From bf99292f43c5e9de0be40e83dc89b53a57dc345a Mon Sep 17 00:00:00 2001 From: Richard Zink Date: Mon, 9 Nov 2026 15:39:48 +0100 Subject: [PATCH] Docker CLI in the image (static client for a mounted host socket) Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 3 +++ Dockerfile | 10 ++++++++++ docs/MOVING.md | 3 +-- web/src/whatsnew.ts | 4 ++++ 4 files changed, 18 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c66db65..29bd2ef 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,9 @@ until 1.0, minor versions may contain breaking changes. ### Added +- The image contains the Docker CLI (static client). With the host's `/var/run/docker.sock` + mounted (and its group), admins' agents and terminals can use the host's Docker; + `scripts/move-server.sh --docker-sock` sets this up on a new host. - `scripts/move-server.sh --tools-dir DIR`: agent home, users' homes and `/tmp` on a separate disk. ## [v202611-00005] – 2026-11-09 diff --git a/Dockerfile b/Dockerfile index 36e271e..3740996 100644 --- a/Dockerfile +++ b/Dockerfile @@ -67,6 +67,14 @@ RUN mkdir -p server/src && echo 'fn main(){}' > server/src/main.rs \ && mkdir -p /out && cp target/x86_64-unknown-linux-musl/release/codecraft /out/codecraft-linux-x86_64 \ && cp target/aarch64-unknown-linux-musl/release/codecraft /out/codecraft-linux-aarch64 +# --- Docker CLI (static client; the daemon is the host's via the mounted socket) -- +FROM toolchain AS dockercli +ARG TARGETARCH +ARG DOCKER_VERSION=29.9.3 +RUN case "$TARGETARCH" in amd64) arch=x86_64 ;; arm64) arch=aarch64 ;; *) echo "unsupported $TARGETARCH" >&2; exit 1 ;; esac \ + && curl -fsSL "https://download.docker.com/linux/static/stable/$arch/docker-$DOCKER_VERSION.tgz" | tar -xz -C /tmp docker/docker \ + && install -m 0755 /tmp/docker/docker /docker + # --- runtime ------------------------------------------------------------------ # Node is included so agents can work on JS projects and run npx-based MCP servers. FROM node:22-bookworm-slim @@ -85,6 +93,8 @@ RUN npm install -g typescript@5 typescript-language-server pyright && npm cache COPY --from=server /codecraft /usr/local/bin/codecraft COPY --from=web /web/dist /app/web COPY --from=cli /out /app/cli +# Used with a mounted /var/run/docker.sock (see docs/MOVING.md, --docker-sock). +COPY --from=dockercli /docker /usr/local/bin/docker COPY server/ghidra /app/ghidra COPY server/resources /app/resources # The agent's home lives on the data volume: tools it installs in user space diff --git a/docs/MOVING.md b/docs/MOVING.md index 7783b58..818e6a1 100644 --- a/docs/MOVING.md +++ b/docs/MOVING.md @@ -104,8 +104,7 @@ any host folder. - Admins' agents and terminals (they run without sandbox) can use it. - Sandboxed users do not see the socket (the sandbox does not mount `/var/run`). - `docker` and `docker-compose` commands always need an approval, except in *bypass* mode. -- The image has no Docker CLI; agents install the static CLI into their home when they need it - (on the tools disk with `--tools-dir`). +- The image contains the Docker CLI (static client); the daemon is the host's. The current host has the same setup in its local `docker-compose.override.yml` (group 997). diff --git a/web/src/whatsnew.ts b/web/src/whatsnew.ts index a38ee4f..9ccd330 100644 --- a/web/src/whatsnew.ts +++ b/web/src/whatsnew.ts @@ -3,6 +3,10 @@ * under "unreleased"; scripts/release.sh renames the key to the release version. */ export const WHATS_NEW: Record = { + unreleased: { + en: ["Docker CLI in the image – with the host's Docker socket mounted, admins' agents and terminals can use Docker"], + de: ["Docker-CLI im Image – mit eingehängtem Docker-Socket können Admin-Agents und -Terminals Docker nutzen"], + }, "202611-00005": { en: ["Agents commit with the git name and e-mail from your settings – also in repositories with their own identity"], de: ["Agents committen mit Git-Name und -E-Mail aus deinen Einstellungen – auch in Repos mit eigener Identität"],