Skip to content

Devbox Anywhere v1.3.0

Choose a tag to compare

View all tags
@hubbvee hubbvee released this 30 Aug 22:45
· 70 commits to main since this release
v1.3.0
028b3cb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Devbox Anywhere v1.3.0 — Browsers & authenticating to services

Gives the devbox a browser when it needs one, in three layers (safest first), without weakening the loopback-by-default, human-only-secrets, explicit-exposure model. scripts/install-devbox remains the sole privileged installer.

Headless browser (always on)

  • A pinned Playwright + Chromium with OS dependencies is baked into the image (offline-ready) for tests, screenshots, scraping, and link checks.
  • devbox-browser-check smoke helper launches headless Chromium and fails loud on any error.

Auth playbook (documentation, no new services)

  • docs/12-browser-and-auth.md: token-first authentication — including Cloudflare API tokens, Access service tokens, and tunnel tokens — SSH-forwarded OAuth callbacks, and guidance on when a real browser is actually required.
  • A seventh Hermes umbrella-skill reference, references/browser-and-auth.md.

Opt-in interactive browser (--with-browser)

  • A loopback-only KasmVNC Chromium service (linuxserver/chromium, pinned by digest) behind a Compose browser profile — off by default.
  • install-devbox --with-browser binds 127.0.0.1:8081 only, generates an owner-only noVNC password (never printed), and persists the browser profile under /data/devbox/browser so completed logins survive rebuilds.
  • The agent harness plan --json --with-browser reports the listener and the additional approval and appends the flag to the install command; default plans are unchanged.
  • Reach it over the existing SSH tunnel or an authenticated proxy / Cloudflare Access. Never expose port 8081 publicly. The interactive browser is a convenience, not a sandbox.

Also in this release

  • The install test fixture is now POSIX-sh (previously bash-only printf %q), so the canonical suite passes under dash.

Verification

  • Canonical suite passes (all gates) with 29 named mutation reds.
  • A full real-build smoke on an x86_64 Debian/Ubuntu Docker host passed end-to-end: image build, headless Chromium, install-devbox --with-browser, harness verify returning ok: true (all 8 checks), and the noVNC endpoint answering on loopback 8081.

Supported install target is Debian/Ubuntu (GNU coreutils and /usr/bin/python3). Within the reviewed and tested scope, there are no known blockers.

Assets 2
Loading