mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-26 02:00:52 +01:00
Harold KimandPaperclip
98df214917
When reusing a Codex sandbox, the workspace-restore step now performs an auth-merge check before adopting the sandbox's auth.json. The merge fails closed when: - host or sandbox Codex auth is unusable (missing token or account) - the subscription payload shapes differ between host and sandbox - subscription account identities do not match Additional hardening: node absence on PATH during the embedded decision script now exits non-zero instead of silently falling through. Co-change comments link parseAuth (the embedded script) to hasUsableAuthPayload (codex-home.ts) so a future auth-format change cannot silently diverge between the two implementations. Co-Authored-By: Paperclip <noreply@paperclip.ing>
38 lines
1.5 KiB
Docker
38 lines
1.5 KiB
Docker
# syntax=docker/dockerfile:1.6
|
|
ARG NODE_VERSION=22
|
|
ARG TARGETARCH
|
|
|
|
# ---------- Stage 1: build agent-shim ----------
|
|
FROM golang:1.25-bookworm AS shim-build
|
|
ARG TARGETARCH
|
|
WORKDIR /src
|
|
COPY tools/agent-shim/ ./
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH:-amd64} \
|
|
go build -ldflags='-s -w' -o /out/paperclip-agent-shim .
|
|
|
|
# ---------- Stage 2: runtime base image ----------
|
|
# Ubuntu + Node + git + tini + non-root paperclip user + the agent-shim. This is
|
|
# everything the sandbox exec-in model needs: the pod idles and paperclip-server
|
|
# execs the harness CLI in, so the harness images only add their CLI on top of
|
|
# this. Git workspace population (an init-container workspace bootstrap) is
|
|
# intentionally NOT built here yet: the current scope is a blank workspace.
|
|
# Add it when git workspace population lands.
|
|
FROM ubuntu:22.04 AS base
|
|
ARG NODE_VERSION
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates curl git tini gnupg \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& curl -fsSL https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - \
|
|
&& apt-get install -y --no-install-recommends nodejs \
|
|
&& apt-get clean \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& groupadd -g 1000 paperclip \
|
|
&& useradd -u 1000 -g 1000 -d /home/paperclip -m -s /bin/bash paperclip
|
|
|
|
COPY --from=shim-build /out/paperclip-agent-shim /usr/local/bin/paperclip-agent-shim
|
|
|
|
USER 1000:1000
|
|
WORKDIR /workspace
|
|
ENTRYPOINT ["/usr/bin/tini", "--"]
|
|
CMD ["/usr/local/bin/paperclip-agent-shim"]
|