mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-11-01 06:42:06 +01:00
Harold KimandPaperclip
98df214917
When reusing a Codex sandbox, the workspace-restore step now performs an auth-merge check before adopting the sandbox's auth.json. The merge fails closed when: - host or sandbox Codex auth is unusable (missing token or account) - the subscription payload shapes differ between host and sandbox - subscription account identities do not match Additional hardening: node absence on PATH during the embedded decision script now exits non-zero instead of silently falling through. Co-change comments link parseAuth (the embedded script) to hasUsableAuthPayload (codex-home.ts) so a future auth-format change cannot silently diverge between the two implementations. Co-Authored-By: Paperclip <noreply@paperclip.ing>
41 lines
1.5 KiB
Docker
41 lines
1.5 KiB
Docker
FROM ubuntu:24.04
|
|
|
|
ARG NODE_MAJOR=20
|
|
ARG PAPERCLIPAI_VERSION=latest
|
|
ARG HOST_UID=10001
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive \
|
|
PAPERCLIP_HOME=/paperclip \
|
|
PAPERCLIP_OPEN_ON_LISTEN=false \
|
|
HOST=0.0.0.0 \
|
|
PORT=3100 \
|
|
HOME=/home/paperclip \
|
|
LANG=en_US.UTF-8 \
|
|
LC_ALL=en_US.UTF-8 \
|
|
NPM_CONFIG_UPDATE_NOTIFIER=false \
|
|
NODE_MAJOR=${NODE_MAJOR} \
|
|
PAPERCLIPAI_VERSION=${PAPERCLIPAI_VERSION}
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates curl gnupg locales \
|
|
&& mkdir -p /etc/apt/keyrings \
|
|
&& curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
|
|
| gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
|
|
&& echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_${NODE_MAJOR}.x nodistro main" \
|
|
> /etc/apt/sources.list.d/nodesource.list \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends nodejs \
|
|
&& locale-gen en_US.UTF-8 \
|
|
&& groupadd --gid 10001 paperclip \
|
|
&& useradd --create-home --shell /bin/bash --uid "${HOST_UID}" --gid 10001 paperclip \
|
|
&& mkdir -p /paperclip /home/paperclip/workspace \
|
|
&& chown -R paperclip:paperclip /paperclip /home/paperclip \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
VOLUME ["/paperclip"]
|
|
WORKDIR /home/paperclip/workspace
|
|
EXPOSE 3100
|
|
USER paperclip
|
|
|
|
CMD ["bash", "-lc", "set -euo pipefail; mkdir -p \"$PAPERCLIP_HOME\"; npx --yes \"paperclipai@${PAPERCLIPAI_VERSION}\" onboard --yes --data-dir \"$PAPERCLIP_HOME\""]
|