Dockerfile.claude

# Claude Code dev-container for developing Receiptory in place on a NAS (e.g. UNRAID).
#
# This is NOT the application image (that's ./Dockerfile). It's a lightweight
# sidecar that carries the Claude Code CLI plus a few dev tools, and bind-mounts
# the repo so you can edit/build/fix the app without installing anything on the
# UNRAID host (whose root filesystem is reset on every reboot).
#
# Build & run: see docs/claude-code-on-unraid.md or docker-compose.claude.yml.

FROM node:24-bookworm

# Dev tools for the Claude Code CLI.
# jq: required by gstack skills for JSONL task artifacts, review-log, and the
# review-readiness dashboard; without it those writes silently no-op.
RUN apt-get update && apt-get install -y --no-install-recommends \
      git \
      ripgrep \
      less \
      ca-certificates \
      curl \
      jq \
    && rm -rf /var/lib/apt/lists/*

# Docker CLI + Compose v2 plugin ONLY (no daemon) from Docker's official repo.
# These drive the *host* daemon via the mounted /var/run/docker.sock so Claude can
# rebuild/restart the app with `docker compose up -d --build`. docker-ce-cli pulls
# no dockerd; the compose/buildx plugins are what make `docker compose` available
# (the Debian `docker.io` package does not ship the Compose v2 plugin).
RUN install -m 0755 -d /etc/apt/keyrings \
    && curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc \
    && chmod a+r /etc/apt/keyrings/docker.asc \
    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian bookworm stable" \
       > /etc/apt/sources.list.d/docker.list \
    && apt-get update \
    && apt-get install -y --no-install-recommends \
         docker-ce-cli \
         docker-compose-plugin \
         docker-buildx-plugin \
    && rm -rf /var/lib/apt/lists/*

# GitHub CLI — used for PR review/create and as git credential helper (gh auth setup-git).
RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
        -o /usr/share/keyrings/githubcli-archive-keyring.gpg \
    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
       > /etc/apt/sources.list.d/github-cli.list \
    && apt-get update \
    && apt-get install -y --no-install-recommends gh \
    && rm -rf /var/lib/apt/lists/*

# Chromium system libraries for gstack's browser skills (/browse, /qa,
# /design-review). gstack's `./setup` downloads the Playwright Chromium binary
# into $HOME/.cache (a persistent mount, so it survives rebuilds), but the
# shared libs it links against live in the image layer and must be baked in
# here — otherwise Chromium fails to launch with "libnspr4.so: cannot open
# shared object file". This is Playwright's chromium dependency set for Debian
# 12 (equivalent to `playwright install-deps chromium`).
RUN apt-get update && apt-get install -y --no-install-recommends \
      libnss3 \
      libnspr4 \
      libatk1.0-0 \
      libatk-bridge2.0-0 \
      libatspi2.0-0 \
      libcups2 \
      libdbus-1-3 \
      libdrm2 \
      libgbm1 \
      libxcomposite1 \
      libxdamage1 \
      libxfixes3 \
      libxrandr2 \
      libxkbcommon0 \
      libasound2 \
      libpango-1.0-0 \
      libcairo2 \
      fonts-liberation \
    && rm -rf /var/lib/apt/lists/*

# claude-code CLI + bun. bun is the JS runtime several gstack skill scripts
# shell out to (e.g. gstack-review-log validates JSON via `bun -e`, gstack-
# learnings-log runs under bun); without it those writes silently no-op.
RUN npm install -g @anthropic-ai/claude-code bun

# The repo is bind-mounted and owned by the host user (e.g. UNRAID's nobody:users,
# 99:100), while this container runs as root. Without this, git 2.39 refuses to
# operate on it with "fatal: detected dubious ownership", which breaks Claude Code.
RUN git config --system --add safe.directory '*'

RUN printf '#!/bin/sh\nexec claude --dangerously-skip-permissions --continue "$@"\n' \
    > /usr/local/bin/claude-yolo && chmod +x /usr/local/bin/claude-yolo

WORKDIR /workspace

# Entrypoint: wire gh as git credential helper if GH_TOKEN is present, then hand off.
RUN printf '#!/bin/sh\nif [ -n "$GH_TOKEN" ]; then\n  gh auth setup-git\nfi\nexec "$@"\n' \
    > /usr/local/bin/entrypoint.sh && chmod +x /usr/local/bin/entrypoint.sh

ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

# Keep the container alive; you interact via `docker exec -it claude-dev claude`.
CMD ["sleep", "infinity"]