mirror of
https://github.com/Ark0N/Codeman.git
synced 2026-10-02 13:39:41 +02:00
DevvynandClaude Opus 5
10876aa440
Compose binds CODEMAN_APPDATA_PATH and CODEMAN_CASES_PATH from the host. When either path does not exist yet - a first run, a cleared application-data directory, a restored backup - the Docker daemon creates it owned by root. The server runs unprivileged as CODEMAN_RUNTIME_USER, so it cannot create its own state directory, and the container restarts forever on: Failed to start web server: EACCES: permission denied, mkdir '/home/<user>/.codeman' Start-Codeman.sh already worked around this by preparing the directory on the host, so the failure only appears when Compose is run directly, which the README documents as a supported path. Add docker/entrypoint.sh, which starts as root, corrects the ownership of both bind mounts, then drops to PUID:PGID with setpriv. The Dockerfile's USER instruction is replaced by that entrypoint and CMD is unchanged. docker-compose.yaml adds back only the four capabilities the chown and the privilege drop require, so cap_drop: ALL continues to remove everything else. Two guards keep existing deployments working: - A container started with an explicit `user:` is left alone. The entrypoint execs straight through, with no elevation and no chown. - A chown that fails is a warning, not an error. Bind mounts backed by NFS, CIFS or a rootless daemon can refuse chown while remaining perfectly writable, and those deployments must keep starting. PUID and PGID are also exported as runtime environment defaults so the image behaves correctly when run without Compose, rather than depending on build args alone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
154 lines
6.3 KiB
Docker
154 lines
6.3 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# Build the application from the checkout supplied as the Docker build context.
|
|
# No published Codeman application image is required.
|
|
FROM node:22-bookworm-slim AS build
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends python3 make g++ \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /opt/codeman
|
|
|
|
COPY . .
|
|
|
|
# devDependencies are deliberately KEPT (no `npm prune --omit=dev`). The in-app
|
|
# updater rebuilds from inside this container, and `npm run build` is tsc +
|
|
# esbuild — both devDependencies. Pruning them saves image size and takes the
|
|
# self-updater with it. See docs/docker-self-update.md.
|
|
RUN npm ci \
|
|
&& npm run build \
|
|
&& npm cache clean --force
|
|
|
|
# The Docker CLI talks to the host daemon through the socket mounted by
|
|
# docker/docker-compose.yaml. It does not run a Docker daemon in this container.
|
|
FROM node:22-bookworm-slim
|
|
|
|
ARG CODEMAN_RUNTIME_USER=opencode
|
|
ARG PUID=1000
|
|
ARG PGID=1000
|
|
|
|
# python3/make/g++ are here for the SELF-UPDATER, not for this build. An update
|
|
# runs `npm install` inside the running container, and node-pty ships no Linux
|
|
# prebuild, so a release that bumps it compiles from source right here. Without
|
|
# a toolchain that install fails and the update rolls back — every time, on the
|
|
# releases that need it most. Same reason install.sh installs one on bare hosts.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
curl \
|
|
g++ \
|
|
git \
|
|
make \
|
|
openssh-client \
|
|
procps \
|
|
python3 \
|
|
ripgrep \
|
|
tmux \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# The Docker CLI, taken from the official image rather than Debian's `docker.io`.
|
|
# That package is the full ENGINE: with --no-install-recommends it still pulls 15
|
|
# packages including containerd, runc, dmsetup and iptables, none of which a
|
|
# client that only talks to a mounted socket can use. Measured on top of this
|
|
# base image: `docker.io` costs 266 MB and ships Docker 20.10.24 (2023), while
|
|
# these two files cost 108 MB and ship the current CLI (493 MB vs 335 MB total).
|
|
#
|
|
# The binaries are STATIC Go builds, so they run on this glibc image even though
|
|
# the image they come from is Alpine (verified: `docker --version`, `docker ps`
|
|
# and `docker build` all work here against a mounted host socket).
|
|
#
|
|
# buildx is copied on purpose. `scripts/build-agent-image.mjs` shells out to
|
|
# `docker build` — Codeman auto-builds the agent image on the first Docker case —
|
|
# and without the plugin that silently falls back to the CLASSIC builder, which
|
|
# Docker has deprecated and will eventually drop. `docker-compose` is NOT copied:
|
|
# Codeman never shells out to it.
|
|
COPY --from=docker:29-cli /usr/local/bin/docker /usr/local/bin/docker
|
|
COPY --from=docker:29-cli \
|
|
/usr/local/libexec/docker/cli-plugins/docker-buildx \
|
|
/usr/local/libexec/docker/cli-plugins/docker-buildx
|
|
|
|
# Keep credentials out of the image. Users authenticate these CLIs at runtime
|
|
# through Codeman sessions, and the configured host bind mount retains state.
|
|
#
|
|
# ⚠️ PINNED ON PURPOSE. Unpinned, the agent CLI versions a user ends up with are
|
|
# a function of WHEN their image was built, not of any commit — so a Codeman
|
|
# release that depends on newer CLI behaviour (the trust-dialog handling is
|
|
# pinned to Claude Code 2.1.252's layout; wheel forwarding to >= 2.1.187) breaks
|
|
# on an older image with no diff anywhere to explain why. In-app updates make
|
|
# rebuilds RARER, which makes that drift worse. Pinning turns "this release needs
|
|
# a newer CLI" into a Dockerfile change, which the updater's environment gate
|
|
# already detects and refuses (docs/docker-self-update.md).
|
|
#
|
|
# Bump these deliberately, in a release. `--no-cache` is still needed to rebuild
|
|
# this layer when only the pins change upstream.
|
|
RUN npm install --global \
|
|
@anthropic-ai/claude-code@2.1.258 \
|
|
@google/gemini-cli@0.58.0 \
|
|
@openai/codex@0.152.1 \
|
|
opencode-ai@1.18.26 \
|
|
&& npm cache clean --force
|
|
|
|
# Keep the web server and every local Codeman session unprivileged. PUID and
|
|
# PGID match the host-owned application-data directory mounted by Compose. The
|
|
# requested GID may not exist in the base image, and a host UID such as 1000 may
|
|
# already belong to the baked `node` account, so handle both cases explicitly.
|
|
RUN set -eux; \
|
|
case "${PUID}" in ''|*[!0-9]*) echo "PUID must be numeric" >&2; exit 1;; esac; \
|
|
case "${PGID}" in ''|*[!0-9]*) echo "PGID must be numeric" >&2; exit 1;; esac; \
|
|
if [ "${PUID}" -eq 0 ]; then \
|
|
echo "PUID must identify an unprivileged account, not root" >&2; \
|
|
exit 1; \
|
|
fi; \
|
|
if ! getent group "${PGID}" >/dev/null; then \
|
|
groupadd --gid "${PGID}" codeman-runtime; \
|
|
fi; \
|
|
existing_user="$(getent passwd "${PUID}" | cut -d: -f1 || true)"; \
|
|
if [ -n "${existing_user}" ]; then \
|
|
usermod \
|
|
--login "${CODEMAN_RUNTIME_USER}" \
|
|
--gid "${PGID}" \
|
|
--home "/home/${CODEMAN_RUNTIME_USER}" \
|
|
--move-home \
|
|
--shell /bin/bash \
|
|
"${existing_user}"; \
|
|
else \
|
|
useradd \
|
|
--uid "${PUID}" \
|
|
--gid "${PGID}" \
|
|
--create-home \
|
|
--home-dir "/home/${CODEMAN_RUNTIME_USER}" \
|
|
--shell /bin/bash \
|
|
"${CODEMAN_RUNTIME_USER}"; \
|
|
fi
|
|
|
|
WORKDIR /opt/codeman
|
|
|
|
COPY --from=build /opt/codeman /opt/codeman
|
|
|
|
# CODEMAN_IN_CONTAINER tells the self-updater it must restart by exiting rather
|
|
# than by asking an init system that is not here (src/web/self-update.ts).
|
|
# NODE_ENV stays `production`; the updater passes `npm install --include=dev`
|
|
# explicitly, since that value would otherwise omit the build toolchain.
|
|
ENV CODEMAN_IN_CONTAINER=1 \
|
|
CODEMAN_PORT=3000 \
|
|
HOME=/home/${CODEMAN_RUNTIME_USER} \
|
|
NODE_ENV=production
|
|
|
|
# Runtime defaults for the entrypoint, matching the account created above.
|
|
ENV PGID=${PGID} PUID=${PUID}
|
|
|
|
EXPOSE 3000
|
|
|
|
# The container starts as root so the entrypoint can correct the ownership of
|
|
# the host bind mounts, which the daemon creates as root whenever they do not
|
|
# already exist. The entrypoint then drops to PUID:PGID with setpriv, so the
|
|
# server itself never runs privileged. Setting `user:` in Compose bypasses both
|
|
# steps, leaving the caller in full control.
|
|
COPY docker/entrypoint.sh /usr/local/bin/entrypoint.sh
|
|
RUN chmod 0755 /usr/local/bin/entrypoint.sh
|
|
|
|
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
|
|
|
|
CMD ["node", "dist/index.js", "web"]
|