"runArgs": [
  "--cap-drop=ALL",                              // Drop all capabilities first
  "--cap-add=NET_ADMIN",                         // Required for iptables/sysctl
  "--cap-add=NET_RAW",                           // Required for packet filtering
  "--cap-add=SETUID",                            // Required for sudo operations
  "--cap-add=SETGID",                            // Required for group switching
  "--cap-add=SYS_ADMIN",                         // Required for kernel parameters
  "--sysctl=net.ipv6.conf.all.disable_ipv6=1",   // Layer 1: IPv6 at creation
  "--sysctl=net.ipv6.conf.default.disable_ipv6=1",
  "--sysctl=net.ipv6.conf.lo.disable_ipv6=1"
],
"postStartCommand": "sudo /usr/local/bin/init-firewall.sh"

#!/bin/bash
set -euo pipefail
IFS=$'\n\t'

STATE_FILE="/var/lib/firewall-configured"

# Disable IPv6 to prevent bypass
echo "Disabling IPv6..."
sysctl -w net.ipv6.conf.all.disable_ipv6=1 >/dev/null 2>&1 || true
sysctl -w net.ipv6.conf.default.disable_ipv6=1 >/dev/null 2>&1 || true
sysctl -w net.ipv6.conf.lo.disable_ipv6=1 >/dev/null 2>&1 || true

# Check if already configured
if [ -f "$STATE_FILE" ]; then
    echo "Firewall already configured, skipping..."
    exit 0
fi

echo "Starting firewall configuration..."

# Initialize DNS resolution statistics
TOTAL_DOMAINS=0
RESOLVED_DOMAINS=0
FAILED_DOMAINS=0

# Extract Docker DNS before flushing
DOCKER_DNS_RULES=$(iptables-save -t nat | grep "127\.0\.0\.11" || true)

# Detect Docker networks
echo "Detecting Docker networks..."
DOCKER_NETWORKS=$(ip -o -f inet addr show | grep -v "127.0.0.1" | awk '{print $4}')

if [ -z "$DOCKER_NETWORKS" ]; then
    echo "ERROR: Failed to detect Docker networks"
    exit 1
fi

# Create ipset for allowed domains
ipset destroy allowed-domains 2>/dev/null || true
ipset create allowed-domains hash:net

# Fetch GitHub IP ranges
echo "Fetching GitHub IP ranges..."
gh_ranges=$(curl -s https://api.github.com/meta)
if [ -z "$gh_ranges" ]; then
    echo "ERROR: Failed to fetch GitHub IP ranges"
    exit 1
fi

echo "Processing GitHub IPs..."
while read -r cidr; do
    echo "Adding GitHub range $cidr"
    ipset add allowed-domains "$cidr" -exist
done < <(echo "$gh_ranges" | jq -r '(.web + .api + .git)[]' | aggregate -q)

# Add Anthropic IP ranges (official published ranges)
echo "Adding Anthropic IP ranges..."
echo "Adding Anthropic CIDR range 160.79.104.0/23"
ipset add allowed-domains "160.79.104.0/23" -exist

# Add Anthropic specific IP addresses
for ip in "34.162.46.92" "34.162.102.82" "34.162.136.91" "34.162.142.92" "34.162.183.95"; do
    echo "Adding Anthropic IP $ip"
    ipset add allowed-domains "$ip" -exist
done

# Fetch and add Google Cloud/API IP ranges
echo "Fetching Google Cloud/API IP ranges..."
goog_ranges=$(curl -s https://www.gstatic.com/ipranges/goog.json)
if [ -z "$goog_ranges" ]; then
    echo "ERROR: Failed to fetch Google IP ranges"
    exit 1
fi

echo "Processing Google IPs..."
while read -r cidr; do
    echo "Adding Google range $cidr"
    ipset add allowed-domains "$cidr" -exist
done < <(echo "$goog_ranges" | jq -r '.prefixes[].ipv4Prefix | select(. != null)')

# Fetch and add Cloudflare CDN IP ranges
echo "Fetching Cloudflare CDN IP ranges..."
cf_ranges=$(curl -s https://api.cloudflare.com/client/v4/ips)
if [ -z "$cf_ranges" ]; then
    echo "ERROR: Failed to fetch Cloudflare IP ranges"
    exit 1
fi

echo "Processing Cloudflare IPs..."
while read -r cidr; do
    echo "Adding Cloudflare range $cidr"
    ipset add allowed-domains "$cidr" -exist
done < <(echo "$cf_ranges" | jq -r '.result.ipv4_cidrs[]')

# Fetch and add AWS IP ranges (covers many AI services: Hugging Face, Replicate, etc.)
# Filtered for US East/West regions and EC2/CloudFront services only to limit allowlist size
echo "Fetching AWS IP ranges..."
aws_ranges=$(curl -s https://ip-ranges.amazonaws.com/ip-ranges.json)
if [ -z "$aws_ranges" ]; then
    echo "ERROR: Failed to fetch AWS IP ranges"
    exit 1
fi

echo "Processing AWS IPs (US regions: us-east-1, us-west-2; Services: EC2, CLOUDFRONT)..."
while read -r cidr; do
    echo "Adding AWS range $cidr"
    ipset add allowed-domains "$cidr" -exist
done < <(echo "$aws_ranges" | jq -r '.prefixes[] | select(.region == "us-east-1" or .region == "us-west-2") | select(.service == "EC2" or .service == "CLOUDFRONT") | .ip_prefix' | aggregate -q)

# Resolve and add allowed domains (defense-in-depth: includes DNS backup for services above)
for domain in \
    "dns.google" \
    "1.1.1.1" \
    "8.8.8.8" \
    "8.8.4.4" \
    "auth.openai.com" \
    "chatgpt.com" \
    "context7.com" \
    "unpkg.com" \
    "cdn.jsdelivr.net" \
    "cdnjs.cloudflare.com" \
    "github.com" \
    "api.github.com" \
    "raw.githubusercontent.com" \
    "github.githubassets.com" \
    "collector.github.com" \
    "ghcr.io" \
    "pkg-containers.githubusercontent.com" \
    "nodejs.org" \
    "registry.npmjs.org" \
    "pypi.org" \
    "files.pythonhosted.org" \
    "astral.sh" \
    "bun.sh" \
    "crates.io" \
    "static.crates.io" \
    "index.crates.io" \
    "docker.io" \
    "registry-1.docker.io" \
    "auth.docker.io" \
    "production.cloudflare.docker.com" \
    "api.anthropic.com" \
    "api.openai.com" \
    "aistudio.google.com" \
    "accounts.google.com" \
    "oauth2.googleapis.com" \
    "www.googleapis.com" \
    "storage.googleapis.com" \
    "content.googleapis.com" \
    "generativelanguage.googleapis.com" \
    "sentry.io" \
    "statsig.anthropic.com" \
    "statsig.com" \
    "marketplace.visualstudio.com" \
    "vscode.blob.core.windows.net" \
    "update.code.visualstudio.com" \
    "docs.mcp.cloudflare.com" \
    "mcp.context7.com" \
    "vercel.com" \
    "ui.shadcn.com" \
    "tailwindcss.com" \
    "radix-ui.com" \
    "react.dev" \
    "reactjs.org" \
    "esm.sh" \
    "lucide.dev" \
    "openrouter.ai" \
    "api.cerebras.ai" "inference.cerebras.ai" "cloud.cerebras.ai" "cerebras.ai" \
    "dashscope.aliyuncs.com" "qwen.ai" "qwenlm.ai" "aliyuncs.com" "alibabacloud.com" \
    "cn-hangzhou.aliyuncs.com" "us-west-1.aliyuncs.com" "ap-southeast-1.aliyuncs.com" \
    "api.minimax.chat" "minimax.chat" \
    "z.ai" \
    "api.cohere.ai" "cohere.ai" \
    "api.together.xyz" "together.xyz" \
    "api.replicate.com" "replicate.com" \
    "api-inference.huggingface.co" "huggingface.co" \
    "api.perplexity.ai" "perplexity.ai" \
    "api.mistral.ai" "mistral.ai" \
    "api.deepinfra.com" "deepinfra.com" \
    "api.fireworks.ai" "fireworks.ai" \
    "api.groq.com" "groq.com" \
    "api.lepton.ai" "lepton.ai" \
    "mancer.tech" "api.mancer.tech" \
    "api.deepseek.com" "deepseek.com" \
    "api.lingyiwanwu.com" "platform.lingyiwanwu.com"; do

    # Check if IP address
    if [[ "$domain" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
        echo "Adding IP $domain"
        ipset add allowed-domains "$domain" -exist
        continue
    fi

    # Resolve hostname with graceful error handling
    TOTAL_DOMAINS=$((TOTAL_DOMAINS + 1))
    echo "Resolving $domain..."
    ips=$(dig +noall +answer A "$domain" | awk '$4 == "A" {print $5}')
    if [ -z "$ips" ]; then
        echo "WARNING: Failed to resolve $domain (continuing...)"
        FAILED_DOMAINS=$((FAILED_DOMAINS + 1))
        continue
    fi

    # Successfully resolved, add IPs to allowlist
    domain_resolved=false
    while read -r ip; do
        if [[ ! "$ip" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
            echo "WARNING: Invalid IP from DNS for $domain: $ip (skipping)"
            continue
        fi
        echo "Adding $ip for $domain"
        ipset add allowed-domains "$ip" -exist
        domain_resolved=true
    done < <(echo "$ips")

    # Count as resolved only if at least one valid IP was added
    if [ "$domain_resolved" = true ]; then
        RESOLVED_DOMAINS=$((RESOLVED_DOMAINS + 1))
    else
        FAILED_DOMAINS=$((FAILED_DOMAINS + 1))
    fi
done

echo ""
echo "IP allowlist built successfully"
echo "DNS Resolution Summary: ${RESOLVED_DOMAINS}/${TOTAL_DOMAINS} domains resolved successfully"
if [ "$FAILED_DOMAINS" -gt 0 ]; then
    echo "  WARNING: ${FAILED_DOMAINS} domains failed to resolve"
fi
echo ""

# Flush iptables
echo "Flushing iptables..."
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X

# Restore Docker DNS
if [ -n "$DOCKER_DNS_RULES" ]; then
    echo "Restoring Docker DNS..."
    iptables -t nat -N DOCKER_OUTPUT 2>/dev/null || true
    iptables -t nat -N DOCKER_POSTROUTING 2>/dev/null || true
    echo "$DOCKER_DNS_RULES" | xargs -L 1 iptables -t nat
fi

# Configure base rules
echo "Configuring base rules..."
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --sport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow Docker networks
echo "Allowing Docker networks..."
while read -r network; do
    echo "  Allowing: $network"
    iptables -A INPUT -s "$network" -j ACCEPT
    iptables -A OUTPUT -d "$network" -j ACCEPT
done < <(echo "$DOCKER_NETWORKS")

# Set default-deny policies
echo "Setting default-deny policies..."
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow whitelisted domains
iptables -A OUTPUT -m set --match-set allowed-domains dst -j ACCEPT

# Reject all other traffic
iptables -A OUTPUT -j REJECT --reject-with icmp-admin-prohibited

# Configure IPv6 firewall rules (Layer 3 - Defense-in-depth)
echo "Configuring IPv6 firewall rules..."
ip6tables -P INPUT DROP 2>/dev/null || echo "  Note: IPv6 may already be disabled"
ip6tables -P FORWARD DROP 2>/dev/null || true
ip6tables -P OUTPUT DROP 2>/dev/null || true
ip6tables -A INPUT -i lo -j ACCEPT 2>/dev/null || true
ip6tables -A OUTPUT -o lo -j ACCEPT 2>/dev/null || true
ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || true
ip6tables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || true
ip6tables -A INPUT -j REJECT 2>/dev/null || true
ip6tables -A OUTPUT -j REJECT 2>/dev/null || true
echo "IPv6 firewall rules configured"

echo ""
echo "Firewall configuration complete!"
echo ""

# Verify firewall
echo "Verifying firewall..."

# Check IPv6 disabled (warning only, not fatal)
if sysctl net.ipv6.conf.all.disable_ipv6 | grep -q "= 1"; then
    echo "✓ IPv6 disabled"
else
    echo "⚠ WARNING: IPv6 is still enabled (container restrictions may prevent disabling)"
    echo "  IPv6 traffic will be blocked by ip6tables rules as a security fallback"
    echo "  This is expected in some Docker environments and does not affect security"
fi

# Check blocked domains
if curl --connect-timeout 5 https://example.com >/dev/null 2>&1; then
    echo "✗ Firewall failed - can reach example.com"
    exit 1
else
    echo "✓ Blocked example.com as expected"
fi

# Check allowed domains
if ! curl --connect-timeout 5 https://api.github.com/zen >/dev/null 2>&1; then
    echo "✗ Cannot reach api.github.com"
    exit 1
else
    echo "✓ Can reach api.github.com as expected"
fi

# Verify OpenRouter API access
if ! curl --connect-timeout 5 https://openrouter.ai/api/v1/models >/dev/null 2>&1; then
    echo "✗ Cannot reach OpenRouter"
    exit 1
else
    echo "✓ Can reach OpenRouter as expected"
fi

# Verify Cerebras API access
if ! curl --connect-timeout 5 https://api.cerebras.ai/v1/models >/dev/null 2>&1; then
    echo "✗ Cannot reach Cerebras"
    exit 1
else
    echo "✓ Can reach Cerebras as expected"
fi

# Mark as configured
touch "$STATE_FILE"
echo "Firewall configured successfully!"

# Copy firewall script
COPY init-firewall.sh /usr/local/bin/

# Set permissions and configure sudoers
RUN chmod +x /usr/local/bin/init-firewall.sh && \
    echo "node ALL=(root) NOPASSWD: /usr/local/bin/init-firewall.sh" > /etc/sudoers.d/node-firewall && \
    chmod 0440 /etc/sudoers.d/node-firewall

mkdir -p .devcontainer
cd .devcontainer

{
  "name": "React Dev Container",
  "build": {
    "dockerfile": "Dockerfile"
  },
  "customizations": {
    "vscode": {
      "extensions": [
        "anthropic.claude-code",
        "dbaeumer.vscode-eslint",
        "esbenp.prettier-vscode",
        "bradlc.vscode-tailwindcss"
      ],
      "settings": {
        "editor.formatOnSave": true,
        "editor.defaultFormatter": "esbenp.prettier-vscode"
      }
    }
  },
  "runArgs": [
    "--cap-drop=ALL",
    "--cap-add=NET_ADMIN",
    "--cap-add=NET_RAW",
    "--cap-add=SETUID",
    "--cap-add=SETGID",
    "--cap-add=SYS_ADMIN",
    "--sysctl=net.ipv6.conf.all.disable_ipv6=1",
    "--sysctl=net.ipv6.conf.default.disable_ipv6=1",
    "--sysctl=net.ipv6.conf.lo.disable_ipv6=1"
  ],
  "forwardPorts": [3000, 5173],
  "postCreateCommand": "npm install -g @anthropic-ai/claude-code@latest && npm install -g @openai/codex && npm install -g @google/gemini-cli && npm install -g wrangler@latest && npm install -g vercel@latest && npm install && /usr/local/bin/init-claude-hooks.sh",
  "postStartCommand": "sudo /usr/local/bin/init-claude-config.sh && sudo /usr/local/bin/init-firewall.sh",
  "remoteUser": "node",
  "mounts": [
    "source=claude-code-bashhistory-${devcontainerId},target=/commandhistory,type=volume",
    "source=claude-config-${devcontainerId},target=/home/node/.claude,type=volume",
    "source=codex-config-${devcontainerId},target=/home/node/.codex,type=volume",
    "source=gemini-config-${devcontainerId},target=/home/node/.gemini,type=volume",
    "source=opencode-config-${devcontainerId},target=/home/node/.opencode,type=volume",
    "source=ghub-config-${devcontainerId},target=/home/node/.config/gh,type=volume",
    "source=npm-global-${devcontainerId},target=/home/node/.npm-global,type=volume",
    "source=cargo-${devcontainerId},target=/home/node/.cargo,type=volume",
    "source=bun-${devcontainerId},target=/home/node/.bun,type=volume",
    "source=local-bin-${devcontainerId},target=/home/node/.local,type=volume",
    "source=aws-config-${devcontainerId},target=/home/node/.aws,type=volume",
    "source=wrangler-config-${devcontainerId},target=/home/node/.wrangler,type=volume",
    "source=vercel-config-${devcontainerId},target=/home/node/.vercel,type=volume"
  ]
}

# Start from Node.js 22 base image
FROM node:22

# Install essential tools and firewall dependencies
RUN apt-get update && apt-get install -y \
    git \
    curl \
    iptables \
    ipset \
    dnsutils \
    aggregate \
    jq \
    sudo \
    && rm -rf /var/lib/apt/lists/*

# npm CLI packages (Claude Code, OpenCode, Codex, Gemini, Wrangler, Vercel) installed via postCreateCommand
# This ensures packages install AFTER npm-global volume mounts, preventing version conflicts
# See devcontainer.json postCreateCommand for installation details

# Create directory for Claude Code defaults
RUN mkdir -p /usr/local/share/claude-defaults

# Copy initialization scripts and templates
COPY init-firewall.sh /usr/local/bin/
COPY init-claude-config.sh /usr/local/bin/
COPY --chown=node:node settings.json.template /usr/local/share/claude-defaults/settings.json
COPY --chown=node:node mcp.json.template /usr/local/share/claude-defaults/mcp.json

# Set permissions and configure sudoers for both scripts
RUN chmod +x /usr/local/bin/init-firewall.sh && \
    chmod +x /usr/local/bin/init-claude-config.sh && \
    echo "node ALL=(root) NOPASSWD: /usr/local/bin/init-firewall.sh" > /etc/sudoers.d/node-firewall && \
    echo "node ALL=(root) NOPASSWD: /usr/local/bin/init-claude-config.sh" > /etc/sudoers.d/node-claude-config && \
    chmod 0440 /etc/sudoers.d/node-firewall && \
    chmod 0440 /etc/sudoers.d/node-claude-config

# Set working directory
WORKDIR /workspace

# Configure git (optional, for better commit messages)
RUN git config --global init.defaultBranch main

# Switch to non-root user for security
USER node

# Check Node.js version
node --version  # Should show v20.x.x

# Check npm version
npm --version

# Check Claude Code is installed
claude --version

# Start your React dev server
npm run dev  # or npm start

{
  "name": "Python Dev Container",
  "build": {
    "dockerfile": "Dockerfile"
  },
  "customizations": {
    "vscode": {
      "extensions": [
        "anthropic.claude-code",
        "ms-python.python",
        "ms-python.vscode-pylance",
        "ms-python.debugpy",
        "ms-python.black-formatter",
        "charliermarsh.ruff"
      ],
      "settings": {
        "python.defaultInterpreterPath": "/usr/local/bin/python",
        "python.linting.enabled": true,
        "python.formatting.provider": "black",
        "editor.formatOnSave": true
      }
    }
  },
  "runArgs": [
    "--cap-drop=ALL",
    "--cap-add=NET_ADMIN",
    "--cap-add=NET_RAW",
    "--cap-add=SETUID",
    "--cap-add=SETGID",
    "--cap-add=SYS_ADMIN",
    "--sysctl=net.ipv6.conf.all.disable_ipv6=1",
    "--sysctl=net.ipv6.conf.default.disable_ipv6=1",
    "--sysctl=net.ipv6.conf.lo.disable_ipv6=1"
  ],
  "forwardPorts": [5000, 8000],
  "postCreateCommand": "pip install -r requirements.txt && /usr/local/bin/init-claude-config.sh && /usr/local/bin/init-python.sh && /usr/local/bin/init-claude-hooks.sh",
  "postStartCommand": "sudo /usr/local/bin/init-firewall.sh",
  "remoteUser": "node",
  "mounts": [
    "source=claude-code-bashhistory-${devcontainerId},target=/commandhistory,type=volume",
    "source=claude-config-${devcontainerId},target=/home/node/.claude,type=volume",
    "source=codex-config-${devcontainerId},target=/home/node/.codex,type=volume",
    "source=gemini-config-${devcontainerId},target=/home/node/.gemini,type=volume",
    "source=opencode-config-${devcontainerId},target=/home/node/.opencode,type=volume",
    "source=ghub-config-${devcontainerId},target=/home/node/.config/gh,type=volume",
    "source=local-bin-${devcontainerId},target=/home/node/.local,type=volume"
  ]
}

# Start from Node.js 22 base (modern approach with Python 3.14 via uv)
FROM mcr.microsoft.com/devcontainers/javascript-node:22-bookworm

# Install system dependencies and firewall tools
RUN apt-get update && apt-get install -y \
    git \
    curl \
    build-essential \
    iptables \
    ipset \
    dnsutils \
    aggregate \
    jq \
    sudo \
    python3.11 \
    python3.11-dev \
    python3-pip \
    && rm -rf /var/lib/apt/lists/*

# Install uv (fast Python package manager)
# uv installer places binary at /home/node/.local/bin/uv
USER node
RUN curl -LsSf https://astral.sh/uv/install.sh | sh && \
    echo 'export PATH="$HOME/.local/bin:$PATH"' >> /home/node/.bashrc
ENV PATH="/home/node/.local/bin:$PATH"

# Switch back to root for system configuration
USER root

# Install Claude Code CLI
RUN curl -fsSL https://claude.ai/install.sh | bash

# Create directory for Claude Code defaults
RUN mkdir -p /usr/local/share/claude-defaults

# Copy initialization scripts and templates
COPY init-firewall.sh /usr/local/bin/
COPY init-claude-config.sh /usr/local/bin/
COPY init-python.sh /usr/local/bin/
COPY --chown=node:node settings.json.template /usr/local/share/claude-defaults/settings.json
COPY --chown=node:node mcp.json.template /usr/local/share/claude-defaults/mcp.json

# Set permissions and configure sudoers for scripts
RUN chmod +x /usr/local/bin/init-firewall.sh && \
    chmod +x /usr/local/bin/init-claude-config.sh && \
    chmod +x /usr/local/bin/init-python.sh && \
    echo "node ALL=(root) NOPASSWD: /usr/local/bin/init-firewall.sh" > /etc/sudoers.d/node-firewall && \
    echo "node ALL=(root) NOPASSWD: /usr/local/bin/init-claude-config.sh" > /etc/sudoers.d/node-claude-config && \
    echo "node ALL=(root) NOPASSWD: /usr/local/bin/init-python.sh" > /etc/sudoers.d/node-python && \
    chmod 0440 /etc/sudoers.d/node-firewall && \
    chmod 0440 /etc/sudoers.d/node-claude-config && \
    chmod 0440 /etc/sudoers.d/node-python

# Set working directory
WORKDIR /workspaces

# Switch to non-root user
USER node

# Set Python to unbuffered mode (better for logs)
ENV PYTHONUNBUFFERED=1

# NOTE: Python 3.14 is installed via init-python.sh in postCreateCommand
# This ensures installation persists in /home/node/.local volume

flask==3.0.0
python-dotenv==1.0.0
requests==2.31.0

fastapi==0.104.0
uvicorn[standard]==0.24.0
python-dotenv==1.0.0
pydantic==2.5.0

# Check Python version
python --version  # Should show Python 3.14.x

# Check pip version
pip --version

# Verify dependencies installed
pip list

# Run Flask app (example)
python app.py

# Or run FastAPI app (example)
uvicorn main:app --reload --host 0.0.0.0 --port 8000

{
  "name": "Advanced Python Dev Container",
  "build": {
    "dockerfile": "Dockerfile"
  },
  "customizations": {
    "vscode": {
      "extensions": [
        "anthropic.claude-code",
        "ms-python.python",
        "ms-python.vscode-pylance",
        "ms-python.debugpy",
        "ms-python.black-formatter",
        "charliermarsh.ruff"
      ],
      "settings": {
        "python.defaultInterpreterPath": "/usr/local/bin/python",
        "python.linting.enabled": true,
        "python.formatting.provider": "black",
        "editor.formatOnSave": true
      }
    }
  },
  "runArgs": [
    "--cap-drop=ALL",
    "--cap-add=NET_ADMIN",
    "--cap-add=NET_RAW",
    "--cap-add=SETUID",
    "--cap-add=SETGID",
    "--cap-add=SYS_ADMIN",
    "--sysctl=net.ipv6.conf.all.disable_ipv6=1",
    "--sysctl=net.ipv6.conf.default.disable_ipv6=1",
    "--sysctl=net.ipv6.conf.lo.disable_ipv6=1"
  ],
  "forwardPorts": [5000, 8000, 8888],
  "postCreateCommand": "uv pip install -r requirements.txt && /usr/local/bin/init-claude-config.sh && /usr/local/bin/init-python.sh && /usr/local/bin/init-claude-hooks.sh",
  "postStartCommand": "sudo /usr/local/bin/init-firewall.sh",
  "remoteUser": "node",
  "mounts": [
    "source=claude-code-bashhistory-${devcontainerId},target=/commandhistory,type=volume",
    "source=claude-config-${devcontainerId},target=/home/node/.claude,type=volume",
    "source=codex-config-${devcontainerId},target=/home/node/.codex,type=volume",
    "source=gemini-config-${devcontainerId},target=/home/node/.gemini,type=volume",
    "source=opencode-config-${devcontainerId},target=/home/node/.opencode,type=volume",
    "source=ghub-config-${devcontainerId},target=/home/node/.config/gh,type=volume",
    "source=cargo-${devcontainerId},target=/home/node/.cargo,type=volume",
    "source=bun-${devcontainerId},target=/home/node/.bun,type=volume",
    "source=local-bin-${devcontainerId},target=/home/node/.local,type=volume"
  ]
}

# Start from Node.js 22 base (modern approach with Python 3.14 via uv)
FROM mcr.microsoft.com/devcontainers/javascript-node:22-bookworm

# Install extended system dependencies (organized by category)
RUN apt-get update && apt-get install -y \
    # Version control
    git \
    git-lfs \
    # Core utilities
    curl \
    wget \
    ca-certificates \
    # Build tools for native extensions
    build-essential \
    gcc \
    g++ \
    make \
    cmake \
    pkg-config \
    # Development libraries (for data science, web scraping, crypto)
    libffi-dev \
    libssl-dev \
    libz-dev \
    libbz2-dev \
    libreadline-dev \
    libsqlite3-dev \
    libncurses5-dev \
    libncursesw5-dev \
    liblzma-dev \
    # Text processing and data tools
    jq \
    yq \
    sed \
    gawk \
    # Modern search tools (faster alternatives)
    ripgrep \
    fd-find \
    # System utilities
    htop \
    tree \
    procps \
    # Network tools
    net-tools \
    iputils-ping \
    dnsutils \
    # Firewall tools
    iptables \
    ipset \
    aggregate \
    sudo \
    # Text editors
    vim \
    nano \
    # Locales for proper encoding
    locales \
    # Python 3.11 (system Python for node-gyp compatibility)
    python3.11 \
    python3.11-dev \
    python3-pip \
    && rm -rf /var/lib/apt/lists/*

# Set up locale (prevents encoding issues)
RUN sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen && \
    locale-gen
ENV LANG=en_US.UTF-8 \
    LANGUAGE=en_US:en \
    LC_ALL=en_US.UTF-8

# NOTE: Using 'node' user from base image (no need to create vscode user)

# Install Claude Code CLI
RUN curl -fsSL https://claude.ai/install.sh | bash

# Create directory for Claude Code defaults
RUN mkdir -p /usr/local/share/claude-defaults

# Copy initialization scripts and templates
COPY init-firewall.sh /usr/local/bin/
COPY init-claude-config.sh /usr/local/bin/
COPY init-python.sh /usr/local/bin/
COPY --chown=node:node settings.json.template /usr/local/share/claude-defaults/settings.json
COPY --chown=node:node mcp.json.template /usr/local/share/claude-defaults/mcp.json

# Set permissions and configure sudoers for scripts
RUN chmod +x /usr/local/bin/init-firewall.sh && \
    chmod +x /usr/local/bin/init-claude-config.sh && \
    chmod +x /usr/local/bin/init-python.sh && \
    echo "node ALL=(root) NOPASSWD: /usr/local/bin/init-firewall.sh" > /etc/sudoers.d/node-firewall && \
    echo "node ALL=(root) NOPASSWD: /usr/local/bin/init-claude-config.sh" > /etc/sudoers.d/node-claude-config && \
    echo "node ALL=(root) NOPASSWD: /usr/local/bin/init-python.sh" > /etc/sudoers.d/node-python && \
    chmod 0440 /etc/sudoers.d/node-firewall && \
    chmod 0440 /etc/sudoers.d/node-claude-config && \
    chmod 0440 /etc/sudoers.d/node-python

# Set working directory
WORKDIR /workspaces

# Install Python dev tools globally
RUN pip install --no-cache-dir \
    black \
    pylint \
    pytest \
    ipython \
    jupyter \
    jupyterlab

# Switch to non-root user
USER node

# Install uv (fast Python package manager + version management)
# uv installer places binary at /home/node/.local/bin/uv
RUN curl -LsSf https://astral.sh/uv/install.sh | sh && \
    echo 'export PATH="$HOME/.local/bin:$PATH"' >> /home/node/.bashrc
ENV PATH="/home/node/.local/bin:$PATH"

# Install bun (for Python projects with JS/TS frontends)
RUN curl -fsSL https://bun.sh/install | bash && \
    echo 'export BUN_INSTALL="$HOME/.bun"' >> /home/node/.bashrc && \
    echo 'export PATH="$BUN_INSTALL/bin:$PATH"' >> /home/node/.bashrc
ENV BUN_INSTALL="/home/node/.bun"
ENV PATH="$BUN_INSTALL/bin:$PATH"

# Set Python to unbuffered mode (better for logs)
ENV PYTHONUNBUFFERED=1

# NOTE: Python 3.14 is installed via init-python.sh in postCreateCommand
# This ensures installation persists in /home/node/.local volume

pip install -r requirements.txt
pip list

uv pip install -r requirements.txt
uv pip list

# Verify Python
python --version  # Should show Python 3.14.x

# Verify pip
pip --version

# Verify uv
uv --version

# Verify bun (for hybrid projects)
bun --version

# Verify modern tools
rg --version    # ripgrep (fast search)
fdfind --version # fd (fast find)
jq --version    # JSON processor

# Test your Flask/FastAPI app
python app.py
# or
uvicorn main:app --reload --host 0.0.0.0 --port 8000