## Cave Runner — self-hosted automation runner with rootless Podman-in-Podman.
##
## Based on quay.io/podman/stable, the Podman team's reference image for nested
## rootless Podman. It ships a pre-configured `podman` user (subuid/subgid,
## newuidmap/newgidmap with file capabilities, and a containers.conf tuned for
## nesting), so workflow jobs run in nested containers with LEAST privilege.
##
## A plain fedora image does NOT work here: its newuidmap/newgidmap lose their
## file caps in the build, /etc/subuid uses a range outside the container's own
## userns, and the default config trips on proc-mount / sethostname. Rather than
## patch all of that by hand, inherit the maintained reference setup.
##
## Build:  make runner-image
## Run (least privilege — no --privileged):
##   podman run --security-opt label=disable --device /dev/fuse \
##     cave-runner:latest --url grpc://cave:9443 --token <registration-token>

FROM quay.io/podman/stable

# podman/stable already provides podman, fuse-overlayfs, git, and the rootless
# nested-podman setup. Add the build tools some workflow jobs expect, plus rclone
# for the S3-backed actions/cache store (the runner operator configures the
# remote + credentials; rclone reads them from its own env/config).
RUN dnf install -y make gcc rclone && dnf clean all

# Shared FASL cache, bind-mounted into Lisp build jobs (see main.lisp). Pre-create
# it owned by the unprivileged `podman` user the runner runs as, so the mount
# source exists and is writable without root.
RUN mkdir -p /var/cache/cave-runner/common-lisp \
    && chown -R podman:podman /var/cache/cave-runner

# Per-job working trees live here (overridable via CAVE_RUNNER_WORKDIR). In
# production mount a NATIVE (ext4/xfs) host volume over this path: building from
# the container's fuse-overlayfs makes source reads crawl and wedges jobs (#9).
# Pre-created + owned by `podman` so an unmounted dev run still works (on fuse).
RUN mkdir -p /var/lib/cave-runner/work \
    && chown -R podman:podman /var/lib/cave-runner

# The runner is a subcommand of cave-server.
COPY --chmod=755 cave-server /usr/bin/cave-server

USER podman
WORKDIR /home/podman
ENTRYPOINT ["cave-server", "runner"]