c858cb816c
Add git, gh, openssh-client, curl, and sudo to the computer image with a docker smoke test. Mount deployment-owner project workspacePath at /home/rakazo/project, align /home/rakazo file paths with shell, and resolve default branch from origin/HEAD. Inject the owner GitHub token from encrypted deployment settings only into project computers; enforce branch-only push, block force-push, and require approval before the first push or gh pr in a run. Add runaway guards (tool fuse and stall pause), collapse live narration, fix streaming progress merge, DE run strings, and Lead as the project main Oo name. Fix evo-deploy test flake. Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
76 lines
2.8 KiB
Docker
76 lines
2.8 KiB
Docker
FROM debian:bookworm-slim AS capture-builder
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
build-essential \
|
|
libx11-dev \
|
|
libxdamage-dev \
|
|
libxext-dev \
|
|
libxfixes-dev \
|
|
libxtst-dev \
|
|
libpng-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
WORKDIR /build
|
|
COPY xcapture.c .
|
|
RUN cc -O3 -fPIC -shared -Wall -Wextra -Werror -o librakazo-xcapture.so xcapture.c \
|
|
-lX11 -lXext -lXdamage -lXfixes -lXtst -lpng
|
|
|
|
FROM debian:bookworm-slim
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
xvfb \
|
|
x11vnc \
|
|
fluxbox \
|
|
xterm \
|
|
xdotool \
|
|
x11-utils \
|
|
x11-xserver-utils \
|
|
imagemagick \
|
|
novnc \
|
|
websockify \
|
|
python3 \
|
|
ca-certificates \
|
|
procps \
|
|
bash \
|
|
git \
|
|
gh \
|
|
openssh-client \
|
|
curl \
|
|
sudo \
|
|
chromium \
|
|
fonts-liberation \
|
|
fonts-dejavu-core \
|
|
dbus-x11 \
|
|
xdg-utils \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& groupadd --gid 1000 rakazo \
|
|
&& useradd --uid 1000 --gid rakazo --create-home --shell /bin/bash rakazo \
|
|
&& usermod -aG sudo rakazo \
|
|
&& printf '%s\n' 'rakazo ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/rakazo \
|
|
&& chmod 440 /etc/sudoers.d/rakazo \
|
|
&& mkdir -p /etc/rakazo/fluxbox \
|
|
&& printf '%s\n' '#!/bin/sh' 'exec xsetroot -solid "#111113" "$@"' > /usr/bin/fbsetbg \
|
|
&& chmod +x /usr/bin/fbsetbg \
|
|
&& ln -sfn /bin/true /usr/bin/xmessage
|
|
ENV DISPLAY=:1
|
|
ENV HOME=/home/rakazo
|
|
WORKDIR /home/rakazo
|
|
# --chmod normalizes modes: a restrictive host umask (e.g. 077 on hardened hosts) would
|
|
# otherwise leave these files unreadable to USER 1000 at runtime.
|
|
COPY --chmod=755 start.sh /usr/local/bin/rakazo-computer
|
|
COPY --chmod=755 control.py /usr/local/bin/rakazo-computer-control
|
|
COPY --from=capture-builder /build/librakazo-xcapture.so /usr/local/lib/librakazo-xcapture.so
|
|
COPY --chmod=755 rakazo-browser /usr/local/bin/rakazo-browser
|
|
COPY --chmod=755 rakazo-page-browser /usr/local/bin/rakazo-page-browser
|
|
COPY --chmod=644 rakazo-browser.desktop /usr/share/applications/rakazo-browser.desktop
|
|
COPY --chmod=644 fluxbox.init /etc/rakazo/fluxbox/init
|
|
COPY --chmod=644 fluxbox.apps /etc/rakazo/fluxbox/apps
|
|
COPY --chmod=644 fluxbox.menu /etc/rakazo/fluxbox/menu
|
|
COPY --chmod=644 embed.html /usr/share/novnc/embed.html
|
|
COPY --chmod=644 clipboard-bridge.js /usr/share/novnc/clipboard-bridge.js
|
|
COPY --chmod=644 mobile-keyboard.js /usr/share/novnc/mobile-keyboard.js
|
|
# Strip CR so shebangs work even if the build context came from a CRLF checkout.
|
|
RUN ldconfig \
|
|
&& sed -i 's/\r$//' /usr/local/bin/rakazo-computer /usr/local/bin/rakazo-computer-control /usr/local/bin/rakazo-browser /usr/local/bin/rakazo-page-browser \
|
|
/etc/rakazo/fluxbox/init /etc/rakazo/fluxbox/apps /etc/rakazo/fluxbox/menu
|
|
EXPOSE 7070 6080 6081 6082 6083 6084 6085 6086 6087 6088 6089 6090 6091 6092 6093 6094 6095
|
|
USER 1000:1000
|
|
CMD ["/usr/local/bin/rakazo-computer"]
|