didericis
6c939e3309
The Docker backend cannot launch a bottle on this host: the orchestrator publishes 127.0.0.1:8099 but is attached only to the `--internal` control network, so Docker accepts the mapping and never establishes the forward (PortBindings set, NetworkSettings.Ports empty). Every launch dies on `orchestrator did not become healthy`. That is independent of the demo and left alone here, because fixing it means touching the L3 isolation the control network exists to provide. Pin the tape to macos-container, which launches cleanly, and drop the Docker daemon check and image pre-warm from setup. The pre-warm is not replaced with a `container build` equivalent: build_image() applies --dns handling that would become a second, drifting copy in shell, and the warm layer cache already keeps rebuilds fast. Pre-warm never kept BuildKit off camera anyway — the launcher prints CACHED lines regardless, so that comment was wrong when it was written. Launch via --headless. The interactive path opens four selectors in a row and the tape drove none of them; it also lists every bottle in ~/.bot-bottle/bottles/, putting the operator's own bottle names in a GIF that ships in the README. --headless is one-shot by construction (`claude -p`), so all probes ride in on a single --prompt rather than being typed as follow-ups into a session that has already exited. Spell the probes as literal shell commands. Left in English, one take had the agent substitute a placeholder for $FAKE_TOKEN: the DLP scanner had nothing to match and gitleaks found nothing to flag, so both controls reported a clean pass without ever being exercised. Neither curl discards the body, so the recording shows the host-filter refusal and the DLP refusal as visibly different reasons instead of two identical 403s. Drop the git/gitleaks probe. In the last run carrying it, gitleaks reported `no leaks found` on an AKIA-shaped key and the gate forwarded the push, which failed only because upstream.invalid does not resolve. A recording of that reads as the gate catching a secret while showing the opposite. Tracked in #541. Refs #540 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
34 lines
1.3 KiB
Bash
Executable File
34 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Human-runnable demo wrapper. Stages the demo bottle/agent and dummy
|
|
# identity (see scripts/demo-setup.sh), launches `bot-bottle start demo`
|
|
# interactively, then restores prior state. The recorded GIF
|
|
# (docs/demo.gif) goes through the same flow via docs/demo.tape.
|
|
#
|
|
# Once attached to claude inside the bottle, use the `!` prefix to run
|
|
# bash directly — e.g.
|
|
# ! curl --proxy "$HTTPS_PROXY" -sw 'status=%{http_code}\n' \
|
|
# -o /dev/null http://example.com/
|
|
# returns 403 because example.com is not on the bottle's allowlist.
|
|
|
|
set -euo pipefail
|
|
|
|
cd "$(dirname "$0")/.."
|
|
|
|
if [ -z "${BOT_BOTTLE_CLAUDE_OAUTH_TOKEN:-}" ]; then
|
|
cat <<'EOF' >&2
|
|
demo: BOT_BOTTLE_CLAUDE_OAUTH_TOKEN is unset. The bottle launches claude,
|
|
which needs the token to authenticate. Set it in your shell env (e.g.
|
|
~/.zshrc) — see README §Auth — then re-run.
|
|
EOF
|
|
exit 1
|
|
fi
|
|
|
|
bash scripts/demo-setup.sh
|
|
trap 'bash scripts/demo-teardown.sh' EXIT
|
|
|
|
# Pinned to the Apple Container backend: the Docker backend cannot
|
|
# reach its own orchestrator (published port lands on an internal-only
|
|
# network), and the demo should run the same way on every host rather
|
|
# than following the host default (Firecracker on KVM Linux).
|
|
BOT_BOTTLE_BACKEND=macos-container bot-bottle start demo
|