From 7b98d6dae6f679aa848e485e3cfb0b9fe543cc12 Mon Sep 17 00:00:00 2001
From: Ian <iantirso.cini@gmail.com>
Date: Thu, 1 Oct 2026 23:22:33 +0200
Subject: [PATCH] fix: reduce permissions and fix npm and opencode versions

---
 Dockerfile    |  8 +++-----
 build.sh      |  4 +++-
 dev.sh        |  8 ++++----
 entrypoint.sh | 46 +++++++++++++++++++++++-----------------------
 4 files changed, 33 insertions(+), 33 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 74021f2..d734dae 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,6 +4,7 @@ ARG UBUNTU_VERSION=26.04
 FROM ubuntu:${UBUNTU_VERSION}
 
 ARG NODE_VERSION=24.21.0
+ARG OPENCODE_VERSION=2.0.3
 
 ARG DEV_UID=1000
 ARG DEV_GID=1000
@@ -43,7 +44,6 @@ RUN apt-get update \
         python3-pip \
         python3-venv \
         ripgrep \
-        sudo \
         tar \
         tree \
         unzip \
@@ -67,9 +67,7 @@ RUN groupadd --gid "${DEV_GID}" dev \
         --uid "${DEV_UID}" \
         --gid "${DEV_GID}" \
         --create-home \
-        --shell /bin/bash dev \
-    && echo 'dev ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/dev \
-    && chmod 0440 /etc/sudoers.d/dev
+        --shell /bin/bash dev
 
 # Node.js + OpenCode
 RUN curl -fsSLO \
@@ -81,7 +79,7 @@ RUN curl -fsSLO \
     && rm "node-v${NODE_VERSION}-linux-x64.tar.xz" \
     && echo -n "node version: " && node --version \
     && echo -n "npm version: " && npm --version \
-    && npm install -g @opencode/cli \
+    && npm install -g "@opencode/cli@${OPENCODE_VERSION}" \
     && echo -n "opencode version: " && opencode --version \
     && npm cache clean --force
 
diff --git a/build.sh b/build.sh
index 63c3adf..0603794 100755
--- a/build.sh
+++ b/build.sh
@@ -6,7 +6,8 @@ cd "$SCRIPT_DIR"
 
 UBUNTU_VERSION="${UBUNTU_VERSION:-26.04}"
 # OPENCODE_VERSION=$(curl -fsSI https://github.com/anomalyco/opencode/releases/latest | sed -n 's/^location:.*\/tag\/v\{0,1\}\(.*\)\r$/\1/ip')
-NODE_VERSION=$(curl -fsSL https://nodejs.org/dist/index.json | sed -n 's/.*"version":"v\([^"]*\)".*"lts":".*".*/\1/p' | head -n 1)
+NODE_VERSION="${NODE_VERSION:-24.21.0}"
+OPENCODE_VERSION="${OPENCODE_VERSION:-2.0.3}"
 
 IMAGE_REPO="${IMAGE_REPO:-localhost/opencode-dev}"
 # IMAGE_TAG="${IMAGE_TAG:-${OPENCODE_VERSION}}"
@@ -49,6 +50,7 @@ if [ ${DRY_RUN} == false ]; then
     "${NO_CACHE[@]}" \
     --build-arg "UBUNTU_VERSION=${UBUNTU_VERSION}" \
     --build-arg "NODE_VERSION=${NODE_VERSION}" \
+    --build-arg "OPENCODE_VERSION=${OPENCODE_VERSION}" \
     --build-arg "DEV_UID=${DEV_UID}" \
     --build-arg "DEV_GID=${DEV_GID}" \
     -t "$IMAGE" \
diff --git a/dev.sh b/dev.sh
index 93a93e9..470b16a 100755
--- a/dev.sh
+++ b/dev.sh
@@ -18,7 +18,6 @@ M2_FOLDER="${M2_FOLDER:-$BASE_DIR/m2}"
 NPM_MODULES="${NPM_MODULES:-$BASE_DIR/npm-modules}"
 NPM_CACHE="${NPM_CACHE:-$BASE_DIR/npm-cache}"
 PIP_CACHE="${PIP_CACHE:-$BASE_DIR/pip-cache}"
-CERTIFICATES="${CERTIFICATES:-$BASE_DIR/certs}"
 BASH_FOLDER="${BASH_FOLDER:-$BASE_DIR/bash}"
 
 mkdir -p \
@@ -31,7 +30,6 @@ mkdir -p \
     "$NPM_MODULES" \
     "$NPM_CACHE" \
     "$PIP_CACHE" \
-    "$CERTIFICATES" \
     "$BASH_FOLDER"
 
 if [[ ! -f "$HOME/.gitconfig" ]]; then
@@ -63,7 +61,6 @@ if [[ ! -d "$PROJECTS_DIR" ]]; then
   exit 1
 fi
 
-# --security-opt=no-new-privileges
 ARGS=(
   run --rm -it
   --name opencode-dev
@@ -71,6 +68,10 @@ ARGS=(
   --userns=keep-id
   --network=default
   --tz=local
+
+  --security-opt=no-new-privileges
+  --cap-drop=ALL
+
   -e "HOST_LANG=${LANG:-C.UTF-8}"
   -e "HOST_LC_ALL=${LC_ALL:-}"
   -e "START_DIR=${START_DIR}"
@@ -81,7 +82,6 @@ ARGS=(
   -v "$M2_FOLDER:/home/dev/.m2:rw"
   -v "$NPM_CACHE:/home/dev/.npm:rw"
   -v "$PIP_CACHE:/home/dev/.cache/pip:rw"
-  -v "$CERTIFICATES:/host-certs:ro"
   -v "$PROJECTS_DIR:/workspace:rw"
   -v "$HOME/.gitconfig:/home/dev/.gitconfig:ro"
   # -v "$HOME/.ssh:/home/dev/.ssh:ro"
diff --git a/entrypoint.sh b/entrypoint.sh
index fff0625..e57436a 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -1,29 +1,29 @@
 #!/bin/bash
 set -euo pipefail
 
-CERT_DIR="${CERT_DIR:-/host-certs}"
-
-if [[ -d "$CERT_DIR" ]]; then
-  shopt -s nullglob
-  certs=("$CERT_DIR"/*.crt "$CERT_DIR"/*.pem)
-  if ((${#certs[@]})); then
-    mkdir -p /usr/local/share/ca-certificates/opencode-host
-    for cert in "${certs[@]}"; do
-      target="/usr/local/share/ca-certificates/opencode-host/$(basename "${cert%.*}").crt"
-      if openssl x509 -in "$cert" -noout >/dev/null 2>&1; then
-        cp -f "$cert" "$target"
-      else
-        echo "WARNING: ignoring invalid CA certificate: $cert" >&2
-      fi
-    done
-    if update-ca-certificates >/tmp/opencode-ca.log 2>&1; then
-      :
-    else
-      echo "WARNING: update-ca-certificates failed; continuing." >&2
-      cat /tmp/opencode-ca.log >&2 || true
-    fi
-  fi
-fi
+# CERT_DIR="${CERT_DIR:-/host-certs}"
+#
+# if [[ -d "$CERT_DIR" ]]; then
+#   shopt -s nullglob
+#   certs=("$CERT_DIR"/*.crt "$CERT_DIR"/*.pem)
+#   if ((${#certs[@]})); then
+#     mkdir -p /usr/local/share/ca-certificates/opencode-host
+#     for cert in "${certs[@]}"; do
+#       target="/usr/local/share/ca-certificates/opencode-host/$(basename "${cert%.*}").crt"
+#       if openssl x509 -in "$cert" -noout >/dev/null 2>&1; then
+#         cp -f "$cert" "$target"
+#       else
+#         echo "WARNING: ignoring invalid CA certificate: $cert" >&2
+#       fi
+#     done
+#     if update-ca-certificates >/tmp/opencode-ca.log 2>&1; then
+#       :
+#     else
+#       echo "WARNING: update-ca-certificates failed; continuing." >&2
+#       cat /tmp/opencode-ca.log >&2 || true
+#     fi
+#   fi
+# fi
 
 host_lang="${HOST_LANG:-${LANG:-C.UTF-8}}"
 host_lc_all="${HOST_LC_ALL:-${LC_ALL:-}}"