# The machine room for exam hosts that have to be real machines.
#
# Most exam hosts are containers (images/node). A container shares this machine's kernel, and under
# rootless podman it may neither load eBPF programs nor use a kernel feature this machine lacks: no
# Falco, no AppArmor. Tasks that need them get a virtual machine instead - Ubuntu, like the real exam
# hosts - and this image is what runs it: QEMU with KVM, in a container on the simulator's network
# that carries the host's name, so `ssh cks0105` from the desktop reaches the VM exactly as it
# reaches a container host. `./ksim build cks --vm` builds the image and the VM's disk.
FROM docker.io/library/debian:trixie-slim
RUN apt-get update \
 && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
      qemu-system-x86 qemu-utils cloud-image-utils genisoimage openssh-client ca-certificates procps \
 && rm -rf /var/lib/apt/lists/*
COPY rootfs/ /
RUN chmod 755 /usr/local/bin/ksim-vm && chmod 700 /root/.ssh && chmod 600 /root/.ssh/config
ENTRYPOINT ["/usr/local/bin/ksim-vm"]