6b1e4a6846
Bumps node from 22-slim to 24-slim. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
60 lines
1.5 KiB
Docker
60 lines
1.5 KiB
Docker
FROM node:24-slim
|
|
|
|
ARG TZ
|
|
ENV TZ="$TZ"
|
|
|
|
# Install basic development tools, ca-certificates, and iptables/ipset, then clean up apt cache to reduce image size
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
aggregate \
|
|
ca-certificates \
|
|
curl \
|
|
dnsutils \
|
|
fzf \
|
|
gh \
|
|
git \
|
|
gnupg2 \
|
|
iproute2 \
|
|
ipset \
|
|
iptables \
|
|
jq \
|
|
less \
|
|
man-db \
|
|
procps \
|
|
unzip \
|
|
ripgrep \
|
|
zsh \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Ensure default node user has access to /usr/local/share
|
|
RUN mkdir -p /usr/local/share/npm-global && \
|
|
chown -R node:node /usr/local/share
|
|
|
|
ARG USERNAME=node
|
|
|
|
# Set up non-root user
|
|
USER node
|
|
|
|
# Install global packages
|
|
ENV NPM_CONFIG_PREFIX=/usr/local/share/npm-global
|
|
ENV PATH=$PATH:/usr/local/share/npm-global/bin
|
|
|
|
# Install codex
|
|
COPY dist/codex.tgz codex.tgz
|
|
RUN npm install -g codex.tgz \
|
|
&& npm cache clean --force \
|
|
&& rm -rf /usr/local/share/npm-global/lib/node_modules/codex-cli/node_modules/.cache \
|
|
&& rm -rf /usr/local/share/npm-global/lib/node_modules/codex-cli/tests \
|
|
&& rm -rf /usr/local/share/npm-global/lib/node_modules/codex-cli/docs
|
|
|
|
# Inside the container we consider the environment already sufficiently locked
|
|
# down, therefore instruct Codex CLI to allow running without sandboxing.
|
|
ENV CODEX_UNSAFE_ALLOW_NO_SANDBOX=1
|
|
|
|
# Copy and set up firewall script as root.
|
|
USER root
|
|
COPY scripts/init_firewall.sh /usr/local/bin/
|
|
RUN chmod 500 /usr/local/bin/init_firewall.sh
|
|
|
|
# Drop back to non-root.
|
|
USER node
|