f14b112cdd
* Broker GitHub integration token for computer git/gh Use the Integrations GitHub MCP secret for supervisor broker sessions so home and project computers can clone private repos without PAT prompts. Add rakazo git/gh shims, push policy, deploy image rebuild, and tests. Co-authored-by: cynarAI <cynarAI@users.noreply.github.com> * ci: retrigger product checks after runner timeout Co-authored-by: cynarAI <cynarAI@users.noreply.github.com> * ci: run product change detection on GitHub-hosted runners Co-authored-by: cynarAI <cynarAI@users.noreply.github.com> * style: format deployment-github-token Co-authored-by: cynarAI <cynarAI@users.noreply.github.com> * ci: self-hosted change detection with timeout and fail-open gate Keep Detect product changes on evoo-ci with a 10-minute cap, continue-on-error filtering, and a fail-open product flag when detection fails. Downstream jobs and Product CI treat a failed or timed-out changes job as full product impact. Add job timeouts on remaining self-hosted ci jobs. Co-authored-by: cynarAI <cynarAI@users.noreply.github.com> * fix: continueRun tests and broker home path guard - Skip broker workspace resolution when computer homeKey is absent - Add shared continue-run Prisma/home/secretStore test stubs - Update computer PATH expectation and evo-deploy command sequence - Remove unused executor imports flagged by Biome Co-authored-by: cynarAI <cynarAI@users.noreply.github.com> * style: Biome format and import order for broker CI Co-authored-by: cynarAI <cynarAI@users.noreply.github.com> * fix: compose YAML, typecheck for broker stubs and GitHub hint Co-authored-by: cynarAI <cynarAI@users.noreply.github.com> * ci: retrigger Product CI after compose and typecheck fixes Co-authored-by: cynarAI <cynarAI@users.noreply.github.com> * ci: retry Product CI queue Co-authored-by: cynarAI <cynarAI@users.noreply.github.com> * ci: give self-hosted Web E2E a 45m job timeout Co-authored-by: cynarAI <cynarAI@users.noreply.github.com> * ci: extend Web E2E job timeout to 60m on self-hosted runners Co-authored-by: cynarAI <cynarAI@users.noreply.github.com> * fix: keep github-broker-token off the core browser barrel Export broker HMAC helpers only from @rakazo/core/node/github-broker-token so Vite does not pull node:crypto into the web client and break Playwright signup. Co-authored-by: cynarAI <cynarAI@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
76 lines
3.0 KiB
Docker
76 lines
3.0 KiB
Docker
FROM debian:bookworm-slim AS capture-builder
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
build-essential \
|
|
libx11-dev \
|
|
libxdamage-dev \
|
|
libxext-dev \
|
|
libxfixes-dev \
|
|
libxtst-dev \
|
|
libpng-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
WORKDIR /build
|
|
COPY xcapture.c .
|
|
RUN cc -O3 -fPIC -shared -Wall -Wextra -Werror -o librakazo-xcapture.so xcapture.c \
|
|
-lX11 -lXext -lXdamage -lXfixes -lXtst -lpng
|
|
|
|
FROM debian:bookworm-slim
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
xvfb \
|
|
x11vnc \
|
|
fluxbox \
|
|
xterm \
|
|
xdotool \
|
|
x11-utils \
|
|
x11-xserver-utils \
|
|
imagemagick \
|
|
novnc \
|
|
websockify \
|
|
python3 \
|
|
ca-certificates \
|
|
procps \
|
|
bash \
|
|
git \
|
|
gh \
|
|
openssh-client \
|
|
curl \
|
|
chromium \
|
|
fonts-liberation \
|
|
fonts-dejavu-core \
|
|
dbus-x11 \
|
|
xdg-utils \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& groupadd --gid 1000 rakazo \
|
|
&& useradd --uid 1000 --gid rakazo --create-home --shell /bin/bash rakazo \
|
|
&& mkdir -p /etc/rakazo/fluxbox /usr/local/lib/rakazo/bin \
|
|
&& printf '%s\n' '#!/bin/sh' 'exec xsetroot -solid "#111113" "$@"' > /usr/bin/fbsetbg \
|
|
&& chmod +x /usr/bin/fbsetbg \
|
|
&& ln -sfn /bin/true /usr/bin/xmessage
|
|
ENV DISPLAY=:1
|
|
ENV HOME=/home/rakazo
|
|
ENV PATH=/usr/local/lib/rakazo/bin:/home/rakazo/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
|
WORKDIR /home/rakazo
|
|
# --chmod normalizes modes: a restrictive host umask (e.g. 077 on hardened hosts) would
|
|
# otherwise leave these files unreadable to USER 1000 at runtime.
|
|
COPY --chmod=755 bin/rakazo-git bin/rakazo-gh /usr/local/lib/rakazo/bin/
|
|
RUN ln -sf /usr/local/lib/rakazo/bin/rakazo-git /usr/local/lib/rakazo/bin/git \
|
|
&& ln -sf /usr/local/lib/rakazo/bin/rakazo-gh /usr/local/lib/rakazo/bin/gh
|
|
COPY --chmod=755 start.sh /usr/local/bin/rakazo-computer
|
|
COPY --chmod=755 control.py /usr/local/bin/rakazo-computer-control
|
|
COPY --from=capture-builder /build/librakazo-xcapture.so /usr/local/lib/librakazo-xcapture.so
|
|
COPY --chmod=755 rakazo-browser /usr/local/bin/rakazo-browser
|
|
COPY --chmod=755 rakazo-page-browser /usr/local/bin/rakazo-page-browser
|
|
COPY --chmod=644 rakazo-browser.desktop /usr/share/applications/rakazo-browser.desktop
|
|
COPY --chmod=644 fluxbox.init /etc/rakazo/fluxbox/init
|
|
COPY --chmod=644 fluxbox.apps /etc/rakazo/fluxbox/apps
|
|
COPY --chmod=644 fluxbox.menu /etc/rakazo/fluxbox/menu
|
|
COPY --chmod=644 embed.html /usr/share/novnc/embed.html
|
|
COPY --chmod=644 clipboard-bridge.js /usr/share/novnc/clipboard-bridge.js
|
|
COPY --chmod=644 mobile-keyboard.js /usr/share/novnc/mobile-keyboard.js
|
|
# Strip CR so shebangs work even if the build context came from a CRLF checkout.
|
|
RUN ldconfig \
|
|
&& sed -i 's/\r$//' /usr/local/bin/rakazo-computer /usr/local/bin/rakazo-computer-control /usr/local/bin/rakazo-browser /usr/local/bin/rakazo-page-browser \
|
|
/etc/rakazo/fluxbox/init /etc/rakazo/fluxbox/apps /etc/rakazo/fluxbox/menu
|
|
EXPOSE 7070 6080 6081 6082 6083 6084 6085 6086 6087 6088 6089 6090 6091 6092 6093 6094 6095
|
|
USER 1000:1000
|
|
CMD ["/usr/local/bin/rakazo-computer"]
|