FROM mcr.microsoft.com/playwright:v1.52.0-noble

RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        jq \
        unzip \
        wget \
        python3-pip \
        libzbar0 \
        libzbar-dev \
    && rm -rf /var/lib/apt/lists/*

# Install Bitwarden CLI — native Rust binary (no Node.js/npm)
# Same CLI interface as the npm package but zero runtime dependencies.
ARG BW_CLI_VERSION=2026.7.0
RUN wget -q -O /tmp/bw.zip \
        "https://github.com/bitwarden/clients/releases/download/cli-v${BW_CLI_VERSION}/bw-linux-${BW_CLI_VERSION}.zip" && \
    unzip -o /tmp/bw.zip -d /usr/local/bin/ && \
    chmod +x /usr/local/bin/bw && \
    rm /tmp/bw.zip

# Install Python dependencies
COPY requirements.txt /tmp/
RUN python3 -m pip install --no-cache-dir --break-system-packages -r /tmp/requirements.txt

# Create non-root user for Playwright
RUN groupadd -r provision && useradd -r -g provision -G audio,video -m -d /home/provision provision \
    && mkdir -p "/home/provision/.config/Bitwarden CLI" \
    && chown -R provision:provision /home/provision

WORKDIR /app
COPY . .
RUN chown -R provision:provision /app

USER provision

ENTRYPOINT ["python3", "/app/provision-agent.py"]