f136451e22
Agents kept configuring git with RAKAZO_GITHUB_BROKER_RUN_TOKEN as a password because the system prompt listed it among "managed credentials" to use in shell commands. GitHub rejects it, and the agent then asks the user for a personal access token. - List only the user's own agent secrets in that instruction; the broker variables stay in the environment for the git shim. - Make /usr/bin/git the shim as well, so git called by absolute path still goes through the broker; the real binary moves out of PATH. - Prompt no longer names the broker variable. Claude-Session: https://claude.ai/code/session_01Tgvrj34NMnaqvtgvruYQZZ Co-authored-by: Claude <noreply@anthropic.com>
80 lines
3.3 KiB
Docker
80 lines
3.3 KiB
Docker
FROM debian:bookworm-slim AS capture-builder
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
build-essential \
|
|
libx11-dev \
|
|
libxdamage-dev \
|
|
libxext-dev \
|
|
libxfixes-dev \
|
|
libxtst-dev \
|
|
libpng-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
WORKDIR /build
|
|
COPY xcapture.c .
|
|
RUN cc -O3 -fPIC -shared -Wall -Wextra -Werror -o librakazo-xcapture.so xcapture.c \
|
|
-lX11 -lXext -lXdamage -lXfixes -lXtst -lpng
|
|
|
|
FROM debian:bookworm-slim
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
xvfb \
|
|
x11vnc \
|
|
fluxbox \
|
|
xterm \
|
|
xdotool \
|
|
x11-utils \
|
|
x11-xserver-utils \
|
|
imagemagick \
|
|
novnc \
|
|
websockify \
|
|
python3 \
|
|
ca-certificates \
|
|
procps \
|
|
bash \
|
|
git \
|
|
gh \
|
|
openssh-client \
|
|
curl \
|
|
chromium \
|
|
fonts-liberation \
|
|
fonts-dejavu-core \
|
|
dbus-x11 \
|
|
xdg-utils \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& groupadd --gid 1000 rakazo \
|
|
&& useradd --uid 1000 --gid rakazo --create-home --shell /bin/bash rakazo \
|
|
&& mkdir -p /etc/rakazo/fluxbox /usr/local/lib/rakazo/bin \
|
|
&& printf '%s\n' '#!/bin/sh' 'exec xsetroot -solid "#111113" "$@"' > /usr/bin/fbsetbg \
|
|
&& chmod +x /usr/bin/fbsetbg \
|
|
&& ln -sfn /bin/true /usr/bin/xmessage
|
|
ENV DISPLAY=:1
|
|
ENV HOME=/home/rakazo
|
|
ENV PATH=/usr/local/lib/rakazo/bin:/home/rakazo/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
|
WORKDIR /home/rakazo
|
|
# --chmod normalizes modes: a restrictive host umask (e.g. 077 on hardened hosts) would
|
|
# otherwise leave these files unreadable to USER 1000 at runtime.
|
|
COPY --chmod=755 bin/rakazo-git bin/rakazo-gh bin/rakazo-broker /usr/local/lib/rakazo/bin/
|
|
# /usr/bin/git is the shim too, so calling git by absolute path still goes through the broker.
|
|
RUN mkdir -p /usr/local/libexec/rakazo \
|
|
&& mv /usr/bin/git /usr/local/libexec/rakazo/git \
|
|
&& ln -sf /usr/local/lib/rakazo/bin/rakazo-git /usr/bin/git \
|
|
&& ln -sf /usr/local/lib/rakazo/bin/rakazo-git /usr/local/lib/rakazo/bin/git \
|
|
&& ln -sf /usr/local/lib/rakazo/bin/rakazo-gh /usr/local/lib/rakazo/bin/gh
|
|
COPY --chmod=755 start.sh /usr/local/bin/rakazo-computer
|
|
COPY --chmod=755 control.py /usr/local/bin/rakazo-computer-control
|
|
COPY --from=capture-builder /build/librakazo-xcapture.so /usr/local/lib/librakazo-xcapture.so
|
|
COPY --chmod=755 rakazo-browser /usr/local/bin/rakazo-browser
|
|
COPY --chmod=755 rakazo-page-browser /usr/local/bin/rakazo-page-browser
|
|
COPY --chmod=644 rakazo-browser.desktop /usr/share/applications/rakazo-browser.desktop
|
|
COPY --chmod=644 fluxbox.init /etc/rakazo/fluxbox/init
|
|
COPY --chmod=644 fluxbox.apps /etc/rakazo/fluxbox/apps
|
|
COPY --chmod=644 fluxbox.menu /etc/rakazo/fluxbox/menu
|
|
COPY --chmod=644 embed.html /usr/share/novnc/embed.html
|
|
COPY --chmod=644 clipboard-bridge.js /usr/share/novnc/clipboard-bridge.js
|
|
COPY --chmod=644 mobile-keyboard.js /usr/share/novnc/mobile-keyboard.js
|
|
# Strip CR so shebangs work even if the build context came from a CRLF checkout.
|
|
RUN ldconfig \
|
|
&& sed -i 's/\r$//' /usr/local/bin/rakazo-computer /usr/local/bin/rakazo-computer-control /usr/local/bin/rakazo-browser /usr/local/bin/rakazo-page-browser \
|
|
/etc/rakazo/fluxbox/init /etc/rakazo/fluxbox/apps /etc/rakazo/fluxbox/menu
|
|
EXPOSE 7070 6080 6081 6082 6083 6084 6085 6086 6087 6088 6089 6090 6091 6092 6093 6094 6095
|
|
USER 1000:1000
|
|
CMD ["/usr/local/bin/rakazo-computer"]
|