deploy: container image for a Dockerfile-based PaaS (v0.434.0) - #808
Open
rosinghal wants to merge 6 commits into
Open
deploy: container image for a Dockerfile-based PaaS (v0.434.0)#808rosinghal wants to merge 6 commits into
rosinghal wants to merge 6 commits into
Conversation
Ships the full session runtime — tmux, ttyd, git, gh and the claude CLI — on node:22-bookworm-slim, with both bundles built in a builder stage. Runs as uid 1000, not root: the unattended lane launches claude with --dangerously-skip-permissions, which the CLI refuses under root. $HOME is a real writable directory (the deploy mounts it) because claude-launch.sh seeds ~/.claude.json in the home root to accept the folder-trust dialog, and because the credential dir and transcripts the console reads back both live there. en_US.UTF-8 is generated since session-backend.ts hardcodes it into every pane. No host, tenant or token appears here — deployment identity is runtime config. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Multi-stage Dockerfile plus .dockerignore, CHECKS and docker-entrypoint.sh, building both bundles and shipping the full session runtime (tmux, ttyd, git, gh, claude) on node:22-bookworm-slim. Three constraints the image has to hold, all load-bearing: - it runs as uid 1000, not root — the unattended lane launches claude with --dangerously-skip-permissions, which the CLI refuses under uid 0; - $HOME is a real writable directory the deploy mounts as a volume, because claude-launch.sh seeds ~/.claude.json to pre-accept the folder-trust dialog and a failed seed hangs every session on it; the credentials and the transcripts the console reads back live under the same home; - en_US.UTF-8 is generated, since session-backend.ts hardcodes it into every tmux pane and tmux string-matches it to decide UTF-8 mode. AOS_UID_ISOLATION stays off, so the app's own /terminal/ proxy keeps one published port enough. No host, tenant, email or token is baked in — all deployment identity stays runtime config. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
# Conflicts: # CHANGELOG.md
rosinghal
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
Dockerfile,.dockerignore,CHECKSanddocker-entrypoint.shso Agentric deploys to a Dockerfile-based PaaS (Dokku/Heroku-style). Multi-stage build of both bundles, shipping the full session runtime — tmux, ttyd,git,gh,claude— onnode:22-bookworm-slim.Three constraints the image has to hold, each documented inline: it runs as uid 1000, not root (
--dangerously-skip-permissionsis refused under root);$HOMEis a real writable volume (a failed~/.claude.jsontrust seed hangs every session); anden_US.UTF-8is generated, sincesession-backend.tshardcodes it into every tmux pane.AOS_UID_ISOLATIONstays off, so the app's own/terminal/proxy keeps one published port enough.No host, tenant, email or token is baked in — deployment identity stays runtime config.
Verified:
npm run build,cd web && npm run build,npm run test:governanceall pass, and the image builds and boots healthy on a Dokku host with/healthreporting 0.433.0.🤖 Generated with Claude Code