# Optional full-kernel test harness for Docker Desktop/WSL kernels lacking NFT_SOCKET.
# No privileged container, host networking, KVM, or host kernel changes are needed.
ARG FIREGEX_TEST_IMAGE=firegex-mcp:test
FROM ${FIREGEX_TEST_IMAGE} AS guest
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends \
    qemu-system-x86 linux-image-amd64 initramfs-tools e2fsprogs busybox-static && \
    rm -rf /var/lib/apt/lists/*
COPY --from=guest / /guest/
RUN cp -a /lib/modules/. /guest/lib/modules/ && \
    cp /bin/busybox /guest/usr/local/bin/test-busybox && \
    ln -sf /usr/local/bin/test-busybox /guest/usr/sbin/modprobe && \
    ln -sf /usr/local/bin/test-busybox /guest/usr/sbin/sysctl && \
    ln -sf /usr/local/bin/test-busybox /guest/usr/sbin/poweroff && \
    ln -s /boot/vmlinuz-* /kernel && ln -s /boot/initrd.img-* /initrd
COPY tests/mcp_vm_init.sh /guest/test/tests/mcp_vm_init.sh
RUN chmod +x /guest/test/tests/mcp_vm_init.sh
COPY tests/mcp_vm_run.sh /usr/local/bin/mcp-vm-run
ENTRYPOINT ["sh", "/usr/local/bin/mcp-vm-run"]