# The Pi, minus the Pi. Layer 4 from the README: a real sshd, a real remote
# shell, and real `ssh` on the other end of everything runner.py builds.
#
# This is the only layer that can see remote-shell parsing. The fake `ssh` in
# layer 2 is handed an argv, so it runs the FIRST of the two parses between the
# CLI and the installer; `ssh` then joins its trailing arguments with spaces and
# a shell here re-parses the result. A quoting bug lives in that gap and nothing
# below this catches it.
FROM debian:bookworm-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
      openssh-server \
      curl \
      ca-certificates \
      sudo \
 && rm -rf /var/lib/apt/lists/*

# `pi`, because that is who Pi Imager creates and who the CLI's examples name.
# Passwordless sudo because `restart` uses it and a password prompt in a
# non-interactive test is a hang rather than a failure.
RUN useradd -m -s /bin/bash pi \
 && printf 'pi ALL=(ALL) NOPASSWD:ALL\n' > /etc/sudoers.d/pi \
 && chmod 440 /etc/sudoers.d/pi \
 && mkdir -p /run/sshd /home/pi/.ssh \
 && chown -R pi:pi /home/pi/.ssh \
 && chmod 700 /home/pi/.ssh

# Real systemd in a container is privileged and fiddly, and the CLI does not
# restart anything — it issues a command and surfaces the result. A stub covers
# everything the CLI is accountable for; whether the unit genuinely comes back
# is the runtime's contract, tested where the unit file lives.
COPY systemctl journalctl /usr/local/bin/
COPY entrypoint.sh /usr/local/bin/entrypoint.sh
RUN chmod +x /usr/local/bin/systemctl /usr/local/bin/journalctl /usr/local/bin/entrypoint.sh

EXPOSE 22
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
