44 lines
1.9 KiB
Docker
44 lines
1.9 KiB
Docker
# syntax=docker/dockerfile:1.6
|
|
ARG NODE_VERSION=24
|
|
ARG TARGETARCH
|
|
|
|
# ---------- Stage 1: build agent-shim ----------
|
|
FROM golang:1.25-bookworm AS shim-build
|
|
ARG TARGETARCH
|
|
WORKDIR /src
|
|
COPY tools/agent-shim/ ./
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH:-amd64} \
|
|
go build -ldflags='-s -w' -o /out/paperclip-agent-shim .
|
|
|
|
# ---------- Stage 2: runtime base image ----------
|
|
# Ubuntu + Node + git + tini + non-root paperclip user + the agent-shim. This is
|
|
# everything the sandbox exec-in model needs: the pod idles and paperclip-server
|
|
# execs the harness CLI in, so the harness images only add their CLI on top of
|
|
# this. Git workspace population (an init-container workspace bootstrap) is
|
|
# intentionally NOT built here yet: the current scope is a blank workspace.
|
|
# Add it when git workspace population lands.
|
|
FROM ubuntu:22.04 AS base
|
|
ARG NODE_VERSION
|
|
# ripgrep (rg): required on PATH so OpenCode's skill tooling uses the system
|
|
# binary instead of trying to download a pinned build from github.com at run
|
|
# time. A sandbox with locked-down egress makes that download hang ~127s then
|
|
# fail ("Transport error ... BurntSushi/ripgrep/releases/..."), wasting run
|
|
# budget on every agent run. The root repo Dockerfile already ships rg; this
|
|
# restores parity for the agent-runtime image.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates curl git tini gnupg ripgrep \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& curl -fsSL https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - \
|
|
&& apt-get install -y --no-install-recommends nodejs \
|
|
&& apt-get clean \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& groupadd -g 1000 paperclip \
|
|
&& useradd -u 1000 -g 1000 -d /home/paperclip -m -s /bin/bash paperclip
|
|
|
|
COPY --from=shim-build /out/paperclip-agent-shim /usr/local/bin/paperclip-agent-shim
|
|
|
|
USER 1000:1000
|
|
WORKDIR /workspace
|
|
ENTRYPOINT ["/usr/bin/tini", "--"]
|
|
CMD ["/usr/local/bin/paperclip-agent-shim"]
|