Omar SobhandClaude Opus 4.8
731adb6449
So a fresh per-agent node-local volume (node-placed terminal) seeds with 65532 ownership and the non-root shell can write ~/drives, instead of a root-owned mount. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
47 lines
2.1 KiB
Docker
47 lines
2.1 KiB
Docker
# The themed interactive "computer terminal" for the agent's Terminal app:
|
|
# zsh + oh-my-zsh + powerlevel10k. Runs as uid 65532 — matching the server's
|
|
# nonroot uid — so the terminal and the server share read-write ownership of the
|
|
# file-drive volume (~/drives). cap-drop ALL, seccomp deny profile,
|
|
# no-new-privileges. Unlike the hardened tool sandboxes it keeps a writable home
|
|
# so the baked p10k config, completion cache and shell history work.
|
|
FROM debian:bookworm-slim
|
|
|
|
ENV LANG=C.UTF-8 \
|
|
LC_ALL=C.UTF-8 \
|
|
TERM=xterm-256color
|
|
|
|
# A small but useful dev toolbelt; no setuid binaries survive (no priv-esc).
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
zsh tmux git curl ca-certificates less nano procps coreutils \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& useradd --uid 65532 --user-group --create-home --shell /usr/bin/zsh agent \
|
|
&& find / -xdev -perm /6000 -type f -delete
|
|
|
|
USER 65532:65532
|
|
WORKDIR /home/agent
|
|
ENV HOME=/home/agent \
|
|
ZSH=/home/agent/.oh-my-zsh
|
|
|
|
# oh-my-zsh + powerlevel10k + quality-of-life plugins (built with egress; the
|
|
# running container's egress is a separate, default-off config knob).
|
|
RUN git clone --depth=1 https://github.com/ohmyzsh/ohmyzsh.git "$ZSH" \
|
|
&& git clone --depth=1 https://github.com/romkatv/powerlevel10k.git \
|
|
"$ZSH/custom/themes/powerlevel10k" \
|
|
&& git clone --depth=1 https://github.com/zsh-users/zsh-autosuggestions \
|
|
"$ZSH/custom/plugins/zsh-autosuggestions" \
|
|
&& git clone --depth=1 https://github.com/zsh-users/zsh-syntax-highlighting \
|
|
"$ZSH/custom/plugins/zsh-syntax-highlighting"
|
|
|
|
COPY --chown=65532:65532 zdotdir/.zshrc /home/agent/.zshrc
|
|
COPY --chown=65532:65532 zdotdir/.p10k.zsh /home/agent/.p10k.zsh
|
|
COPY --chown=65532:65532 zdotdir/.tmux.conf /home/agent/.tmux.conf
|
|
|
|
# Pre-create the drives mount root owned by the runtime user, so when a fresh
|
|
# per-agent node-local volume mounts here (node-placed terminal) Docker seeds it
|
|
# with this ownership — i.e. the non-root shell can actually write ~/drives.
|
|
RUN mkdir -p /home/agent/drives
|
|
|
|
# Idle keep-alive; the server execs an interactive tmux/zsh into the container.
|
|
CMD ["sleep", "infinity"]
|