# Boardroom Map grader image — BUILT ON THE HEAD SPARK (aarch64), not packed into the
# s9pk (the orchestrator ships this build context and builds it on the Spark; see
# graders.ensure_grader_image).
#
# One-shot, read-only role agent (grader_agent.py; BM_ROLE = extractor | grader |
# adjudicator) speaking the OpenAI-compatible API directly — a lean pure-Python
# image that builds fast.
#
# At RUN time the orchestrator launches this HARDENED (non-root, --cap-drop ALL,
# --security-opt no-new-privileges, read-only rootfs, no docker socket, only
# /docs (ro), /BDEF.md (ro), /schema.json (ro), /persona (ro) and /out (rw)
# mounted — the adjudicator instead gets /grades (ro) + /extraction.json (ro) —
# cpu/mem/pid caps) and attached to the per-job network. In air-gapped mode that
# network is --internal, so the container can reach ONLY the on-Spark model proxy.
FROM python:3.11-slim

RUN apt-get update && apt-get install -y --no-install-recommends \
        ca-certificates curl && \
    rm -rf /var/lib/apt/lists/*

# Non-root user matching the orchestrator's --user 1000:1000 (HOME=/home/rev,
# mounted as a writable tmpfs at run time).
RUN useradd -u 1000 -m -d /home/rev -s /bin/bash reviewer || true

COPY grader_agent.py /opt/boardroom/grader_agent.py

WORKDIR /out
ENV PYTHONUNBUFFERED=1
# grader_agent.py uses only the Python stdlib (urllib) — no pip deps to install.
ENTRYPOINT ["python3", "/opt/boardroom/grader_agent.py"]