#!/usr/bin/env sh
# Run from the checkout root. Build context is sent to Docker, never bind-mounted.
set -eu
command -v docker >/dev/null
[ "$(docker info --format '{{.OSType}}')" = linux ] || { echo 'A Linux Docker daemon is required for the agent namespace smoke' >&2; exit 1; }
tmp="$(mktemp -d)"
name="evofw-linux-smoke-${GITHUB_RUN_ID:-local}-${GITHUB_RUN_ATTEMPT:-1}-$$"
image=''
cleanup() {
  result=$?
  trap - EXIT HUP INT TERM
  docker rm -f "$name" >/dev/null 2>&1 || true
  if [ -n "$image" ]; then docker image rm "$image" >/dev/null 2>&1 || true; fi
  rm -rf "$tmp"
  exit "$result"
}
trap cleanup EXIT
trap 'exit 129' HUP
trap 'exit 130' INT
trap 'exit 143' TERM
docker build --file scripts/ci/linux-agent-smoke.Dockerfile --iidfile "$tmp/image-id" .
image="$(cat "$tmp/image-id")"
printf '%s\n' "$image" | grep -Eq '^sha256:[0-9a-f]{64}$' || { echo 'Missing immutable helper image ID' >&2; exit 1; }
set -- docker run --rm --name "$name" --network none \
  --cap-drop ALL --cap-add SYS_ADMIN --cap-add NET_ADMIN --cap-add NET_RAW \
  --security-opt no-new-privileges:true \
  --read-only --tmpfs /tmp:rw,nosuid,nodev,noexec,size=64m \
  --pids-limit 256 --cpus 2 --memory 512m
# docker-default AppArmor denies the mount operations used by unshare/ip-netns.
# Only this disposable, networkless helper gets the mount-capable exception.
# libxt_set opens an AF_INET/SOCK_RAW/IPPROTO_RAW socket to query ipset;
# NET_RAW permits that query inside the isolated helper network namespace.
# Default seccomp remains enabled and adapts to the granted capabilities.
security="$(docker info --format '{{json .SecurityOptions}}')"
if printf '%s' "$security" | grep -q apparmor; then
  set -- "$@" --security-opt apparmor=unconfined
fi
set -- "$@" "$image"
"$@"