# Supply a Debian/Ubuntu-based runtime image approved for your deployment.
# Use its immutable digest; this example does not install an agent harness.
ARG BASE_IMAGE
FROM ${BASE_IMAGE}

# Match the non-root runtime identity in the approved base image.
ARG RUNTIME_USER=1000:1000
USER root
RUN apt-get update \
    && apt-get install -y --no-install-recommends git jq ca-certificates \
    && rm -rf /var/lib/apt/lists/*
USER ${RUNTIME_USER}

# Inherit the base image's ENTRYPOINT, CMD, and WORKDIR.
# Do not bake credentials, SSH keys, session data, or connection secrets here.