init: Coder compose + templates + act-runner

coder/templates/mcp-sandbox/Dockerfile

@@ -0,0 +1,39 @@
+FROM ghcr.io/astral-sh/uv:bookworm-slim
+
+ARG PY_VERSION=3.13
+
+# minimal OS deps: external network tools + ca-certs + a shell-friendly setup
+RUN apt-get update -qq \
+ && apt-get install -y --no-install-recommends \
+        curl wget ca-certificates sudo git openssh-client \
+        bash less procps file \
+ && rm -rf /var/lib/apt/lists/*
+
+# install pinned-but-current Python via uv (rebuild image to bump)
+RUN uv python install --default ${PY_VERSION}
+
+# create a managed venv and put it on PATH so `python`/`pip` are the sandbox's
+ENV VIRTUAL_ENV=/opt/venv \
+    PATH=/opt/venv/bin:/root/.local/bin:${PATH}
+RUN uv venv --python ${PY_VERSION} /opt/venv
+
+# sci/plotting stack — installed once into /opt/venv
+RUN uv pip install --no-cache \
+        numpy \
+        pandas \
+        matplotlib \
+        plotly \
+        seaborn \
+        scipy \
+        scikit-learn \
+        requests \
+        httpx \
+        ipython \
+ && python -c "import numpy, pandas, matplotlib, scipy, sklearn, plotly, seaborn; print('sci stack OK')"
+
+# non-root sandbox user
+RUN useradd -m -s /bin/bash -u 1000 coder \
+ && echo "coder ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/coder
+
+USER coder
+WORKDIR /home/coder