93 lines
2.9 KiB
Docker
93 lines
2.9 KiB
Docker
FROM debian:bookworm-slim
|
|
|
|
# Avoid interactive prompts
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
|
|
# Update and install Swiss Army Knife tools
|
|
RUN apt-get update && apt-get install -y \
|
|
curl \
|
|
wget \
|
|
git \
|
|
jq \
|
|
unzip \
|
|
tar \
|
|
vim \
|
|
nano \
|
|
python3 \
|
|
python3-pip \
|
|
python3-venv \
|
|
build-essential \
|
|
iputils-ping \
|
|
dnsutils \
|
|
net-tools \
|
|
ffmpeg \
|
|
openssh-server \
|
|
ripgrep ncdu \
|
|
sudo \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install Node.js 22 (via NodeSource)
|
|
RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
|
|
&& apt-get install -y nodejs \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install Chromium + Xvfb for headful browser support
|
|
RUN apt-get update && apt-get install -y chromium xvfb \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install OpenClaw CLI globally
|
|
RUN npm install -g openclaw@latest
|
|
|
|
# Install yq (binary release for latest version)
|
|
RUN wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O /usr/bin/yq && \
|
|
chmod +x /usr/bin/yq
|
|
RUN wget https://downloads-openshift-console.apps.lab.apilab.us/amd64/linux/oc.tar -O /tmp/oc.tar && \
|
|
tar -xvf /tmp/oc.tar -C /usr/bin/ && \
|
|
rm /tmp/oc.tar && chmod +x /usr/bin/oc
|
|
|
|
# Setup SSH directory & Config for OpenShift (Random UID support)
|
|
RUN mkdir -p /var/run/sshd && \
|
|
chmod 775 /var/run/sshd
|
|
|
|
# Custom sshd_config for non-root usage
|
|
# StrictModes no: Required for non-root / random UID environments
|
|
# PidFile: Point to /tmp for guaranteed write access
|
|
RUN echo "Port 2222
|
|
PermitRootLogin no
|
|
PasswordAuthentication no
|
|
PubkeyAuthentication yes
|
|
StrictModes no
|
|
PidFile /tmp/sshd.pid
|
|
HostKey /data/ssh/ssh_host_rsa_key
|
|
HostKey /data/ssh/ssh_host_ecdsa_key
|
|
HostKey /data/ssh/ssh_host_ed25519_key
|
|
AuthorizedKeysFile .ssh/authorized_keys
|
|
ChallengeResponseAuthentication no
|
|
UsePAM yes
|
|
Subsystem sftp /usr/lib/openssh/sftp-server" > /etc/ssh/sshd_config
|
|
|
|
# Create a user 'claw' (UID 1000) with sudo access
|
|
RUN useradd -m -s /bin/bash -u 1000 claw && \
|
|
echo "claw ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers && \
|
|
chmod -R g+rwX /home/claw
|
|
|
|
# Prepare volume mount point
|
|
# Mount persistent storage here
|
|
VOLUME /data
|
|
RUN mkdir -p /data && \
|
|
chown claw:claw /data && \
|
|
chmod 775 /data
|
|
|
|
# Set working directory to the persistent volume
|
|
WORKDIR /data
|
|
|
|
# Expose SSH port (non-privileged)
|
|
EXPOSE 2222
|
|
|
|
# Switch to user 'claw' (UID 1000)
|
|
USER claw
|
|
|
|
# Start SSH daemon
|
|
# Fix: StrictModes no handles permissions, but chmod 600 helps sanity.
|
|
CMD ["/bin/bash", "-c", "mkdir -p /data/ssh && if [ ! -f /data/ssh/ssh_host_rsa_key ]; then echo 'Generating persistent host keys...'; ssh-keygen -f /data/ssh/ssh_host_rsa_key -N '' -t rsa; ssh-keygen -f /data/ssh/ssh_host_ecdsa_key -N '' -t ecdsa; ssh-keygen -f /data/ssh/ssh_host_ed25519_key -N '' -t ed25519; fi && chmod 600 /data/ssh/ssh_host_*_key && /usr/sbin/sshd -D -f /etc/ssh/sshd_config"]
|