fix(docker): address git identity review

This commit is contained in:
Devvyn
2026-09-25 22:27:26 +08:00
parent 8d358aaa26
commit bf73a84732
10 changed files with 65 additions and 48 deletions
+15 -14
View File
@@ -12,9 +12,6 @@
# writable even though the uid is not the baked 1000.
FROM node:22-bookworm-slim
ARG GIT_USER_EMAIL=
ARG GIT_USER_NAME=
# Base toolchain. `curl` is needed for the hook callbacks (`curl -sk $CODEMAN_API_URL`),
# `procps` for `ps`, `tmux` for the durable in-container session.
RUN apt-get update \
@@ -30,17 +27,6 @@ RUN apt-get update \
openssh-client \
&& rm -rf /var/lib/apt/lists/*
# Docker cases run with a fresh, container-owned home directory. Configure Git
# at the system level during the build so the identity supplied in docker/.env
# remains stable after an agent image rebuild. Refuse an incomplete identity.
RUN set -eux; \
if [ -n "${GIT_USER_NAME}" ] || [ -n "${GIT_USER_EMAIL}" ]; then \
test -n "${GIT_USER_NAME}"; \
test -n "${GIT_USER_EMAIL}"; \
git config --system user.name "${GIT_USER_NAME}"; \
git config --system user.email "${GIT_USER_EMAIL}"; \
fi
# GitHub CLI and Azure CLI (+ the azure-devops extension) with the same system
# git credential helpers as docker/server.Dockerfile, so an agent in a Docker
# case can clone and push to private GitHub / Azure DevOps repositories. The
@@ -268,6 +254,21 @@ RUN useradd -g 0 -m -d /home/agent -s /bin/bash agent \
&& chgrp -R 0 /home/agent \
&& chmod -R g=u /home/agent
# Docker cases have a fresh, container-owned home directory. Declare the
# optional identity here so changing it invalidates only this final layer, then
# configure Git's system defaults. A user-level config still takes precedence.
ARG GIT_USER_EMAIL=
ARG GIT_USER_NAME=
RUN set -eux; \
if [ -n "${GIT_USER_NAME}" ] || [ -n "${GIT_USER_EMAIL}" ]; then \
if [ -z "${GIT_USER_NAME}" ] || [ -z "${GIT_USER_EMAIL}" ]; then \
echo 'Git user name and email must both be set when configuring Git identity' >&2; \
exit 1; \
fi; \
git config --system user.name "${GIT_USER_NAME}"; \
git config --system user.email "${GIT_USER_EMAIL}"; \
fi
USER agent
WORKDIR /home/agent