Richard ZinkandClaude Opus 5.5
5b569b6835
- Sandbox (bubblewrap) for non-admin shell/git, MCP per-user rights, hard budgets and quotas, login rate limiting, audit log and backups - Ghidra headless decompilation (ARM64 natives built from source), binary_info tool, clean room / deep workflow per session - Recreate skill and commands for analysing and re-building old software - File checkpoints with rewind/restore, background shells (bash_output, kill_shell) - web_search tool (DuckDuckGo, SearXNG, Brave, Tavily) - In-app dialogs and toasts instead of browser dialogs - 15 base themes (trilium-themes palettes plus Nord, VS Code, GitHub, Catppuccin, One, Dracula, Rose Pine, Everforest, Kanagawa) with light/dark/auto switcher and license notes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
53 lines
2.3 KiB
Docker
53 lines
2.3 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# --- web UI (PWA) -------------------------------------------------------------
|
|
FROM node:22-alpine AS web
|
|
WORKDIR /web
|
|
COPY web/package.json web/package-lock.json ./
|
|
RUN npm ci --no-audit --no-fund
|
|
COPY web/ ./
|
|
RUN npm run build
|
|
|
|
# --- server -------------------------------------------------------------------
|
|
FROM rust:1-bookworm AS server
|
|
WORKDIR /src
|
|
COPY config.example.toml ./
|
|
COPY server/Cargo.toml server/Cargo.lock ./server/
|
|
# Cache dependencies separately from the sources.
|
|
RUN mkdir -p server/src && echo 'fn main(){}' > server/src/main.rs \
|
|
&& cd server && cargo build --release && rm -rf src
|
|
COPY server/src ./server/src
|
|
RUN cd server && touch src/main.rs && cargo build --release
|
|
|
|
# --- runtime ------------------------------------------------------------------
|
|
# Node is included so agents can work on JS projects and run npx-based MCP servers.
|
|
FROM node:22-bookworm-slim
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates bash git curl wget ripgrep jq less procps file bubblewrap \
|
|
unzip zip xz-utils bzip2 p7zip-full unar innoextract unshield cabextract msitools arj lhasa \
|
|
python3 python3-pip python3-venv pipx \
|
|
build-essential pkg-config libssl-dev cmake zlib1g-dev binutils-multiarch \
|
|
chromium fonts-dejavu-core fonts-noto-color-emoji poppler-utils openmpt123 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
COPY --from=server /src/server/target/release/codecraft /usr/local/bin/codecraft
|
|
COPY --from=web /web/dist /app/web
|
|
COPY server/ghidra /app/ghidra
|
|
COPY server/resources /app/resources
|
|
# The agent's home lives on the data volume: tools it installs in user space
|
|
# (pip --user, pipx, rustup, npm -g, downloaded binaries) survive rebuilds.
|
|
ENV CODECRAFT_WEB=/app/web \
|
|
CODECRAFT_CONFIG=/data/config.toml \
|
|
HOME=/data/home \
|
|
PATH=/data/home/.local/bin:/data/home/.cargo/bin:/data/home/.npm-global/bin:/usr/local/bin:/usr/bin:/bin \
|
|
NPM_CONFIG_PREFIX=/data/home/.npm-global \
|
|
PIP_BREAK_SYSTEM_PACKAGES=1 \
|
|
PIPX_HOME=/data/home/.local/pipx \
|
|
PIPX_BIN_DIR=/data/home/.local/bin \
|
|
RUST_LOG=info
|
|
RUN mkdir -p /data /workspace && chmod 777 /data /workspace
|
|
VOLUME ["/data"]
|
|
EXPOSE 8787
|
|
# Run as the host user (see docker-compose.yml) so files in /workspace keep their owner.
|
|
USER 1000:1000
|
|
ENTRYPOINT ["codecraft"]
|