didericis
86a9b499bc
Second step of PRD 0006. With pipelock now doing the bumping, the agent's TLS library has to trust pipelock's per-bottle CA — or every CONNECT to api.anthropic.com is a self-signed-cert error. - BottleBackend.provision gains a non-abstract `provision_ca` with a default no-op (so non-Docker backends aren't forced to implement TLS interception) and orchestrates ca → prompt → skills → ssh → git. CA install runs first so the agent's trust store is rebuilt before anything else in the agent makes a TLS call. - New backend/docker/provision/ca.py: docker-cp's the CA cert into the agent at /usr/local/share/ca-certificates/..., `update-ca-certificates`, then emits a one-line stderr log with the SHA-256 fingerprint (stdlib `ssl` + `hashlib`; no subprocess for crypto). Module-level constants AGENT_CA_PATH and AGENT_CA_BUNDLE are imported by launch.py so the env trio set at docker run time matches the paths the provisioner writes. - launch.py: rebinds `plan` after `dataclasses.replace`s on the pipelock proxy plan so provision_ca (which reads `plan.proxy_plan.ca_cert_host_path`) sees the populated CA paths. Three new -e flags on the agent's docker run for the NODE_EXTRA_CA_CERTS / SSL_CERT_FILE / REQUESTS_CA_BUNDLE trio. - Dockerfile: adds curl to the apt-get install line. curl natively respects HTTPS_PROXY and sends CONNECT directly — the agent doesn't need OS-level DNS for external hostnames (pipelock resolves them on its side of the bumped tunnel). This is the "simple HTTPS request" path the earlier turn needed and Node's stdlib https.request couldn't provide. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
67 lines
2.9 KiB
Docker
67 lines
2.9 KiB
Docker
# claude-bottle container image.
|
|
#
|
|
# Goal: a small, cache-friendly base that ships claude-code (the
|
|
# `@anthropic-ai/claude-code` npm package, CLI name `claude`) ready to run
|
|
# interactively. The container is ephemeral; per PRD 0001 v1 the host
|
|
# filesystem is not mounted in.
|
|
#
|
|
# Layer ordering is deliberate: the npm install lives in its own layer so
|
|
# changes to the rest of the repo (or to the CMD) don't bust it.
|
|
|
|
# Current Node LTS; slim variant keeps the image small while still
|
|
# providing apt-get for any future additions.
|
|
FROM node:22-slim
|
|
|
|
# Install runtime system deps. claude-code shells out to git for several
|
|
# features (status checks, commits, PR creation) — without git in the
|
|
# image, those features fail in surprising ways once the user does any
|
|
# real work. ca-certificates is already in the slim base; listed for
|
|
# clarity in case the base ever drops it. socat is the privileged
|
|
# forwarder for the in-container ssh-agent (see claude_bottle/ssh.py): the agent
|
|
# runs as root and rejects non-root connections, so socat sits between
|
|
# node and the agent socket. curl is here so any HTTPS_PROXY-aware
|
|
# tool (curl itself, plus anything that shells out to it) works
|
|
# against pipelock's bumped TLS without the agent needing local DNS.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends git ca-certificates openssh-client socat curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install claude-code globally. Pinned to the version verified in the v1
|
|
# build (`claude --version` returns 2.1.126). Bump deliberately when
|
|
# rolling forward; an unpinned install would mean rebuilds silently pick
|
|
# up new behavior.
|
|
RUN npm install -g --no-fund --no-audit @anthropic-ai/claude-code@2.1.126 \
|
|
&& npm cache clean --force
|
|
|
|
# Run as a non-root user. The node image already provides a `node` user
|
|
# (uid 1000) with a home directory, which is where claude-code will write
|
|
# its session state.
|
|
USER node
|
|
WORKDIR /home/node
|
|
|
|
# Pre-create the skills directory so PRD 0002's host->container skill
|
|
# copier (claude_bottle/skills.py) drops files into a path owned by the
|
|
# `node` user. `skills_copy_into` also `mkdir -p`s defensively, but
|
|
# baking it into the image avoids a permission-confusion footgun if a
|
|
# future change to the launcher copies in as a different user.
|
|
RUN mkdir -p /home/node/.claude/skills
|
|
|
|
# Heredoc delimiter is unquoted so $HOME expands; no other `$` appears
|
|
# in the body, so this is safe under dash (Docker's default RUN shell).
|
|
RUN cat > "$HOME/.claude.json" <<JSON
|
|
{
|
|
"hasCompletedOnboarding": true,
|
|
"theme": "dark",
|
|
"bypassPermissionsModeAccepted": true,
|
|
"projects": {
|
|
"$HOME": { "hasTrustDialogAccepted": true }
|
|
}
|
|
}
|
|
JSON
|
|
|
|
# Default to an interactive claude session. In the v1 launcher,
|
|
# `claude_bottle/cli/start.py` runs the container detached and uses `docker exec`
|
|
# to attach a TTY, but this CMD makes `docker run -it claude-bottle` also
|
|
# do something useful for ad-hoc debugging.
|
|
CMD ["claude"]
|