare microVM (no fuse-overlayfs /
# overlay module / subuid maps). Matches image_builder.
FROM bot-bottle-gateway:latest

# The orchestrator content, from its single definition. The gateway image
# already has the flat daemon modules under /app; this adds the full
# `bot_bottle` package so `python3 -m bot_bottle.orchestrator` resolves in the
# orchestrator-role VM.
COPY --from=bot-bottle-orchestrator:latest /app/bot_bottle /app/bot_bottle

RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      buildah crun netavark aardvark-dns \
 && rm -rf /var/lib/apt/lists/*
ENV STORAGE_DRIVER=vfs \
    BUILDAH_ISOLATION=chroot