FROM debian:bookworm-slim
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
      bash ca-certificates coreutils curl iproute2 ipset iptables netbase nftables python3 util-linux \
    && rm -rf /var/lib/apt/lists/*
# The harness masks /etc. Debian's public xtables links normally traverse
# /etc/alternatives, so resolve them while that directory is still visible.
RUN set -eu; for tool in iptables iptables-save iptables-restore ip6tables ip6tables-save ip6tables-restore; do \
      binary="$(readlink -f "$(command -v "$tool")")"; \
      test -x "$binary"; \
      case "$binary" in /etc/*) exit 1;; esac; \
      ln -sf "$binary" "/usr/sbin/$tool"; \
      test "$(readlink -f "/usr/sbin/$tool")" = "$binary"; \
    done
WORKDIR /work
# Public protocol/service name databases only; never copy the runner's /etc.
RUN mkdir helper-etc && cp /etc/protocols /etc/services helper-etc/
# COPY makes this work with a remote Docker daemon; no runner path is mounted.
COPY apps/api/src/agent-scripts/evofw-firewall.sh apps/api/src/agent-scripts/evofw-firewall.sh
COPY scripts/ci/linux-netns-smoke.sh scripts/ci/linux-agent-fixture.py scripts/ci/linux-agent-fixture.test.py scripts/ci/linux-agent-container-entry.sh scripts/ci/
RUN bash -n scripts/ci/linux-netns-smoke.sh scripts/ci/linux-agent-container-entry.sh \
    && python3 -B scripts/ci/linux-agent-fixture.test.py
ENTRYPOINT ["bash", "scripts/ci/linux-agent-container-entry.sh"]