Conan Scott
c909668246
- Add SHA256 checksum verification for yq and oc downloads to prevent supply chain attacks - Pin busybox init container to version 1.36 for consistency - Fix gitconfig symlink to work unconditionally (survives file creation after boot) - Document kubeconfig secret prerequisite with correct breakglass config path Security: Protects against compromised mirrors and MITM attacks during image build Reliability: Ensures reproducible builds and proper git config persistence Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
135 lines
4.2 KiB
Docker
135 lines
4.2 KiB
Docker
FROM debian:bookworm-slim
|
|
|
|
# Avoid interactive prompts
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
|
|
# Update and install Swiss Army Knife tools
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
curl \
|
|
wget \
|
|
git \
|
|
jq \
|
|
unzip \
|
|
tar \
|
|
vim-nox \
|
|
nano \
|
|
python3 \
|
|
python3-pip \
|
|
python3-venv \
|
|
python3-full \
|
|
build-essential \
|
|
iputils-ping \
|
|
dnsutils \
|
|
net-tools \
|
|
ffmpeg \
|
|
openssh-server \
|
|
openssh-client \
|
|
sshpass \
|
|
ripgrep \
|
|
ncdu \
|
|
sudo \
|
|
tree \
|
|
tmux \
|
|
htop \
|
|
strace \
|
|
file \
|
|
less \
|
|
&& curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
|
|
&& apt-get install -y nodejs \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install yq (v4.x) with checksum verification
|
|
RUN YQ_VERSION="v4.40.5" && \
|
|
YQ_SHA256="47d0032f1f769c2e91b52bfde058d4956e5a959988a8460ed0a55d6ce703795c" && \
|
|
wget https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64 -O /usr/bin/yq && \
|
|
echo "${YQ_SHA256} /usr/bin/yq" | sha256sum -c - && \
|
|
chmod +x /usr/bin/yq
|
|
|
|
# Install OpenShift CLI (oc) with checksum verification
|
|
RUN OC_VERSION="stable" && \
|
|
OC_BASE_URL="https://mirror.openshift.com/pub/openshift-v4/clients/ocp/${OC_VERSION}" && \
|
|
wget ${OC_BASE_URL}/openshift-client-linux.tar.gz -O /tmp/openshift-client-linux.tar.gz && \
|
|
wget ${OC_BASE_URL}/sha256sum.txt -O /tmp/sha256sum.txt && \
|
|
cd /tmp && grep "openshift-client-linux.tar.gz$" sha256sum.txt | sha256sum -c - && \
|
|
tar -xvf openshift-client-linux.tar.gz -C /usr/bin/ oc && \
|
|
rm openshift-client-linux.tar.gz sha256sum.txt && chmod +x /usr/bin/oc
|
|
|
|
# Install Python tools for LLM work
|
|
RUN pip3 install --no-cache-dir --break-system-packages \
|
|
httpie \
|
|
pyyaml \
|
|
requests \
|
|
black \
|
|
ipython
|
|
|
|
# Setup SSH directory & Config for OpenShift (Random UID support)
|
|
RUN mkdir -p /var/run/sshd && \
|
|
chmod 775 /var/run/sshd
|
|
|
|
# Custom sshd_config for non-root usage
|
|
# StrictModes no: Required for non-root / random UID environments
|
|
# PidFile: Point to /tmp for guaranteed write access
|
|
RUN printf "Port 2222\n\
|
|
PermitRootLogin no\n\
|
|
PasswordAuthentication no\n\
|
|
PubkeyAuthentication yes\n\
|
|
StrictModes no\n\
|
|
PidFile /tmp/sshd.pid\n\
|
|
HostKey /data/ssh/ssh_host_rsa_key\n\
|
|
HostKey /data/ssh/ssh_host_ecdsa_key\n\
|
|
HostKey /data/ssh/ssh_host_ed25519_key\n\
|
|
AuthorizedKeysFile .ssh/authorized_keys\n\
|
|
ChallengeResponseAuthentication no\n\
|
|
UsePAM no\n\
|
|
Subsystem sftp /usr/lib/openssh/sftp-server\n" > /etc/ssh/sshd_config
|
|
|
|
# Create a user 'claw' (UID 1000) with sudo access
|
|
RUN useradd -m -s /bin/bash -u 1000 claw && \
|
|
echo "claw ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers && \
|
|
chmod -R g+rwX /home/claw
|
|
|
|
# Prepare volume mount point
|
|
# Mount persistent storage here
|
|
VOLUME /data
|
|
RUN mkdir -p /data /data/.cache/pip /data/.cache/npm /data/.local && \
|
|
chown -R claw:claw /data && \
|
|
chmod -R 775 /data
|
|
|
|
# Set working directory to the persistent volume
|
|
WORKDIR /data
|
|
|
|
# Expose SSH port (non-privileged)
|
|
EXPOSE 2222
|
|
|
|
# Switch to user 'claw' (UID 1000)
|
|
USER claw
|
|
|
|
# Link package managers to persistent storage
|
|
ENV PIP_CACHE_DIR=/data/.cache/pip
|
|
ENV npm_config_cache=/data/.cache/npm
|
|
ENV XDG_CACHE_HOME=/data/.cache
|
|
|
|
# Add better default shell experience
|
|
RUN echo 'export PS1="\[\e[32m\]\u@clawdbox\[\e[m\]:\[\e[34m\]\w\[\e[m\]\$ "' >> /home/claw/.bashrc && \
|
|
echo 'alias ll="ls -lah"' >> /home/claw/.bashrc && \
|
|
echo 'alias k="kubectl"' >> /home/claw/.bashrc && \
|
|
echo 'alias dc="docker"' >> /home/claw/.bashrc && \
|
|
echo 'export HISTFILE=/data/.bash_history' >> /home/claw/.bashrc && \
|
|
echo 'export HISTSIZE=10000' >> /home/claw/.bashrc && \
|
|
echo 'export HISTFILESIZE=10000' >> /home/claw/.bashrc
|
|
|
|
# Start SSH daemon
|
|
# The keys are generated if they don't exist on the persistent volume
|
|
CMD ["/bin/bash", "-c", "\
|
|
mkdir -p /data/ssh && \
|
|
for keytype in rsa ecdsa ed25519; do \
|
|
if [ ! -f /data/ssh/ssh_host_${keytype}_key ]; then \
|
|
echo \"Generating persistent host ${keytype} key...\"; \
|
|
ssh-keygen -q -f /data/ssh/ssh_host_${keytype}_key -N '' -t ${keytype}; \
|
|
fi; \
|
|
done && \
|
|
chmod 600 /data/ssh/ssh_host_*_key && \
|
|
ln -sf /data/.gitconfig ~/.gitconfig && \
|
|
/usr/sbin/sshd -D -e -f /etc/ssh/sshd_config"]
|