FROM ghcr.io/astral-sh/uv:bookworm-slim

ARG PY_VERSION=3.13

# minimal OS deps: external network tools + ca-certs + a shell-friendly setup
RUN apt-get update -qq \
 && apt-get install -y --no-install-recommends \
        curl wget ca-certificates sudo git openssh-client \
        bash less procps file \
 && rm -rf /var/lib/apt/lists/*

# install pinned-but-current Python via uv (rebuild image to bump)
RUN uv python install --default ${PY_VERSION}

# create a managed venv and put it on PATH so `python`/`pip` are the sandbox's
ENV VIRTUAL_ENV=/opt/venv \
    PATH=/opt/venv/bin:/root/.local/bin:${PATH}
RUN uv venv --python ${PY_VERSION} /opt/venv

# sci/plotting stack — installed once into /opt/venv
RUN uv pip install --no-cache \
        numpy \
        pandas \
        matplotlib \
        plotly \
        seaborn \
        scipy \
        scikit-learn \
        requests \
        httpx \
        ipython \
 && python -c "import numpy, pandas, matplotlib, scipy, sklearn, plotly, seaborn; print('sci stack OK')"

# non-root sandbox user
RUN useradd -m -s /bin/bash -u 1000 coder \
 && echo "coder ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/coder

USER coder
WORKDIR /home/coder