# AIMem-backed E2B sandbox image. Build via `e2b template create`
# (see build.sh). The aimem mount is launched after sandbox creation
# via sb.commands.run (see usage.ts), not at image build.

FROM e2bdev/code-interpreter:latest

# Release to pull from the public CDN. Override with
# `--build-arg AIMEM_VERSION=RELEASE.<date>` to pin in production.
ARG AIMEM_VERSION=latest
ARG AIMEM_DL_BASE=https://dl.min.io/aistor/aimem/release

# aimem mounts through /dev/fuse directly via its own setuid helper, so
# no fuse package is installed here. libmlx5.so.1 ships inside
# ibverbs-providers (no standalone libmlx5-1 package on Debian);
# symlink it into the standard search path so aimem's libibverbs
# runtime dlopen finds it.
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
        ca-certificates \
        curl \
        libibverbs1 \
        librdmacm1 \
        ibverbs-providers \
 && MLX5=$(find /usr/lib -name 'libmlx5.so.1.*' | head -1) \
 && [ -n "$MLX5" ] && ln -sf "$MLX5" /usr/lib/x86_64-linux-gnu/libmlx5.so.1 \
 && ldconfig \
 && rm -rf /var/lib/apt/lists/*

# Required only if a mount is ever started with --allow-other (lets root
# and other users traverse the mount). aimem-mount does not pass it
# today, but keep the policy enabled so it works if added.
RUN echo 'user_allow_other' >> /etc/fuse.conf

COPY aimem-mount /usr/local/bin/aimem-mount

# Binary acquisition. The sandbox runs as the unprivileged `user`, so
# aimem opens /dev/fuse itself and forwards the fd to the setuid
# `aimem-fusermount` helper, which performs the privileged mount(2).
#
# Auto-detect the source: use Linux/amd64 binaries pre-staged in ./bin
# (CI / offline builds), otherwise fetch the released binaries from the
# public CDN and verify each against its published .sha256sum.
COPY bin/ /opt/aimem-staged/
# latest is served under the bare file name; a pinned tag lives under archive/,
# the only path that still resolves once a newer release ships.
RUN set -eux; \
    suffix=""; dir=""; \
    [ "${AIMEM_VERSION}" = latest ] || { suffix=".${AIMEM_VERSION}"; dir="archive/"; }; \
    for pair in "aimem:/usr/local/bin/aimem" "aimem-fusermount:/usr/bin/aimem-fusermount"; do \
        name=${pair%%:*}; dest=${pair#*:}; \
        if [ -f "/opt/aimem-staged/$name" ]; then \
            install -m 0755 "/opt/aimem-staged/$name" "$dest"; \
        else \
            curl -fsSL "${AIMEM_DL_BASE}/linux-amd64/${dir}${name}${suffix}" -o "$dest"; \
            curl -fsSL "${AIMEM_DL_BASE}/linux-amd64/${dir}${name}${suffix}.sha256sum" -o /tmp/aimem.sum; \
            echo "$(cut -d' ' -f1 /tmp/aimem.sum)  $dest" | sha256sum -c -; \
            chmod +x "$dest"; \
        fi; \
    done; \
    rm -rf /opt/aimem-staged /tmp/aimem.sum; \
    chmod +x /usr/local/bin/aimem-mount; \
    chown root:root /usr/bin/aimem-fusermount; chmod 4755 /usr/bin/aimem-fusermount; \
    /usr/local/bin/aimem --version

RUN mkdir -p /workspace /tmp/aimem-staging \
 && chown user:user /workspace /tmp/aimem-staging
WORKDIR /workspace