Dockerfile

FROM ubuntu:26.04

ARG RUBY_VERSION=3.4.8

RUN apt-get update && apt-get install -y --no-install-recommends \
     bind9-host \
     build-essential \
     ca-certificates \
     cmake \
     curl \
     ffmpeg \
     file \
     gcc \
     git \
     gpg \
     gpg-agent \
     inetutils-traceroute \
     iputils-ping \
     iputils-tracepath \
     jq \
     less \
     libcurl4-openssl-dev \
     liblz4-dev \
     libpq-dev \
     libyaml-dev \
     libzstd-dev \
     man-db \
     netcat-openbsd \
     openjdk-21-jdk-headless \
     openssh-client \
     pandoc \
     postgresql \
     ragel \
     rdap \
     ripgrep \
     rsync \
     silversearcher-ag \
     strace \
     sudo \
     systemd \
     systemd-sysv \
     tree \
     unminimize \
     vim \
     wget \
     whois \
     zip \
     zlib1g-dev \
     zsh \
     && yes | unminimize \
     && rm -rf /var/lib/apt/lists /var/cache/apt/archives

# Install Chromium dependencies and browser from Debian sid
# (Ubuntu's chromium-browser is a snap wrapper that won't work in containers)
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl \
    gnupg \
    ca-certificates \
    libnss3 \
    libatk1.0-0 \
    libatk-bridge2.0-0 \
    libcups2 \
    libdrm2 \
    libxkbcommon0 \
    libxcomposite1 \
    libxdamage1 \
    libxfixes3 \
    libxrandr2 \
    libgbm1 \
    libasound2t64 \
    libpango-1.0-0 \
    libcairo2 \
    fonts-liberation \
    && rm -rf /var/lib/apt/lists/*

# Add Debian sid repository for Chromium (Ubuntu snaps don't work in containers)
RUN curl -fsSL "https://ftp-master.debian.org/keys/archive-key-12.asc" -o /tmp/debian.asc \
    && gpg --batch --yes --dearmor -o /usr/share/keyrings/debian-archive.gpg /tmp/debian.asc \
    && echo "deb [signed-by=/usr/share/keyrings/debian-archive.gpg] http://deb.debian.org/debian sid main" > /etc/apt/sources.list.d/debian-sid.list \
    && apt-get update \
    && apt-get install -y --no-install-recommends chromium \
    && rm -rf /var/lib/apt/lists/* /tmp/debian.asc

ENV HOME=/workspace
ENV RUBIES_DIR="${HOME}/.local/share/rv/rubies"
RUN mkdir $HOME
WORKDIR $HOME

COPY inside_deps/ ./

RUN bash _brew.sh
RUN bash _claude.sh
RUN bash _nvm.sh
RUN sh _mise.sh
RUN sh _rv.sh
RUN rm _brew.sh \
       _claude.sh \
       _mise.sh \
       _nvm.sh \
       _rv.sh

# Homebrew does not let you pick HOMEBREW_PREFIX on Linux, always /home/linuxbrew/.linuxbrew
# $HOME must be set to run brew
COPY <<-EOT /workspace/.bash_profile
export HOME=/workspace
export PATH=$PATH:/workspace/.cargo/bin

eval "$($HOME/.cargo/bin/rv shell init bash)"
eval "$($HOME/.cargo/bin/rv shell completions bash)"

eval "$($HOME/.local/bin/mise activate bash)"
eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"

source /workspace/.nvm/nvm.sh
EOT

# BASH_ENV makes non-interactively shells source this file
ENV BASH_ENV="/workspace/.bash_profile"

RUN bash -c "brew --version"
RUN bash -c "mise --version"
RUN bash -c "rv --version"

RUN bash -c "mise use --global bun"
RUN bash -c "mise use --global go"
RUN bash -c "mise use --global python"
RUN bash -c "mise use --global rust"

RUN bash -c "go version"
RUN bash -c "python --version"
RUN bash -c "rustc --version"

RUN bash -c "nvm install 22"
RUN bash -c "node -v"
RUN bash -c "npm -v"

RUN bash -c "npm install -g @github/copilot"
RUN bash -c "npm install -g @google/gemini-cli"
RUN bash -c "npm install -g @openai/codex"

RUN bash -c "rv ruby install $RUBY_VERSION"
RUN bash -c "rv ruby install 3.4.7"
RUN bash -c "rv ruby install 3.4.9"
RUN bash -c "rv ruby install 4.0.2"
RUN bash -c "rv run ruby --yjit --version"
RUN bash -c "rv run bundle --version"

# Install chruby per https://gist.github.com/dentarg/79aae28811c290b7a6a96ab4fafd4197
RUN bash -c "git clone --branch do-no-set-gem-home https://github.com/eregon/chruby.git"

# JRuby via ruby-build
RUN bash -c "git clone https://github.com/rbenv/ruby-build.git"
RUN bash -c "ruby-build/bin/ruby-build jruby-10.0.4.0 $RUBIES_DIR/jruby-10.0.4.0"

# Install puppeteer-core (uses system Chromium instead of bundling its own)
RUN bash -c "npm install -g puppeteer-core"

# Crystal
RUN curl --location https://packagecloud.io/84codes/crystal/gpgkey | gpg --dearmor > /etc/apt/trusted.gpg.d/84codes_crystal.gpg
COPY <<-EOT /etc/apt/sources.list.d/84codes_crystal.list
deb https://packagecloud.io/84codes/crystal/ubuntu noble main
EOT
RUN apt-get update && apt-get install -y --no-install-recommends crystal
RUN bash -c "crystal --version"

# PostgreSQL
RUN sed -i 's/scram-sha-256/trust/' /etc/postgresql/*/main/pg_hba.conf
RUN service postgresql start && sudo -u postgres psql --command='CREATE ROLE root WITH LOGIN SUPERUSER;'

# LavinMQ
RUN curl --location https://packagecloud.io/cloudamqp/lavinmq/gpgkey | gpg --dearmor > /usr/share/keyrings/lavinmq.gpg
# no resolute packages yet
COPY <<-EOT /etc/apt/sources.list.d/lavinmq.list
deb [signed-by=/usr/share/keyrings/lavinmq.gpg] https://packagecloud.io/cloudamqp/lavinmq/ubuntu noble main
EOT
RUN apt-get update && apt-get install -y --no-install-recommends lavinmq

# amqpcat - AMQP CLI tool
COPY --from=cloudamqp/amqpcat /amqpcat /usr/bin/amqpcat

# mitmproxy
RUN bash -c "pip install mitmproxy"

# we don't want to wait when starting the container
RUN systemctl disable postgresql lavinmq

# convenience scripts
COPY ./tools/start.sh /usr/local/bin/start.sh
COPY ./tools/screenshot.sh /usr/local/bin/screenshot.sh
COPY ./tools/claude.sh /usr/local/bin/c
COPY ./tools/gemini.sh /usr/local/bin/g
COPY ./tools/codex.sh /usr/local/bin/cx
COPY ./tools/exit.sh /usr/local/bin/x
COPY ./tools/claude-hook.sh /usr/local/bin/claude-hook
COPY ./tools/claude-login.sh /usr/local/bin/claude-login
RUN chmod +x /usr/local/bin/start.sh \
             /usr/local/bin/screenshot.sh \
             /usr/local/bin/c \
             /usr/local/bin/g \
             /usr/local/bin/cx \
             /usr/local/bin/x \
             /usr/local/bin/claude-hook \
             /usr/local/bin/claude-login

#
# systemd
#

# Default is SIGTERM (15), but systemd ignores that. Systemd expects SIGRTMIN+3 (37) to initiate a clean shutdown
# Without it, podman would send SIGTERM, systemd ignores it, then after a timeout podman sends SIGKILL
STOPSIGNAL SIGRTMIN+3

# disables login prompt
RUN systemctl mask getty.target console-getty.service

# this gets us the behaviour we had without systemd: a shell is started, container stops when we exit the shell
COPY <<-EOT /etc/systemd/system/shell.service
[Unit]
Description=Interactive Shell
After=multi-user.target

[Service]
Type=simple
Environment=HOME=$HOME
PassEnvironment=HOST_DIR
ExecStart=/bin/bash
WorkingDirectory=/app
StandardInput=tty
StandardOutput=tty
StandardError=tty
TTYPath=/dev/console
TTYReset=yes
TTYVHangup=yes
ExecStopPost=/bin/kill -37 1

[Install]
WantedBy=multi-user.target
EOT

RUN systemctl enable shell.service

# Token refresh service
COPY <<-EOT /etc/systemd/system/refresh-tokens.service
[Unit]
Description=Claude OAuth Token Refresh
After=network.target

[Service]
Type=simple
Environment=HOME=$HOME
ExecStart=/usr/local/bin/refresh-tokens --daemon
Restart=on-failure
RestartSec=30

[Install]
WantedBy=multi-user.target
EOT

RUN systemctl enable refresh-tokens.service

# Claude Code plugins
# RUN bash -c "claude plugin marketplace add https://github.com/anthropics/claude-code"
# RUN bash -c "claude plugin install ralph-wiggum@claude-code-plugins"

# created by claude native installer
RUN rm -rf $HOME/.claude

ENV LANG C.UTF-8
ENV LC_ALL C.UTF-8

# do this late to allow tweaking without rebuilding previous layers
COPY dot.bashrc $HOME/.bashrc
COPY .gitconfig /etc/gitconfig
COPY bin/refresh-tokens /usr/local/bin/refresh-tokens
RUN chmod +x /usr/local/bin/refresh-tokens

# Hide systemd shutdown messages on container exit
RUN mkdir -p /etc/systemd/system.conf.d && \
    printf '[Manager]\nShowStatus=no\n' > /etc/systemd/system.conf.d/hide-status.conf

CMD ["/sbin/init"]