# Boardroom Map reviewer image — BUILT ON THE HEAD SPARK (aarch64), not packed into the
# s9pk (the orchestrator ships this build context and builds it on the Spark; see
# reviewers.ensure_reviewer_image).
#
# One-shot, read-only document reviewer (grader_agent.py) speaking the
# OpenAI-compatible API directly — a lean pure-Python image that builds fast.
#
# At RUN time the orchestrator launches this HARDENED (non-root, --cap-drop ALL,
# --security-opt no-new-privileges, read-only rootfs, no docker socket, only
# /docs (ro), /persona (ro), /RUBRIC.md (ro) and /out (rw) mounted, cpu/mem/pid
# caps) and attached to the per-job network. In air-gapped mode that network is
# --internal, so the container can reach ONLY the on-Spark model proxy.
FROM python:3.11-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
        ca-certificates curl && \
    rm -rf /var/lib/apt/lists/*

# Non-root user matching the orchestrator's --user 1000:1000 (HOME=/home/rev,
# mounted as a writable tmpfs at run time).
RUN useradd -u 1000 -m -d /home/rev -s /bin/bash reviewer || true

COPY grader_agent.py /opt/boardroom/grader_agent.py

WORKDIR /out
ENV PYTHONUNBUFFERED=1
# grader_agent.py uses only the Python stdlib (urllib) — no pip deps to install.
ENTRYPOINT ["python3", "/opt/boardroom/grader_agent.py"]