# Nucleic runner image — the Antimatter runner's host-of-record container
# (docs/ANTIMATTER_RUNNER.md §2, §9).
#
# Layers `nucleicd` (the headless NucleicCore host) onto the sandbox image, so one container is
# simultaneously the host-of-record AND the agent sandbox (`RunSpec.container = nil` — the
# CLOUD_RUNTIME insight): claude/codex/grok, git, gh, and the control-bridge instrumentation all
# come from the base; this image adds only the daemon and its runtime.
#
# ── Building the binary (linux/amd64 — Cloudflare Containers run amd64 ONLY) ─────────────────
# The `nucleicd` Linux build is REAL (the CLOUD_RUNTIME Phase-2 port landed: swift-crypto Noise
# interop proven by the protocol suite on Linux, GRDB-on-Linux green, BSD-socket approval
# server, 0600-file secret store, NIO relay WebSocket). The image binary is a fully-static
# x86_64-musl build via Swift's Static Linux SDK — cross-compiles at native speed from ANY host
# arch (including the arm64 swift container on an Apple-silicon Mac), no Swift runtime libs to
# ship. The proven recipe is scripted:
#
#   docker run --rm -v "$PWD":/src -w /src swift:6.3-bookworm scripts/build-nucleicd-linux.sh
#   cp .build/x86_64-swift-linux-musl/release/nucleicd containers/nucleic-runner/
#   docker build --platform linux/amd64 -t nucleic-runner containers/nucleic-runner
#
# Verified end to end: the static amd64 binary (run under qemu-x86_64) enrolls with the deployed
# relay, listens on it, and mints working pairing codes.
#
# ── Gates before this deploys to Cloudflare ──────────────────────────────────────────────────
#   • The FROM base below (nucleic-sandbox) is **arm64-only today** — its CI must publish a
#     linux/amd64 variant first (CLOUD_RUNTIME §3.2 names this exact work: "CI adds linux/amd64
#     (Cloudflare requirement) alongside arm64 and smoke-tests each CLI per-arch").
#   • Push this image to a registry, then uncomment the wrangler `containers` block in
#     cloud/nucleic-runner/wrangler.jsonc. The Worker + pool DO deploy and run without it, and a
#     self-hosted box runs `nucleicd` natively with no container at all.
FROM ghcr.io/abkslm/nucleic-sandbox:v5

COPY nucleicd /usr/local/bin/nucleicd

# The runner's store lives on the container's own (ephemeral) disk; durable state rides git
# remotes + checkpoints per CLOUD_RUNTIME §3.5. Fixed path so checkpoint tooling can find it.
ENV NUCLEIC_RUNNER_DATA_DIR=/var/lib/nucleic-runner
RUN mkdir -p /var/lib/nucleic-runner

# The pool injects the rest of the contract at start (container.ts buildContainerEnv):
#   NUCLEIC_RUNNER_POOL_ID, NUCLEIC_RUNNER_INSTANCE_ID, NUCLEIC_RUNNER_EPOCH,
#   NUCLEIC_RUNNER_INSTANCE_TOKEN, NUCLEIC_RUNNER_CONTROL_URL, NUCLEIC_RELAY_URL (optional).
# nucleicd listens relay-only by default and serves the one-shot pairing payload on the
# loopback control port (9200) for the provisioning proxy (`GET /v1/pool/pairing`).
ENTRYPOINT ["/usr/local/bin/nucleicd"]
