chore(cloud-agent): fix local docker sandbox build#60864
Merged
Conversation
tatoalo
changed the title
tatoalo
force-pushed
the
chore/cloud-sandbox-dev-tooling
branch
from
55576ea to
3d06de3
Compare
Contributor
Prompt To Fix All With AIFix the following 1 code review issue. Work through them one at a time, proposing concise fixes.
---
### Issue 1 of 1
products/tasks/backend/sandbox/images/Dockerfile.sandbox-local:24
**Broad build-script allowlist in local sandbox**
`--config.dangerouslyAllowAllBuilds=true` permits every installed package to run its `preinstall`/`install`/`postinstall` scripts unconditionally. For this local-only development image the risk is low, but pnpm v9+ offers a more targeted alternative: list the specific packages that need build scripts in `package.json` under `pnpm.onlyBuiltDependencies` (or a `.npmrc` `onlyBuiltDependencies[]` array). That would satisfy pnpm v11's stricter check without opening the door to all packages. Worth considering if the offending package is already known.
Reviews (1): Last reviewed commit: "chore(cloud-agent): fix local docker san..." | Re-trigger Greptile |
![mendral-app[bot]](https://avatars.githubusercontent.com/in/1975249?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Supply Chain Security Review
✅ Approve — 1 finding in 1 file
Single Dockerfile change adds --config.dangerouslyAllowAllBuilds=true to a pnpm install of locally-packed workspace tarballs in a local sandbox image. Since the installed packages are internal monorepo artifacts (not arbitrary registry packages), the blast radius is minimal.
Tag @mendral-app with feedback or questions. View session
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![hex-security-app[bot]](https://avatars.githubusercontent.com/in/2665233?s=60&v=4){kind=small}
skoob13
approved these changes
Jun 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The local-overlay cloud-agent sandbox image fails to build under pnpm v11, treating an unapproved dependency build script as fatal, which breaks
SANDBOX_PROVIDER=dockerimage builds