6f931b8405
Adds a dedicated Docker environment for reviewing untrusted pull requests with codex/claude, keeping CLI auth state in volumes and using a separate scratch workspace for PR checkouts. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
45 lines
1.1 KiB
Docker
45 lines
1.1 KiB
Docker
FROM node:lts-trixie-slim
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
bash \
|
|
ca-certificates \
|
|
curl \
|
|
fd-find \
|
|
gh \
|
|
git \
|
|
jq \
|
|
less \
|
|
openssh-client \
|
|
procps \
|
|
ripgrep \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN ln -sf /usr/bin/fdfind /usr/local/bin/fd
|
|
|
|
RUN corepack enable \
|
|
&& npm install --global --omit=dev @anthropic-ai/claude-code@latest @openai/codex@latest
|
|
|
|
RUN useradd --create-home --shell /bin/bash reviewer
|
|
|
|
ENV HOME=/home/reviewer \
|
|
CODEX_HOME=/home/reviewer/.codex \
|
|
CLAUDE_HOME=/home/reviewer/.claude \
|
|
PAPERCLIP_HOME=/home/reviewer/.paperclip-review \
|
|
PNPM_HOME=/home/reviewer/.local/share/pnpm \
|
|
PATH=/home/reviewer/.local/share/pnpm:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
|
|
|
WORKDIR /work
|
|
|
|
COPY --chown=reviewer:reviewer docker/untrusted-review/bin/review-checkout-pr /usr/local/bin/review-checkout-pr
|
|
|
|
RUN chmod +x /usr/local/bin/review-checkout-pr \
|
|
&& mkdir -p /work \
|
|
&& chown -R reviewer:reviewer /work
|
|
|
|
USER reviewer
|
|
|
|
EXPOSE 3100 5173
|
|
|
|
CMD ["bash", "-l"]
|