#!/usr/bin/env bash
# Run inside the Atlox container. Only credential-free installed tool assets enter the image.
set -euo pipefail
[[ $(id -u) == 0 ]] || { echo 'Run with sudo inside Atlox' >&2; exit 1; }
cd "$(dirname "$0")/.."
build_dir=${1:-/var/lib/atlox-image-build/dev2}
[[ $build_dir == /var/lib/atlox-image-build/* && ! -e $build_dir ]] || { echo 'Use a new image build directory' >&2; exit 1; }
[[ $(node --version) == v26.10.0 ]]
[[ $(/opt/runtime/codex/bin/codex --version) == 'codex-cli 0.160.0' ]]
[[ $(/usr/local/bin/grok --version) == 'grok 1.0.46 (2765805b9442)' ]]
mkdir -p "$build_dir/rootfs"
docker build --network=host -t atlox-firecracker-base:compose-v1 infra/firecracker
image_container=$(docker create atlox-firecracker-base:compose-v1)
trap 'docker rm "$image_container" >/dev/null' EXIT
docker export "$image_container" | tar --numeric-owner -xp -C "$build_dir/rootfs"
rootfs=$build_dir/rootfs
# Docker markers make systemd skip VM filesystem shutdown/sync.
rm -f "$rootfs/.dockerenv" "$rootfs/run/.containerenv" "$rootfs/run/systemd/container"
install -m755 /usr/local/bin/node /usr/local/bin/grok "$rootfs/usr/local/bin/"
mkdir -p "$rootfs/opt/runtime" "$rootfs/usr/local/lib/node_modules" "$rootfs/opt/playwright/node_modules" "$rootfs/opt/playwright/browsers"
cp -a /opt/runtime/codex "$rootfs/opt/runtime/"
cp -a /usr/local/lib/node_modules/npm "$rootfs/usr/local/lib/node_modules/"
ln -s ../lib/node_modules/npm/bin/npm-cli.js "$rootfs/usr/local/bin/npm"
ln -s ../lib/node_modules/npm/bin/npx-cli.js "$rootfs/usr/local/bin/npx"
ln -s /opt/runtime/codex/bin/codex "$rootfs/usr/local/bin/codex"
cp -a node_modules/.pnpm/playwright-core@1.63.0/node_modules/playwright-core "$rootfs/opt/playwright/node_modules/"
cp -a /home/agent/.cache/ms-playwright/chromium-1243 /home/agent/.cache/ms-playwright/chromium_headless_shell-1243 "$rootfs/opt/playwright/browsers/"
chown -R root:root "$rootfs/opt/playwright" "$rootfs/opt/runtime" "$rootfs/usr/local/lib"
printf 'PLAYWRIGHT_BROWSERS_PATH=/opt/playwright/browsers\n' > "$rootfs/etc/environment"
printf 'nameserver 1.1.1.1\nnameserver 8.8.8.8\n' > "$rootfs/etc/resolv.conf"
find "$rootfs/usr/local/bin" "$rootfs/opt/runtime" -type f -exec sha256sum {} + | sed "s|$rootfs||" > "$build_dir/tool-sha256.txt"
truncate -s 16G "$build_dir/ubuntu.ext4"
mkfs.ext4 -q -F -L atlox-sandbox -d "$rootfs" "$build_dir/ubuntu.ext4"
sha256sum "$build_dir/ubuntu.ext4" > "$build_dir/image-sha256.txt"
printf 'Image: %s\n' "$build_dir/ubuntu.ext4"