51decc6535
When the gateway runs inside a Docker container and creates sandbox containers, volume mount paths need to be host paths, not container paths. Changes: - Add remapPathForDinD() function to remap container paths to host paths - Add CLAWDBOT_SANDBOX_HOST_CONFIG_DIR and CLAWDBOT_SANDBOX_HOST_WORKSPACE_DIR environment variables to docker-compose.yml - Use path remapping in both sandbox container and browser sandbox creation - Add Docker CLI to gateway Dockerfile for Docker-in-Docker support The path remapping is a no-op when the environment variables are not set, so bare metal installations are unaffected. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
53 lines
1.8 KiB
Docker
53 lines
1.8 KiB
Docker
FROM node:22-bookworm
|
|
|
|
# Install Bun (required for build scripts)
|
|
RUN curl -fsSL https://bun.sh/install | bash
|
|
ENV PATH="/root/.bun/bin:${PATH}"
|
|
|
|
# Install Docker CLI from official Docker repo (Debian docker.io is too old for Docker Desktop)
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends ca-certificates curl && \
|
|
install -m 0755 -d /etc/apt/keyrings && \
|
|
curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc && \
|
|
chmod a+r /etc/apt/keyrings/docker.asc && \
|
|
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian bookworm stable" > /etc/apt/sources.list.d/docker.list && \
|
|
apt-get update && \
|
|
apt-get install -y --no-install-recommends docker-ce-cli && \
|
|
apt-get clean && \
|
|
rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*
|
|
|
|
RUN corepack enable
|
|
|
|
WORKDIR /app
|
|
|
|
ARG CLAWDBOT_DOCKER_APT_PACKAGES=""
|
|
RUN if [ -n "$CLAWDBOT_DOCKER_APT_PACKAGES" ]; then \
|
|
apt-get update && \
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends $CLAWDBOT_DOCKER_APT_PACKAGES && \
|
|
apt-get clean && \
|
|
rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*; \
|
|
fi
|
|
|
|
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
|
|
COPY ui/package.json ./ui/package.json
|
|
COPY patches ./patches
|
|
COPY scripts ./scripts
|
|
|
|
RUN pnpm install --frozen-lockfile
|
|
|
|
COPY . .
|
|
RUN CLAWDBOT_A2UI_SKIP_MISSING=1 pnpm build
|
|
# Force pnpm for UI build (Bun may fail on ARM/Synology architectures)
|
|
ENV CLAWDBOT_PREFER_PNPM=1
|
|
RUN pnpm ui:install
|
|
RUN pnpm ui:build
|
|
|
|
ENV NODE_ENV=production
|
|
|
|
# Security hardening: Run as non-root user
|
|
# The node:22-bookworm image includes a 'node' user (uid 1000)
|
|
# This reduces the attack surface by preventing container escape via root privileges
|
|
USER node
|
|
|
|
CMD ["node", "dist/index.js"]
|