FROM ubuntu:24.04

ARG DEBIAN_FRONTEND=noninteractive
# Match the host user so files written to mounted volumes keep the right owner.
ARG USER_NAME=re
ARG USER_UID=1000
ARG USER_GID=1000

# Fingerprint of Anthropic's apt signing key, from the official install docs:
# https://code.claude.com/docs/en/desktop-linux
ARG ANTHROPIC_APT_FPR=31DDDE24DDFAB679F42D7BD2BAA929FF1A7ECACE

RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates curl gnupg \
 && rm -rf /var/lib/apt/lists/*

# Add Anthropic's apt repository and refuse to continue if the key is wrong.
RUN curl -fsSLo /usr/share/keyrings/claude-desktop-archive-keyring.asc \
        https://downloads.claude.ai/claude-desktop/key.asc \
 && gpg --show-keys --with-colons /usr/share/keyrings/claude-desktop-archive-keyring.asc \
        | grep -q "^fpr:::::::::${ANTHROPIC_APT_FPR}:" \
 && echo "deb [arch=amd64,arm64 signed-by=/usr/share/keyrings/claude-desktop-archive-keyring.asc] https://downloads.claude.ai/claude-desktop/apt/stable stable main" \
        > /etc/apt/sources.list.d/claude-desktop.list

# Recommends are skipped: they pull in QEMU/OVMF for Cowork, which needs KVM
# and isn't useful in this container. No keyring is installed: sign-in is not
# kept between runs. x11-utils provides the display check tools.
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
        claude-desktop \
        x11-utils \
        xauth \
        fonts-dejavu-core \
 && rm -rf /var/lib/apt/lists/*

# Ubuntu 24.04 ships a default "ubuntu" user on UID 1000; replace it.
RUN if id ubuntu >/dev/null 2>&1; then userdel -r ubuntu; fi \
 && groupadd -g "${USER_GID}" "${USER_NAME}" \
 && useradd -m -u "${USER_UID}" -g "${USER_GID}" -s /bin/bash "${USER_NAME}"

USER ${USER_NAME}
WORKDIR /home/${USER_NAME}

# No keyring: tell Electron not to look for one. Session data lives only in
# the container's filesystem, which is discarded on exit (run with --rm), so
# the user signs in on every start.
# --no-sandbox: Docker's default seccomp profile blocks the namespaces
# Chromium's sandbox needs, so the zygote dies on start. The container's own
# seccomp/namespaces stay in place as the boundary to the host instead.
CMD ["claude-desktop", "--password-store=basic", "--no-sandbox"]