didericis
dc9fdc8563
On Linux, smolvm's TSI allowlist DB patch crashes boot, so force_allowlist is a no-op. This left the agent VM with full host loopback access — a security regression from the macOS behavior. Fix: install guest-side iptables rules in _init_vm that ACCEPT traffic to the bottle's allocated loopback alias (proxy_host/32) and DROP all other 127.0.0.0/8 destinations. The agent runs as non-root (node) and cannot flush the rules. - Add iptables to claude and codex agent Dockerfiles - Use DROP (not REJECT) — libkrun kernel lacks the REJECT module - Skip on macOS where force_allowlist handles it natively Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
32 lines
1.1 KiB
Docker
32 lines
1.1 KiB
Docker
# bot-bottle Codex provider image.
|
|
#
|
|
# Mirrors the default Claude image shape: Node LTS, git/network tooling,
|
|
# non-root node user, and the provider CLI installed for that user.
|
|
|
|
FROM node:22-slim
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends git ca-certificates curl procps ripgrep iptables \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# App-specific deps. Python isn't required by codex itself
|
|
# (codex is a Node CLI), but is convenient for the agent to shell
|
|
# out to for ad-hoc scripts. Kept on its own layer so it can be
|
|
# moved to a downstream image if the base ever needs to shrink.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends python3 python3-pip python3-venv \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
USER node
|
|
WORKDIR /home/node
|
|
|
|
ENV PATH="/home/node/.local/bin:${PATH}"
|
|
|
|
# Remote-control support requires the standalone Codex install layout
|
|
# under ~/.codex/packages/standalone/current. The npm package can run
|
|
# the TUI, but remote-control commands expect this installer-owned path.
|
|
RUN mkdir -p /home/node/.codex \
|
|
&& curl -fsSL https://chatgpt.com/codex/install.sh | sh
|
|
|
|
CMD ["codex"]
|