mirror of
https://github.com/harivansh-afk/sandbox-agent.git
synced 2026-04-15 13:03:46 +00:00
d8b8b49f37
* Fix Foundry auth: migrate to Better Auth adapter, fix access token retrieval - Remove @ts-nocheck from better-auth.ts, auth-user/index.ts, app-shell.ts and fix all type errors - Fix getAccessTokenForSession: read GitHub token directly from account record instead of calling Better Auth's internal /get-access-token endpoint which returns 403 on server-side calls - Re-implement workspaceAuth helper functions (workspaceAuthColumn, normalizeAuthValue, workspaceAuthClause, workspaceAuthWhere) that were accidentally deleted - Remove all retry logic (withRetries, isRetryableAppActorError) - Implement CORS origin allowlist from configured environment - Document cachedAppWorkspace singleton pattern - Add inline org sync fallback in buildAppSnapshot for post-OAuth flow - Add no-retry rule to CLAUDE.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Add Foundry dev panel from fix-git-data branch Port the dev panel component that was left out when PR #243 was replaced by PR #247. Adapted to remove runtime/mock-debug references that don't exist on the current branch. - Toggle with Shift+D, persists visibility to localStorage - Shows context, session, GitHub sync status sections - Dev-only (import.meta.env.DEV) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Add full Docker image defaults, fix actor deadlocks, and improve dev experience - Add Dockerfile.full and --all flag to install-agent CLI for pre-built images - Centralize Docker image constant (FULL_IMAGE) pinned to 0.3.1-full - Remove examples/shared/Dockerfile{,.dev} and daytona snapshot example - Expand Docker docs with full runnable Dockerfile - Fix self-deadlock in createWorkbenchSession (fire-and-forget provisioning) - Audit and convert 12 task actions from wait:true to wait:false - Add bun --hot for dev backend hot reload - Remove --force from pnpm install in dev Dockerfile for faster startup - Add env_file support to compose.dev.yaml for automatic credential loading - Add mock frontend compose config and dev panel - Update CLAUDE.md with wait:true policy and dev environment setup Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * WIP: async action fixes and interest manager Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Fix Foundry UI bugs: org names, hanging sessions, and wrong repo creation - Fix org display name using GitHub description instead of name field - Fix createWorkbenchSession hanging when sandbox is provisioning - Fix auto-session creation retry storm on errors - Fix task creation using wrong repo due to React state race conditions - Remove Bun hot-reload from backend Dockerfile (causes port drift) - Add GitHub sync/install status to dev panel Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
170 lines
5.8 KiB
Docker
170 lines
5.8 KiB
Docker
# syntax=docker/dockerfile:1.10.0
|
|
|
|
# ============================================================================
|
|
# Build inspector frontend
|
|
# ============================================================================
|
|
FROM node:22-alpine AS inspector-build
|
|
WORKDIR /app
|
|
RUN npm install -g pnpm
|
|
|
|
# Copy package files for workspaces
|
|
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
|
|
COPY frontend/packages/inspector/package.json ./frontend/packages/inspector/
|
|
COPY sdks/cli-shared/package.json ./sdks/cli-shared/
|
|
COPY sdks/acp-http-client/package.json ./sdks/acp-http-client/
|
|
COPY sdks/persist-indexeddb/package.json ./sdks/persist-indexeddb/
|
|
COPY sdks/react/package.json ./sdks/react/
|
|
COPY sdks/typescript/package.json ./sdks/typescript/
|
|
|
|
# Install dependencies
|
|
RUN pnpm install --filter @sandbox-agent/inspector...
|
|
|
|
# Copy SDK source (with pre-generated types from docs/openapi.json)
|
|
COPY docs/openapi.json ./docs/
|
|
COPY sdks/cli-shared ./sdks/cli-shared
|
|
COPY sdks/acp-http-client ./sdks/acp-http-client
|
|
COPY sdks/persist-indexeddb ./sdks/persist-indexeddb
|
|
COPY sdks/react ./sdks/react
|
|
COPY sdks/typescript ./sdks/typescript
|
|
|
|
# Build cli-shared, acp-http-client, SDK, then persist-indexeddb and react (depends on SDK)
|
|
RUN cd sdks/cli-shared && pnpm exec tsup
|
|
RUN cd sdks/acp-http-client && pnpm exec tsup
|
|
RUN cd sdks/typescript && SKIP_OPENAPI_GEN=1 pnpm exec tsup
|
|
RUN cd sdks/persist-indexeddb && pnpm exec tsup
|
|
RUN cd sdks/react && pnpm exec tsup
|
|
|
|
# Copy inspector source and build
|
|
COPY frontend/packages/inspector ./frontend/packages/inspector
|
|
RUN cd frontend/packages/inspector && pnpm exec vite build
|
|
|
|
# ============================================================================
|
|
# AMD64 Builder - Uses cross-tools musl toolchain
|
|
# ============================================================================
|
|
FROM --platform=linux/amd64 rust:1.88.0 AS builder-amd64
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
|
|
RUN apt-get update && apt-get install -y \
|
|
musl-tools \
|
|
musl-dev \
|
|
llvm-14-dev \
|
|
libclang-14-dev \
|
|
clang-14 \
|
|
libssl-dev \
|
|
pkg-config \
|
|
ca-certificates \
|
|
g++ \
|
|
g++-multilib \
|
|
git \
|
|
curl \
|
|
wget && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
# Download cross-tools musl toolchain
|
|
RUN wget -q https://github.com/cross-tools/musl-cross/releases/latest/download/x86_64-unknown-linux-musl.tar.xz && \
|
|
tar -xf x86_64-unknown-linux-musl.tar.xz -C /opt/ && \
|
|
rm x86_64-unknown-linux-musl.tar.xz && \
|
|
rustup target add x86_64-unknown-linux-musl
|
|
|
|
ENV PATH="/opt/x86_64-unknown-linux-musl/bin:$PATH" \
|
|
LIBCLANG_PATH=/usr/lib/llvm-14/lib \
|
|
CLANG_PATH=/usr/bin/clang-14 \
|
|
CC_x86_64_unknown_linux_musl=x86_64-unknown-linux-musl-gcc \
|
|
CXX_x86_64_unknown_linux_musl=x86_64-unknown-linux-musl-g++ \
|
|
AR_x86_64_unknown_linux_musl=x86_64-unknown-linux-musl-ar \
|
|
CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER=x86_64-unknown-linux-musl-gcc \
|
|
CARGO_INCREMENTAL=0 \
|
|
CARGO_NET_GIT_FETCH_WITH_CLI=true
|
|
|
|
# Build OpenSSL for musl
|
|
ENV SSL_VER=1.1.1w
|
|
RUN wget https://www.openssl.org/source/openssl-$SSL_VER.tar.gz && \
|
|
tar -xzf openssl-$SSL_VER.tar.gz && \
|
|
cd openssl-$SSL_VER && \
|
|
./Configure no-shared no-async --prefix=/musl --openssldir=/musl/ssl linux-x86_64 && \
|
|
make -j$(nproc) && \
|
|
make install_sw && \
|
|
cd .. && \
|
|
rm -rf openssl-$SSL_VER*
|
|
|
|
ENV OPENSSL_DIR=/musl \
|
|
OPENSSL_INCLUDE_DIR=/musl/include \
|
|
OPENSSL_LIB_DIR=/musl/lib \
|
|
PKG_CONFIG_ALLOW_CROSS=1 \
|
|
RUSTFLAGS="-C target-feature=+crt-static -C link-arg=-static-libgcc"
|
|
|
|
WORKDIR /build
|
|
COPY . .
|
|
|
|
# Copy pre-built inspector frontend
|
|
COPY --from=inspector-build /app/frontend/packages/inspector/dist ./frontend/packages/inspector/dist
|
|
|
|
RUN --mount=type=cache,target=/usr/local/cargo/registry \
|
|
--mount=type=cache,target=/usr/local/cargo/git \
|
|
--mount=type=cache,target=/build/target \
|
|
cargo build -p sandbox-agent --release --target x86_64-unknown-linux-musl && \
|
|
cp target/x86_64-unknown-linux-musl/release/sandbox-agent /sandbox-agent
|
|
|
|
# ============================================================================
|
|
# ARM64 Builder - Uses Alpine with native musl
|
|
# ============================================================================
|
|
FROM --platform=linux/arm64 rust:1.88-alpine AS builder-arm64
|
|
|
|
RUN apk add --no-cache \
|
|
musl-dev \
|
|
clang \
|
|
llvm-dev \
|
|
openssl-dev \
|
|
openssl-libs-static \
|
|
pkgconfig \
|
|
git \
|
|
curl \
|
|
build-base
|
|
|
|
RUN rustup target add aarch64-unknown-linux-musl
|
|
|
|
ENV CARGO_INCREMENTAL=0 \
|
|
CARGO_NET_GIT_FETCH_WITH_CLI=true \
|
|
RUSTFLAGS="-C target-feature=+crt-static"
|
|
|
|
WORKDIR /build
|
|
COPY . .
|
|
|
|
# Copy pre-built inspector frontend
|
|
COPY --from=inspector-build /app/frontend/packages/inspector/dist ./frontend/packages/inspector/dist
|
|
|
|
RUN --mount=type=cache,target=/usr/local/cargo/registry \
|
|
--mount=type=cache,target=/usr/local/cargo/git \
|
|
--mount=type=cache,target=/build/target \
|
|
cargo build -p sandbox-agent --release --target aarch64-unknown-linux-musl && \
|
|
cp target/aarch64-unknown-linux-musl/release/sandbox-agent /sandbox-agent
|
|
|
|
# ============================================================================
|
|
# Select the appropriate builder based on target architecture
|
|
# ============================================================================
|
|
ARG TARGETARCH
|
|
FROM builder-${TARGETARCH} AS builder
|
|
|
|
# Runtime stage - minimal image
|
|
FROM debian:bookworm-slim
|
|
|
|
RUN apt-get update && apt-get install -y \
|
|
ca-certificates \
|
|
curl \
|
|
git && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
# Copy the binary from builder
|
|
COPY --from=builder /sandbox-agent /usr/local/bin/sandbox-agent
|
|
RUN chmod +x /usr/local/bin/sandbox-agent
|
|
|
|
# Create non-root user
|
|
RUN useradd -m -s /bin/bash sandbox
|
|
USER sandbox
|
|
WORKDIR /home/sandbox
|
|
|
|
EXPOSE 2468
|
|
|
|
ENTRYPOINT ["sandbox-agent"]
|
|
CMD ["server", "--host", "0.0.0.0", "--port", "2468"]
|