b1d9b4cd5b
Add ffmpeg, sox, imagemagick, jq, python3 so the reviewer can verify audio encoding, image assets, and data without claiming tools are missing.
62 lines
2.0 KiB
Docker
62 lines
2.0 KiB
Docker
# EJClaw Reviewer Container
|
|
# Runs Claude/Codex agent in read-only isolated environment for code review.
|
|
# Build from project root: docker build -f container/Dockerfile -t ejclaw-reviewer:latest .
|
|
|
|
FROM node:22-slim
|
|
|
|
# System dependencies
|
|
RUN apt-get update --fix-missing && apt-get install -y --no-install-recommends \
|
|
chromium \
|
|
fonts-liberation \
|
|
fonts-noto-cjk \
|
|
fonts-noto-color-emoji \
|
|
curl \
|
|
git \
|
|
ffmpeg \
|
|
sox \
|
|
imagemagick \
|
|
jq \
|
|
python3 \
|
|
&& curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
|
|
| dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \
|
|
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
|
|
> /etc/apt/sources.list.d/github-cli.list \
|
|
&& apt-get update && apt-get install -y --no-install-recommends gh \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Chromium paths for Playwright/agent-browser
|
|
ENV AGENT_BROWSER_EXECUTABLE_PATH=/usr/bin/chromium
|
|
ENV PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/usr/bin/chromium
|
|
|
|
# Install Claude Code and Codex CLI globally
|
|
RUN npm install -g @anthropic-ai/claude-code @openai/codex
|
|
|
|
# Create app directory
|
|
WORKDIR /app
|
|
|
|
# Copy host's agent-runner (same code, same SDK version)
|
|
COPY runners/agent-runner/package*.json ./
|
|
RUN npm install
|
|
COPY runners/agent-runner/ ./
|
|
RUN npm run build
|
|
|
|
# Create workspace directories
|
|
RUN mkdir -p /workspace/project /workspace/group /workspace/global \
|
|
/workspace/ipc/messages /workspace/ipc/input
|
|
|
|
# Create entrypoint script
|
|
RUN printf '#!/bin/bash\nset -e\ncat > /tmp/input.json\nnode /app/dist/index.js < /tmp/input.json\n' \
|
|
> /app/entrypoint.sh && chmod +x /app/entrypoint.sh
|
|
|
|
# Set ownership to node user (non-root)
|
|
RUN chown -R node:node /workspace /home/node
|
|
|
|
# Switch to non-root user
|
|
USER node
|
|
|
|
# Working directory is the read-only project mount
|
|
WORKDIR /workspace/project
|
|
|
|
# Entry point reads JSON from stdin, outputs JSON to stdout
|
|
ENTRYPOINT ["/app/entrypoint.sh"]
|