# Cua's OSWorld-Verified container image with one change: Chrome and VS Code (Electron) start with
# --no-sandbox. Docker's default seccomp profile refuses the user namespaces their sandbox needs, so
# in the stock image both exit at launch ("Failed to move to new namespace") for every agent.
FROM ghcr.io/trycua/bench-osworld@sha256:e55cf3a314793f89be7efbffdc043aab29bf85990c6213a9ebbb204825504439
RUN set -eux; \
    printf '#!/bin/sh\nexec /opt/google/chrome/google-chrome --no-sandbox "$@"\n' > /usr/local/bin/google-chrome; \
    printf '#!/bin/sh\nexec /usr/share/code/bin/code --no-sandbox "$@"\n' > /usr/local/bin/code; \
    chmod 755 /usr/local/bin/google-chrome /usr/local/bin/code; \
    ln -sf /usr/local/bin/google-chrome /usr/bin/google-chrome; \
    ln -sf /usr/local/bin/google-chrome /usr/bin/google-chrome-stable; \
    ln -sf /usr/local/bin/code /usr/bin/code; \
    for f in /usr/share/applications/google-chrome.desktop /usr/share/applications/code.desktop; do \
      [ -f "$f" ] && sed -i -E 's#^(Exec=[^ ]+)#\1 --no-sandbox#' "$f"; \
    done; \
    grep -h '^Exec=' /usr/share/applications/google-chrome.desktop /usr/share/applications/code.desktop