# Pre-built binary in (this directory)/build/sandbox-stub-linux-amd64.
# We cross-compile on the host (Apple Silicon -> linux/amd64) instead of
# running `go build` inside an emulated amd64 container, which crashes Go's
# runtime (lfstack.push fatal) under QEMU/Rosetta.
#
# Build script:
#   GOOS=linux GOARCH=amd64 CGO_ENABLED=0 \
#     go build -trimpath -ldflags="-s -w" -o build/sandbox-stub-linux-amd64 ./...
#   docker buildx build --platform linux/amd64 \
#     -t us-central1-docker.pkg.dev/neuron-785695/neuron-sandbox/sandbox:initial \
#     --push .

FROM gcr.io/distroless/static-debian12:nonroot
COPY build/sandbox-stub-linux-amd64 /sandbox-stub
EXPOSE 8080
USER nonroot:nonroot
ENTRYPOINT ["/sandbox-stub"]