Dockerfile

FROM node:20-slim

# Install GitHub CLI + Azure CLI (for ADO pr_reviewer)
# gh keyring is binary GPG format - pipe through dd, no gnupg needed
# Microsoft key is ASCII-armored - requires gpg --dearmor, so install gnupg
RUN apt-get update && apt-get install -y --no-install-recommends \
        ca-certificates curl gnupg && \
    curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
        | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg && \
    chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg && \
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
        > /etc/apt/sources.list.d/github-cli.list && \
    curl -sL https://packages.microsoft.com/keys/microsoft.asc | \
        gpg --dearmor -o /usr/share/keyrings/microsoft.gpg && \
    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/microsoft.gpg] https://packages.microsoft.com/repos/azure-cli/ bookworm main" \
        > /etc/apt/sources.list.d/azure-cli.list && \
    apt-get update && apt-get install -y --no-install-recommends gh azure-cli && \
    az extension add --name azure-devops --yes && \
    rm -rf /var/lib/apt/lists/*

# Claude Code CLI
RUN npm install -g @anthropic-ai/claude-code

# SandboxAQ code-review plugin (alg-claude-plugins/plugins/code-review), staged into the
# build context by `make build`. The pr_reviewer agent runs skills/pr-review/SKILL.md from
# here via CLAUDE_PLUGIN_ROOT=/opt/pr-review-plugin, so reviews track the plugin's latest
# committed version at image-build time instead of a frozen copy in agents/pr_reviewer.md.
COPY .plugin-build/code-review /opt/pr-review-plugin

RUN mkdir -p /workspace && chown node:node /workspace

USER node
WORKDIR /workspace

ENTRYPOINT ["claude"]