Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 19 additions & 11 deletions lib/k8s/sandbox-manager.ts
Original file line number Diff line number Diff line change
Expand Up @@ -598,8 +598,8 @@ export class SandboxManager {
memory: '512Mi',
},
limits: {
cpu: '1000m',
memory: '1024Mi',
cpu: '2000m',
memory: '4096Mi',
},
},
},
Expand Down Expand Up @@ -738,29 +738,37 @@ fi

# Copy Next.js project template
echo "→ Copying Next.js project template from /opt/next-template..."
echo " Source: /opt/next-template"
echo " Source: /opt/next-template (agent:agent)"
echo " Target: /home/agent/next"
echo " This may take 30-60 seconds (copying ~200-300MB)..."
echo " This may take 10-30 seconds..."
mkdir -p /home/agent/next
cp -r /opt/next-template/. /home/agent/next

# Verify copy was successful
if [ ! -d /home/agent/next ]; then
echo "✗ ERROR: Project copy failed - target directory not created"
# Copy with progress indicator and preserve timestamps
# Using cp instead of rsync for simplicity (rsync is available but cp is sufficient)
cp -rp /opt/next-template/. /home/agent/next 2>&1 || {
echo "✗ ERROR: Failed to copy template"
exit 1
fi
}

# Verify copy was successful
if [ ! -f /home/agent/next/package.json ]; then
echo "✗ ERROR: Project copy incomplete - package.json not found"
ls -la /home/agent/next 2>&1 || true
exit 1
fi

echo "✓ Next.js project template copied successfully"

# Set ownership and permissions for copied files
# Note: Even though source files are agent:agent in the image,
# cp creates new files owned by the current user (root in init container)
echo "→ Setting ownership (agent:1001) and permissions..."
chown -R 1001:1001 /home/agent/next
chmod -R u+rwX,g+rX,o+rX /home/agent/next
chown -R 1001:1001 /home/agent/next 2>&1 || {
echo "⚠ Warning: Failed to set ownership, but continuing..."
}
chmod -R u+rwX,g+rX,o+rX /home/agent/next 2>&1 || {
echo "⚠ Warning: Failed to set permissions, but continuing..."
}

# Count files for verification
FILE_COUNT=$(find /home/agent/next -type f | wc -l)
Expand Down
2 changes: 1 addition & 1 deletion lib/k8s/versions.ts
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ export const VERSIONS = {
// Storage configuration
STORAGE: {
DATABASE_SIZE: '3Gi',
SANDBOX_SIZE: '5Gi',
SANDBOX_SIZE: '10Gi',
STORAGE_CLASS: 'openebs-backup',
},
} as const
70 changes: 40 additions & 30 deletions sandbox/Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
# NOTE: Sensitive variables below are declared as empty strings for documentation.
# Actual values will be securely injected at runtime via Kubernetes Secrets.
# This is safe - no actual secrets are hardcoded in the Dockerfile.
ENV DEBIAN_FRONTEND=noninteractive \

Check warning on line 20 in sandbox/Dockerfile

View workflow job for this annotation

GitHub Actions / Build Runtime Docker Images

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "DOCKER_HUB_PASSWD") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 20 in sandbox/Dockerfile

View workflow job for this annotation

GitHub Actions / Build Runtime Docker Images

Sensitive data should not be used in the ARG or ENV commands

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "ANTHROPIC_AUTH_TOKEN") More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
NODE_VERSION=22.x \
CLAUDE_CODE_VERSION=latest \
PATH="/root/.local/bin:/home/agent/.local/bin:$PATH" \
Expand Down Expand Up @@ -197,31 +197,22 @@
COPY --chmod=755 entrypoint.sh /usr/local/bin/entrypoint.sh
COPY --chmod=644 .bashrc /etc/skel/.bashrc

# -----------------------------------------------------------------------------
# Create and configure /opt/next-template directory with proper permissions
# Must be done as root before switching to agent user
# -----------------------------------------------------------------------------
RUN mkdir -p /opt/next-template \
&& chown -R agent:agent /opt/next-template

# =============================================================================
# Stage 2: Next.js project template preparation
# =============================================================================

# Switch to non-root user for security and proper file ownership
USER agent
# Create Next.js template directly in /opt/next-template as root, then chown to agent
# This is simpler and faster than creating in /tmp and moving
# Root can safely run npm commands during image build (not runtime)

# -----------------------------------------------------------------------------
# Create Next.js project template at /opt/next-template
# This template will be copied to /home/agent/next by InitContainer on first run
# Reason: /home/agent will be mounted by PVC, so we need to store template elsewhere
# Step 1: Create Next.js project directly in final location
# -----------------------------------------------------------------------------
RUN set -eux; \
# Create template directory (accessible by agent user)
mkdir -p /opt/next-template; \
cd /opt/next-template; \
# Initialize Next.js with all recommended settings
# IMPORTANT: --yes flag is required for non-interactive build (skips React Compiler, Turbopack prompts)
TEMPLATE_DIR="/opt/next-template"; \
mkdir -p "$TEMPLATE_DIR"; \
cd "$TEMPLATE_DIR"; \
echo "=== Creating Next.js project in $TEMPLATE_DIR ==="; \
npx --yes create-next-app@latest . \
--typescript \
--tailwind \
Expand All @@ -232,24 +223,43 @@
--use-pnpm \
--disable-git \
--yes; \
# Verify Next.js project was created successfully
if [ ! -f /opt/next-template/package.json ]; then \
echo "ERROR: Next.js creation failed - package.json not found"; \
ls -la /opt/next-template; \
echo "=== Verifying Next.js project ==="; \
ls -la "$TEMPLATE_DIR"; \
if [ ! -f "$TEMPLATE_DIR/package.json" ]; then \
echo "ERROR: package.json not found"; \
exit 1; \
fi; \
echo "✓ Next.js project created successfully"; \
# Initialize shadcn/ui with default configuration
echo "✓ Next.js project created successfully"

# -----------------------------------------------------------------------------
# Step 2: Install shadcn/ui components
# -----------------------------------------------------------------------------
RUN set -eux; \
TEMPLATE_DIR="/opt/next-template"; \
cd "$TEMPLATE_DIR"; \
echo "=== Initializing shadcn/ui ==="; \
pnpm dlx shadcn@latest init -d -y; \
# Install all available shadcn/ui components
echo "=== Installing shadcn/ui components ==="; \
pnpm dlx shadcn@latest add --all --yes; \
echo "✓ shadcn/ui components installed"; \
# Clean pnpm cache to reduce layer size
echo "✓ shadcn/ui installed"

# -----------------------------------------------------------------------------
# Step 3: Clean up and set ownership
# -----------------------------------------------------------------------------
RUN set -eux; \
TEMPLATE_DIR="/opt/next-template"; \
cd "$TEMPLATE_DIR"; \
echo "=== Cleaning up pnpm cache ==="; \
pnpm store prune; \
# Final verification
echo "Verifying template contents:"; \
ls -la /opt/next-template; \
echo "✓ Next.js template created at /opt/next-template"
echo "=== Setting ownership to agent user (1001:1001) ==="; \
chown -R agent:agent "$TEMPLATE_DIR"; \
echo "=== Final verification ==="; \
ls -la "$TEMPLATE_DIR"; \
if [ ! -f "$TEMPLATE_DIR/package.json" ]; then \
echo "ERROR: Template verification failed"; \
exit 1; \
fi; \
echo "✓ Template ready at $TEMPLATE_DIR (owned by agent:agent)"

# =============================================================================
# Container Runtime Configuration
Expand Down
Loading