# AIMem-backed OpenAI Codex / Agents-SDK sandbox image. Builds with the
# released binaries fetched from the public CDN by default — nothing to
# stage. To build against local binaries instead, drop Linux/amd64
# `aimem` and `aimem-fusermount` into ./bin/ (auto-detected below).
# To layer on a different base, swap the CODEX_IMAGE build arg.

ARG CODEX_IMAGE=ghcr.io/openai/codex-universal:latest
FROM ${CODEX_IMAGE}

# aimem opens /dev/fuse directly via its own setuid helper, so no
# fuse package is needed. coreutils supplies sha256sum/cut/install for
# the checksum-verified CDN fetch; util-linux supplies `mountpoint` for
# the entrypoint readiness poll. python3-venv isolates the baked-in demo
# agents. libmlx5.so.1 ships inside ibverbs-providers on Debian/Ubuntu;
# symlink it into the standard search path so aimem's libibverbs runtime
# dlopen finds it.
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
        ca-certificates \
        coreutils \
        curl \
        libibverbs1 \
        librdmacm1 \
        ibverbs-providers \
        python3-venv \
        util-linux \
 && MLX5=$(find /usr/lib -name 'libmlx5.so.1.*' | head -1) \
 && [ -n "$MLX5" ] && ln -sf "$MLX5" /usr/lib/x86_64-linux-gnu/libmlx5.so.1 \
 && ldconfig \
 && rm -rf /var/lib/apt/lists/*

# Codex CLI. The codex-universal base ships the toolchain but not codex
# itself. Pin to a specific GitHub release + checksum (override with
# build args to bump the pin).
ARG CODEX_VERSION=rust-v0.136.0
ARG CODEX_SHA256=dadad6c9db74500ad5431fa178b30288fdbdda6bdf3397634db6e1f5981321cf
RUN curl -fsSL \
        "https://github.com/openai/codex/releases/download/${CODEX_VERSION}/codex-x86_64-unknown-linux-musl.tar.gz" \
        -o /tmp/codex.tar.gz \
 && echo "${CODEX_SHA256}  /tmp/codex.tar.gz" | sha256sum -c - \
 && tar -xzf /tmp/codex.tar.gz -C /tmp \
 && install -m 755 /tmp/codex-x86_64-unknown-linux-musl /usr/local/bin/codex \
 && rm -f /tmp/codex.tar.gz /tmp/codex-x86_64-unknown-linux-musl \
 && codex --version

# Python entry points used by the default Agents SDK demo and smoke tests.
# TODO(release): replace `latest` with the OpenAI Agents SDK version that
# AIMem validates for the release image.
ARG OPENAI_AGENTS_VERSION=latest
ARG OPENAI_CODEX_SDK_VERSION=0.1.0b2
RUN set -eux; \
    python3 -m venv /opt/aimem-agent-venv; \
    /opt/aimem-agent-venv/bin/pip install --no-cache-dir pydantic; \
    if [ "${OPENAI_AGENTS_VERSION}" = "latest" ]; then \
        /opt/aimem-agent-venv/bin/pip install --no-cache-dir openai-agents; \
    else \
        /opt/aimem-agent-venv/bin/pip install --no-cache-dir "openai-agents==${OPENAI_AGENTS_VERSION}"; \
    fi; \
    /opt/aimem-agent-venv/bin/pip install --no-cache-dir --no-deps "openai-codex==${OPENAI_CODEX_SDK_VERSION}"
ENV PATH=/opt/aimem-agent-venv/bin:${PATH}

# Standard container binary-acquisition block (amd64). Auto-detects staged
# binaries in ./bin (CI/offline) else curls the released binaries from the
# CDN and verifies each against its published .sha256sum. For arm64 runtimes
# swap linux-amd64 -> linux-arm64.
ARG AIMEM_VERSION=latest
ARG AIMEM_DL_BASE=https://dl.min.io/aistor/aimem/release
COPY bin/ /opt/aimem-staged/
# latest is served under the bare file name; a pinned tag lives under archive/,
# the only path that still resolves once a newer release ships.
RUN set -eux; \
    suffix=""; dir=""; \
    [ "${AIMEM_VERSION}" = latest ] || { suffix=".${AIMEM_VERSION}"; dir="archive/"; }; \
    for pair in "aimem:/usr/local/bin/aimem" "aimem-fusermount:/usr/bin/aimem-fusermount"; do \
        name=${pair%%:*}; dest=${pair#*:}; \
        if [ -f "/opt/aimem-staged/$name" ]; then \
            install -m 0755 "/opt/aimem-staged/$name" "$dest"; \
        else \
            curl -fsSL "${AIMEM_DL_BASE}/linux-amd64/${dir}${name}${suffix}" -o "$dest"; \
            curl -fsSL "${AIMEM_DL_BASE}/linux-amd64/${dir}${name}${suffix}.sha256sum" -o /tmp/aimem.sum; \
            echo "$(cut -d' ' -f1 /tmp/aimem.sum)  $dest" | sha256sum -c -; \
            chmod +x "$dest"; \
        fi; \
    done; \
    rm -rf /opt/aimem-staged /tmp/aimem.sum; \
    chown root:root /usr/bin/aimem-fusermount; chmod 4755 /usr/bin/aimem-fusermount; \
    /usr/local/bin/aimem --version

COPY aimem-mount /usr/local/bin/aimem-mount
COPY entrypoint.sh /usr/local/bin/aimem-entrypoint
COPY agent.py agent_smoke.py codex_sdk_smoke.py /
RUN chmod +x /usr/local/bin/aimem-mount /usr/local/bin/aimem-entrypoint

ENV AIMEM_WORKDIR=/workspace \
    AIMEM_LOCAL=/var/cache/aimem-staging

ENTRYPOINT ["/usr/local/bin/aimem-entrypoint"]