Загрузить файлы в «/»

2026-07-15 13:15:52 +00:00
parent c5c7a0344e
commit 1a544e4684
5 changed files with 1261 additions and 0 deletions
@@ -0,0 +1,103 @@
+# Agent Sandbox — isolated Linux environment for CLI coding agents
+# Designed for macOS hosts (Docker Desktop / OrbStack)
+FROM ubuntu:24.04
+
+ARG TARGETARCH
+ARG DEBIAN_FRONTEND=noninteractive
+ARG USERNAME=agent
+ARG USER_UID=1000
+ARG USER_GID=1000
+
+LABEL org.opencontainers.image.title="asandbox" \
+      org.opencontainers.image.description="Secure Docker sandbox for CLI AI coding agents" \
+      org.opencontainers.image.source="local"
+
+# Base tools
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        wget \
+        git \
+        gnupg \
+        openssh-client \
+        sudo \
+        less \
+        nano \
+        vim-tiny \
+        jq \
+        unzip \
+        zip \
+        tar \
+        gzip \
+        bzip2 \
+        xz-utils \
+        build-essential \
+        python3 \
+        python3-pip \
+        python3-venv \
+        python3-dev \
+        ripgrep \
+        fd-find \
+        tree \
+        rsync \
+        locales \
+        tzdata \
+        procps \
+        iproute2 \
+        iputils-ping \
+        dnsutils \
+    && rm -rf /var/lib/apt/lists/* \
+    && ln -sf /usr/bin/fdfind /usr/local/bin/fd \
+    && locale-gen en_US.UTF-8
+
+ENV LANG=en_US.UTF-8 \
+    LC_ALL=en_US.UTF-8 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1 \
+    NPM_CONFIG_UPDATE_NOTIFIER=false \
+    NPM_CONFIG_FUND=false
+
+# Node.js 22 LTS (many agents are Node-based)
+RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
+    && apt-get install -y --no-install-recommends nodejs \
+    && rm -rf /var/lib/apt/lists/* \
+    && corepack enable || true
+
+# uv (fast Python package manager)
+RUN curl -LsSf https://astral.sh/uv/install.sh | sh \
+    && mv /root/.local/bin/uv /usr/local/bin/uv \
+    && mv /root/.local/bin/uvx /usr/local/bin/uvx 2>/dev/null || true
+
+# Create non-root user matching host UID/GID when possible (macOS staff=20 often exists as dialout)
+RUN set -eux; \
+    if getent group "${USER_GID}" >/dev/null; then \
+      EXISTING_GROUP="$(getent group "${USER_GID}" | cut -d: -f1)"; \
+      useradd --uid "${USER_UID}" --gid "${USER_GID}" -m -s /bin/bash "${USERNAME}" \
+        || useradd --uid "${USER_UID}" -g "${EXISTING_GROUP}" -m -s /bin/bash "${USERNAME}"; \
+    else \
+      groupadd --gid "${USER_GID}" "${USERNAME}"; \
+      useradd --uid "${USER_UID}" --gid "${USER_GID}" -m -s /bin/bash "${USERNAME}"; \
+    fi; \
+    echo "${USERNAME} ALL=(ALL) NOPASSWD:ALL" > "/etc/sudoers.d/${USERNAME}"; \
+    chmod 0440 "/etc/sudoers.d/${USERNAME}"
+
+# installagent + shell integration (agents installed on demand inside shell)
+COPY installagent /usr/local/bin/installagent
+COPY entrypoint.sh /usr/local/bin/asandbox-entrypoint
+COPY bashrc.asandbox /etc/asandbox.bashrc
+RUN chmod +x /usr/local/bin/installagent /usr/local/bin/asandbox-entrypoint \
+    && echo 'source /etc/asandbox.bashrc' >> /home/${USERNAME}/.bashrc \
+    && echo 'source /etc/asandbox.bashrc' >> /home/${USERNAME}/.profile \
+    && mkdir -p /home/${USERNAME}/.local/bin /home/${USERNAME}/.npm-global/bin \
+    && chown -R ${USERNAME} /home/${USERNAME}
+
+# Workspace mount point (host path is also bind-mounted at real path)
+RUN mkdir -p /workspace && chown ${USERNAME} /workspace
+
+WORKDIR /workspace
+USER ${USERNAME}
+ENV HOME=/home/${USERNAME} \
+    PATH="/home/${USERNAME}/.local/bin:/home/${USERNAME}/.npm-global/bin:/usr/local/bin:${PATH}"
+
+ENTRYPOINT ["/usr/local/bin/asandbox-entrypoint"]
+CMD ["bash", "-l"]