Dockerfile.example

# Example: Debian-based image that installs agentmon from a GitHub Release .deb
# and opt-in activates the /bin/sh + /bin/bash shim.
#
# Build:
#   docker build -f Dockerfile.example \
#     --build-arg AGENTMON_REPO=diffsec/agentmon \
#     --build-arg AGENTMON_TAG=v0.10.1 \
#     --build-arg DEB_ARCH=amd64 \
#     -t agentmon-example:latest .
#
# Run (connect to an external agentmon server):
#   docker run --rm -e AGENTMON_SERVER=http://host.docker.internal:8080 agentmon-example:latest
#
# Notes:
# - The release tag is "v..." but the artifact filenames use the version without the "v" prefix.
# - DEB_ARCH must match the artifact name (typically: amd64 or arm64).
# - Set AGENTMON_SERVER to point at the agentmon server (e.g. http://host.docker.internal:8080).
# - To select a non-default policy at runtime, set env var AGENTMON_POLICY_NAME to an allowed policy name.
# - To block env iteration for matched commands, set AGENTMON_ENV_BLOCK_ITERATION=1 (requires env shim LD_PRELOAD if used).

FROM debian:bookworm-slim

ARG AGENTMON_REPO=diffsec/agentmon
ARG AGENTMON_TAG=v0.10.1
ARG DEB_ARCH=amd64

RUN set -eux; \
  apt-get update; \
  apt-get install -y --no-install-recommends ca-certificates curl bash; \
  rm -rf /var/lib/apt/lists/*

RUN set -eux; \
  version="${AGENTMON_TAG#v}"; \
  deb="agentmon_${version}_linux_${DEB_ARCH}.deb"; \
  url="https://github.com/${AGENTMON_REPO}/releases/download/${AGENTMON_TAG}/${deb}"; \
  echo "Downloading: ${url}"; \
  curl -fsSL -L "${url}" -o /tmp/agentmon.deb; \
  dpkg -i /tmp/agentmon.deb; \
  rm -f /tmp/agentmon.deb; \
  agentmon --version; \
  agentmon shim install-shell \
    --root / \
    --shim /usr/bin/agentmon-shell-shim \
    --bash \
    --i-understand-this-modifies-the-host

CMD ["/bin/sh", "-lc", "echo hello from agentmon shim; true"]