# The task image plus OpenSandbox's execd. execd is the container's main process;
# it refuses to start without a per-sandbox token (EXECD_ACCESS_TOKEN, set by the
# bridge at start), so a container Cloudflare restarts on its own is never open.
# --graceful-shutdown-timeout 50ms: execd v1.1.0 otherwise holds every command's
# response open for 1 s (for an egress sidecar this deployment does not run).
# Build context: copy the static execd binary here first (see README).
ARG BASE_IMAGE=ubuntu:24.04
FROM ${BASE_IMAGE}
COPY execd /opt/opensandbox/execd
RUN chmod 755 /opt/opensandbox/execd
EXPOSE 44772
ENTRYPOINT ["/bin/sh", "-c", "test -n \"$EXECD_ACCESS_TOKEN\" || { echo 'EXECD_ACCESS_TOKEN not set; refusing to start' >&2; exit 1; }; exec /opt/opensandbox/execd --port 44772 --graceful-shutdown-timeout 50ms"]
