From 9e060a39fe8952f0c272f1dd06b27a85b9ba77cc Mon Sep 17 00:00:00 2001 From: Ian Date: Tue, 29 Sep 2026 23:38:33 +0200 Subject: [PATCH] fix: various fixes - Add uid and gid to dev user - Entry point script is mounted and not built in docker container - Change image name --- Dockerfile | 52 ++++++++++++++++++++++++++++++++++++++++----------- build.sh | 10 ++++++++-- dev.sh | 15 ++++++++++++--- entrypoint.sh | 4 +++- 4 files changed, 64 insertions(+), 17 deletions(-) diff --git a/Dockerfile b/Dockerfile index fa26ad7..2938da4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -6,6 +6,9 @@ FROM ubuntu:${UBUNTU_VERSION} ARG OPENCODE_VERSION=1.18.32 ARG NODE_VERSION=24.21.0 +ARG DEV_UID=1000 +ARG DEV_GID=1000 + ENV DEBIAN_FRONTEND=noninteractive \ HOME=/home/dev \ EDITOR=nvim \ @@ -15,6 +18,7 @@ ENV DEBIAN_FRONTEND=noninteractive \ SHELL ["/bin/bash", "-o", "pipefail", "-c"] +# System packages RUN apt-get update \ && apt-get upgrade -y \ && apt-get install -y --no-install-recommends \ @@ -48,28 +52,54 @@ RUN apt-get update \ xz-utils \ file \ util-linux \ - # && rm -rf /var/lib/apt/lists/* \ && update-alternatives --set java /usr/lib/jvm/java-17-openjdk-amd64/bin/java \ && update-alternatives --set javac /usr/lib/jvm/java-17-openjdk-amd64/bin/javac \ + # && rm -rf /var/lib/apt/lists/* && echo 'en_US.UTF-8 UTF-8' > /etc/locale.gen \ - && locale-gen \ - && useradd --create-home --shell /bin/bash dev \ - && mkdir -p /workspace /home/dev/.config/opencode /home/dev/.local/share/opencode \ - /home/dev/.cache/opencode /home/dev/.cache/pip /home/dev/.npm /home/dev/.m2 \ - && chown -R dev:dev /workspace /home/dev + && locale-gen -RUN curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \ - && tar -xJf "node-v${NODE_VERSION}-linux-x64.tar.xz" -C /usr/local --strip-components=1 \ - && rm "node-v${NODE_VERSION}-linux-x64.tar.xz" \ +# Runtime user +RUN groupadd --gid 1001 dev \ + && useradd \ + --uid 1001 \ + --gid 1001 \ + --create-home \ + --shell /bin/bash \ + dev + +# User directories +RUN mkdir -p \ + /workspace \ + /home/dev/.config/opencode \ + /home/dev/.local/share/opencode \ + /home/dev/.cache/opencode \ + /home/dev/.cache/pip \ + /home/dev/.npm \ + /home/dev/.m2 \ + && chown -R dev:dev \ + /workspace \ + /home/dev + +# Node.js + OpenCode +RUN curl -fsSLO \ + "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz" \ + && tar -xJf \ + "node-v${NODE_VERSION}-linux-x64.tar.xz" \ + -C /usr/local \ + --strip-components=1 \ + && rm \ + "node-v${NODE_VERSION}-linux-x64.tar.xz" \ && node --version \ && npm --version \ && npm install --global "opencode-ai@${OPENCODE_VERSION}" \ && opencode --version \ && npm cache clean --force -COPY entrypoint.sh /usr/local/bin/opencode-dev-entrypoint -RUN chmod +x /usr/local/bin/opencode-dev-entrypoint +# Runtime +USER dev WORKDIR /workspace + ENTRYPOINT ["/usr/local/bin/opencode-dev-entrypoint"] + CMD ["bash"] diff --git a/build.sh b/build.sh index aee2944..ad77539 100755 --- a/build.sh +++ b/build.sh @@ -9,8 +9,9 @@ OPENCODE_VERSION=$(curl -fsSI https://github.com/anomalyco/opencode/releases/lat NODE_VERSION=$(curl -fsSL https://nodejs.org/dist/index.json | sed -n 's/.*"version":"v\([^"]*\)".*"lts":".*".*/\1/p' | head -n 1) IMAGE_REPO="${IMAGE_REPO:-localhost/opencode-dev}" -IMAGE_TAG="${IMAGE_TAG:-${OPENCODE_VERSION}}" -IMAGE="${IMAGE_REPO}:${IMAGE_TAG}" +# IMAGE_TAG="${IMAGE_TAG:-${OPENCODE_VERSION}}" +# IMAGE="${IMAGE_REPO}:${IMAGE_TAG}" +IMAGE="${IMAGE_REPO}" NO_CACHE=() if [[ "${1:-}" == "--no-cache" ]]; then @@ -40,12 +41,17 @@ if ((UPDATE)); then podman rmi $(podman images -q ${IMAGE_REPO}) fi +DEV_UID="$(id -u)" +DEV_GID="$(id -g)" + if [ ${DRY_RUN} == false ]; then podman build \ "${NO_CACHE[@]}" \ --build-arg "UBUNTU_VERSION=${UBUNTU_VERSION}" \ --build-arg "OPENCODE_VERSION=${OPENCODE_VERSION}" \ --build-arg "NODE_VERSION=${NODE_VERSION}" \ + --build-arg "DEV_UID=${DEV_UID}" \ + --build-arg "DEV_GID=${DEV_GID}" \ -t "$IMAGE" \ . diff --git a/dev.sh b/dev.sh index 570cc35..70199e5 100755 --- a/dev.sh +++ b/dev.sh @@ -1,12 +1,15 @@ #!/usr/bin/env bash set -euo pipefail +SCRIPT_DIR=$(realpath -- "$(dirname -- "${BASH_SOURCE[0]}")") +echo "Script dir: ${SCRIPT_DIR}" + BASE_DIR="${OPENCODE_DEV_HOME:-$HOME/dev/opencode-dev}" PROJECTS_DIR="$BASE_DIR/projects" IMAGE_REPO="${IMAGE_REPO:-localhost/opencode-dev}" -OPENCODE_VERSION="${OPENCODE_VERSION:-1.18.32}" -IMAGE_TAG="${IMAGE_TAG:-${OPENCODE_VERSION}}" -IMAGE="${IMAGE_REPO}:${IMAGE_TAG}" +# OPENCODE_VERSION="${OPENCODE_VERSION:-1.18.32}" +# IMAGE_TAG="${IMAGE_TAG:-${OPENCODE_VERSION}}" +IMAGE="${IMAGE_REPO}" mkdir -p \ "$BASE_DIR/opencode-config" \ @@ -19,6 +22,8 @@ mkdir -p \ "$BASE_DIR/bash" \ "$PROJECTS_DIR" +chown "$(id -u):$(id -g)" "$BASE_DIR/opencode-data" + if [[ ! -f "$HOME/.gitconfig" ]]; then echo "WARNING: $HOME/.gitconfig does not exist; Git will use container defaults." >&2 fi @@ -51,6 +56,7 @@ fi ARGS=( run --rm -it --name opencode-dev + --user dev --userns=keep-id --security-opt=no-new-privileges --network=default @@ -69,6 +75,7 @@ ARGS=( -v "$HOME/.gitconfig:/home/dev/.gitconfig:ro" -v "$HOME/.ssh:/home/dev/.ssh:ro" -v "$BASE_DIR/bash:/host-bash:ro" + -v "$SCRIPT_DIR/entrypoint.sh:/usr/local/bin/opencode-dev-entrypoint:ro" ) if [[ -n "${SSH_AUTH_SOCK:-}" && -S "$SSH_AUTH_SOCK" ]]; then @@ -100,4 +107,6 @@ if [[ -f "$BASH_RC" ]]; then ARGS+=(-e BASH_ENV=/host-bash/bashrc) fi +echo "Calling with args: ${ARGS[@]}" + exec podman "${ARGS[@]}" "$IMAGE" bash diff --git a/entrypoint.sh b/entrypoint.sh index 2f80b1d..e436d2b 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -51,4 +51,6 @@ fi # The image entrypoint is root only for one-time runtime setup; the shell/OpenCode # process itself always runs as the unprivileged dev user. -exec su -s /bin/bash dev -c 'cd "${START_DIR:-/workspace}" && exec "$@"' -- "$@" +# exec su -s /bin/bash dev -c 'cd "${START_DIR:-/workspace}" && exec "$@"' -- "$@" +cd "${START_DIR:-/workspace}" +exec "$@"