TimmyandClaude Fable 5
4d22171d16
/opt/huskies/bin/huskies (chowned to the huskies user) with a symlink from /usr/local/bin/huskies. Atomic replace needs write permission on the directory for the tmp-write + rename, which root-owned /usr/local/bin can't provide to the server process. resolve_target_path() now prefers /opt/huskies/bin/huskies over current_exe(), which can point at a stale location (e.g. /workspace/target/release/huskies after a historical in-container rebuild) that the entrypoint would never launch after a restart. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019fHdm92yjvguPi2LiXfLB9
78 lines
2.9 KiB
Docker
78 lines
2.9 KiB
Docker
# huskies-project-base — minimal base for all project containers.
|
|
#
|
|
# This image provides git, the huskies server binary, and a non-root user.
|
|
# It carries no language tooling. Per-stack overlays (docker/stacks/<name>/
|
|
# Dockerfile.fragment) layer their toolchains on top of this base.
|
|
#
|
|
# Prerequisites: build the main `huskies` image first so its binary is
|
|
# available as a build source.
|
|
#
|
|
# docker build -t huskies -f docker/Dockerfile .
|
|
# docker build -t huskies-project-base -f docker/Dockerfile.base .
|
|
#
|
|
# To build a stack image (e.g. rust):
|
|
# (echo "FROM huskies-project-base"; \
|
|
# cat docker/stacks/rust/Dockerfile.fragment) | \
|
|
# docker build -t huskies-project-rust -
|
|
|
|
FROM huskies AS huskies-src
|
|
|
|
FROM debian:bookworm-slim
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
git \
|
|
curl \
|
|
ca-certificates \
|
|
libssl3 \
|
|
procps \
|
|
openssh-server \
|
|
sudo \
|
|
nodejs \
|
|
npm \
|
|
&& npm install -g @anthropic-ai/claude-code \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Copy the huskies binary and entrypoint from the main image.
|
|
# The binary lives in /opt/huskies/bin (chowned to the huskies user below) so
|
|
# the in-process upgrade path (`POST /api/upgrade`) can atomically replace it
|
|
# without root: rename() needs write permission on the *directory*, not just
|
|
# the file. /usr/local/bin/huskies stays a symlink so PATH resolution and the
|
|
# entrypoint CMD are unchanged.
|
|
COPY --from=huskies-src /usr/local/bin/huskies /opt/huskies/bin/huskies
|
|
COPY --from=huskies-src /usr/local/bin/entrypoint.sh /usr/local/bin/entrypoint.sh
|
|
|
|
# Non-root user — Claude Code refuses --dangerously-skip-permissions as root.
|
|
# -s /bin/bash required for SSH sessions to start a real shell.
|
|
RUN groupadd -r huskies \
|
|
&& useradd -r -g huskies -m -d /home/huskies -s /bin/bash huskies \
|
|
&& mkdir -p /home/huskies/.claude \
|
|
&& mkdir -p /home/huskies/.ssh \
|
|
&& chmod 700 /home/huskies/.ssh \
|
|
&& chown -R huskies:huskies /home/huskies \
|
|
&& chown -R huskies:huskies /opt/huskies \
|
|
&& ln -s /opt/huskies/bin/huskies /usr/local/bin/huskies \
|
|
&& mkdir -p /workspace \
|
|
&& chown huskies:huskies /workspace \
|
|
&& git config --global init.defaultBranch master \
|
|
&& echo "huskies ALL=(root) NOPASSWD: /usr/sbin/sshd" > /etc/sudoers.d/huskies-sshd \
|
|
&& chmod 0440 /etc/sudoers.d/huskies-sshd \
|
|
&& mkdir -p /run/sshd \
|
|
&& sed -i \
|
|
-e 's/#PasswordAuthentication yes/PasswordAuthentication no/' \
|
|
-e 's/#PubkeyAuthentication yes/PubkeyAuthentication yes/' \
|
|
-e 's/UsePAM yes/UsePAM no/' \
|
|
/etc/ssh/sshd_config
|
|
|
|
# Shell profile for SSH sessions: land in /workspace and load toolchain paths.
|
|
RUN printf 'cd /workspace\n[ -f "$HOME/.cargo/env" ] && . "$HOME/.cargo/env"\n' \
|
|
> /home/huskies/.profile \
|
|
&& chown huskies:huskies /home/huskies/.profile
|
|
|
|
USER huskies
|
|
WORKDIR /workspace
|
|
|
|
EXPOSE 3001 22
|
|
|
|
ENTRYPOINT ["entrypoint.sh"]
|
|
CMD ["huskies", "/workspace"]
|