dsh/upstream/Dockerfile

ARG DSH_VERSION=latest
ARG ENVIRONMENT_VERSION=development
ARG TARGET_SEQUENCE=0
ARG SIGNED_IMAGE_INPUT=false

FROM node:24-bookworm-slim AS installer
ARG DSH_VERSION
ARG SIGNED_IMAGE_INPUT
COPY container/platform/image-input /opt/dsh-platform-image-input
COPY release/supported-target.json /opt/dsh-supported-target.json

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        g++ \
        make \
        python3 \
    && case "$SIGNED_IMAGE_INPUT" in \
       true) \
         test -f /opt/dsh-platform-image-input/dsh.tgz \
         && npm install --global /opt/dsh-platform-image-input/dsh.tgz \
         ;; \
       false) \
         requested_version="$DSH_VERSION"; \
         if [ "$requested_version" = latest ]; then \
           requested_version="$(node -p "JSON.parse(require('fs').readFileSync('/opt/dsh-supported-target.json', 'utf8')).latestSupportedDsh")"; \
         fi; \
         npm install --global "@deepseek-ai/dsh@${requested_version}" \
         ;; \
       *) echo "SIGNED_IMAGE_INPUT must be true or false" >&2; exit 64 ;; \
       esac \
    && rm -rf /var/lib/apt/lists/* /root/.npm

FROM node:24-bookworm-slim AS platform-seed
ARG PLATFORM_REVISION=development
ARG SIGNED_IMAGE_INPUT
COPY --from=installer /usr/local/lib/node_modules/@deepseek-ai/dsh /opt/installed-dsh
COPY container/control-plane/services/management/package.json container/control-plane/services/management/package-lock.json \
    /opt/dsh-platform-source/control-plane/services/management/
COPY container/environment/resources/plugins/platform-management/package/package.json \
    container/environment/resources/plugins/platform-management/package/package-lock.json \
    /opt/dsh-platform-source/environment/resources/plugins/platform-management/package/
RUN npm ci --omit=dev --ignore-scripts --no-audit --no-fund \
      --prefix /opt/dsh-platform-source/control-plane/services/management \
    && npm ci --omit=dev --ignore-scripts --no-audit --no-fund --legacy-peer-deps \
      --prefix /opt/dsh-platform-source/environment/resources/plugins/platform-management/package
COPY container /opt/dsh-platform-source
RUN case "$SIGNED_IMAGE_INPUT" in \
      true) image_input=/opt/dsh-platform-source/platform/image-input ;; \
      false) image_input=- ;; \
      *) echo "SIGNED_IMAGE_INPUT must be true or false" >&2; exit 64 ;; \
    esac \
    && node /opt/dsh-platform-source/platform/tools/build-seed.mjs \
      /opt/installed-dsh /opt/dsh-platform-seed "$image_input" "$PLATFORM_REVISION"

FROM node:24-bookworm-slim AS runtime
ARG PNPM_VERSION=11.7.0
ARG DSH_VERSION
ARG ENVIRONMENT_VERSION
ARG TARGET_SEQUENCE

LABEL org.opencontainers.image.title="DeepSeek Harness" \
      org.opencontainers.image.description="Unofficial container image for DeepSeek Harness" \
      org.opencontainers.image.source="https://github.com/yjrszcq/dsh-docker" \
      org.opencontainers.image.licenses="MIT" \
      org.opencontainers.image.version="$DSH_VERSION" \
      io.dsh-docker.environment.version="$ENVIRONMENT_VERSION" \
      io.dsh-docker.target-sequence="$TARGET_SEQUENCE"

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        bash \
        ca-certificates \
        curl \
        g++ \
        git \
        jq \
        make \
        openssh-client \
        p7zip-full \
        procps \
        python3 \
        python3-venv \
        ripgrep \
        sudo \
        tini \
        unzip \
        util-linux \
        zip \
    && groupadd --system dsh-sudo-true \
    && groupadd --system dsh-sudo-false \
    && groupadd --system --gid 991 dsh-proxy \
    && useradd --system --uid 991 --gid 991 --home-dir /nonexistent --shell /usr/sbin/nologin dsh-proxy \
    && groupadd --system --gid 992 dsh-access \
    && useradd --system --uid 992 --gid 992 --home-dir /nonexistent --shell /usr/sbin/nologin dsh-access \
    && npm install --global "pnpm@${PNPM_VERSION}" \
    && rm -rf /var/lib/apt/lists/* /root/.npm

COPY docker-sudoers /etc/sudoers.d/dsh-sudo
RUN chmod 440 /etc/sudoers.d/dsh-sudo \
    && visudo -cf /etc/sudoers.d/dsh-sudo

COPY --from=platform-seed /opt/dsh-platform-seed /opt/dsh-platform/seed
COPY container/platform /opt/dsh-platform/runtime/platform
COPY container/control-plane /opt/dsh-platform/runtime/control-plane
COPY --from=platform-seed /opt/dsh-platform-source/control-plane/services/management/node_modules /opt/dsh-platform/runtime/control-plane/services/management/node_modules
COPY container/platform/tools/dsh-shim.sh /usr/local/bin/dsh
COPY container/platform/tools/dsh-platform-shim.sh /usr/local/bin/dsh-platform
RUN chmod 755 /usr/local/bin/dsh /usr/local/bin/dsh-platform

ENV DSH_PLATFORM_DATA=/data/platform \
    DSH_PLATFORM_MANAGED=1 \
    DSH_PLATFORM_RUN=/run/dsh-platform \
    DSH_HOME=/data/dsh \
    DSH_DEFAULT_WORKSPACE=/workspace \
    DSH_PROXY_POLYFILL=true \
    DSH_TELEMETRY_DISABLED=true \
    DSH_UPDATE_METADATA_URL=https://raw.githubusercontent.com/yjrszcq/dsh-docker/release-channel/ \
    DSH_LOG_MAX_BYTES=104857600 \
    DSH_LOG_RETENTION_DAYS=14 \
    DSH_ACTIVATION_TIMEOUT_SECONDS=60 \
    DSH_EXPERIMENTAL_PROBATION_SECONDS=120

RUN mkdir -p /data/platform /data/dsh /workspace \
    && chown -R node:node /data/dsh /workspace

ARG INSTALL_DEVTOOLS=false
ARG UV_VERSION=0.11.32

RUN case "$INSTALL_DEVTOOLS" in \
        true) apt-get update \
            && apt-get install -y --no-install-recommends \
                bash-completion \
                build-essential \
                dnsutils \
                file \
                htop \
                iproute2 \
                iputils-ping \
                less \
                lsof \
                nano \
                netcat-openbsd \
                openssl \
                pkg-config \
                rsync \
                tmux \
                tree \
                unzip \
                vim \
                wget \
                xz-utils \
                zip \
            && curl --fail --location --silent --show-error \
                "https://astral.sh/uv/${UV_VERSION}/install.sh" \
                --output /tmp/uv-installer.sh \
            && UV_UNMANAGED_INSTALL=/usr/local/bin sh /tmp/uv-installer.sh \
            && mkdir -p /etc/uv \
            && printf '%s\n' 'python-downloads = "manual"' > /etc/uv/uv.toml \
            && rm /tmp/uv-installer.sh \
            && rm -rf /var/lib/apt/lists/* \
            ;; \
        false) ;; \
        *) echo "INSTALL_DEVTOOLS must be true or false" >&2; exit 64 ;; \
    esac

WORKDIR /workspace

EXPOSE 3080

HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
    CMD /usr/bin/curl --fail --silent --show-error --noproxy '*' http://127.0.0.1:3080/_dsh_gateway/health >/dev/null || exit 1

ENTRYPOINT ["/usr/bin/tini", "--"]
CMD ["/usr/local/bin/node", "/opt/dsh-platform/runtime/platform/stage0/index.mjs"]