61805a832d
This exploration came out of my review of https://github.com/openai/codex/pull/414. `run_in_container.sh` runs Codex in a Docker container like so:bd1c3deed9/codex-cli/scripts/run_in_container.sh (L51-L58)But then runs `init_firewall.sh` to set up the firewall to restrict network access. Previously, we did this by adding `/usr/local/bin/init_firewall.sh` to the container and adding a special rule in `/etc/sudoers.d` so the unprivileged user (`node`) could run the privileged `init_firewall.sh` script to open up the firewall for `api.openai.com`:31d0d7a305/codex-cli/Dockerfile (L51-L56)Though I believe this is unnecessary, as we can use `docker exec --user root` from _outside_ the container to run `/usr/local/bin/init_firewall.sh` as `root` without adding a special case in `/etc/sudoers.d`. This appears to work as expected, as I tested it by doing the following: ``` ./codex-cli/scripts/build_container.sh ./codex-cli/scripts/run_in_container.sh 'what is the output of `curl https://www.openai.com`' ``` This was a bit funny because in some of my runs, Codex wasn't convinced it had network access, so I had to convince it to try the `curl` request:  As you can see, when it ran `curl -s https\://www.openai.com`, it a connection failure, so the network policy appears to be working as intended. Note this PR also removes `sudo` from the `apt-get install` list in the `Dockerfile`.
56 lines
1.3 KiB
Docker
56 lines
1.3 KiB
Docker
FROM node:20-slim
|
|
|
|
ARG TZ
|
|
ENV TZ="$TZ"
|
|
|
|
# Install basic development tools, ca-certificates, and iptables/ipset, then clean up apt cache to reduce image size
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
aggregate \
|
|
ca-certificates \
|
|
curl \
|
|
dnsutils \
|
|
fzf \
|
|
gh \
|
|
git \
|
|
gnupg2 \
|
|
iproute2 \
|
|
ipset \
|
|
iptables \
|
|
jq \
|
|
less \
|
|
man-db \
|
|
procps \
|
|
unzip \
|
|
ripgrep \
|
|
zsh \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Ensure default node user has access to /usr/local/share
|
|
RUN mkdir -p /usr/local/share/npm-global && \
|
|
chown -R node:node /usr/local/share
|
|
|
|
ARG USERNAME=node
|
|
|
|
# Set up non-root user
|
|
USER node
|
|
|
|
# Install global packages
|
|
ENV NPM_CONFIG_PREFIX=/usr/local/share/npm-global
|
|
ENV PATH=$PATH:/usr/local/share/npm-global/bin
|
|
|
|
# Install codex
|
|
COPY dist/codex.tgz codex.tgz
|
|
RUN npm install -g codex.tgz \
|
|
&& npm cache clean --force \
|
|
&& rm -rf /usr/local/share/npm-global/lib/node_modules/codex-cli/node_modules/.cache \
|
|
&& rm -rf /usr/local/share/npm-global/lib/node_modules/codex-cli/tests \
|
|
&& rm -rf /usr/local/share/npm-global/lib/node_modules/codex-cli/docs
|
|
|
|
# Copy and set up firewall script as root.
|
|
USER root
|
|
COPY scripts/init_firewall.sh /usr/local/bin/
|
|
RUN chmod 500 /usr/local/bin/init_firewall.sh
|
|
|
|
# Drop back to non-root.
|
|
USER node
|