mirror of
https://github.com/tiennm99/goclaw.git
synced 2026-06-09 20:13:24 +00:00
therichardngai-code
6bfad07ed8
Sandbox overlay's cap_add replaces (not merges) the base compose, dropping SETUID, SETGID, CHOWN. This causes credential copy to fail with Permission denied when combining sandbox + claude-cli overlays. Changes: - Re-include base capabilities in sandbox overlay's cap_add - Use umask 077 for atomic permission-safe credential copy - Add ENABLE_CLAUDE_CLI build arg to pre-install Claude CLI in image - Add runtime warning when credentials mounted but CLI binary missing - Add WITH_CLAUDE_CLI to Makefile for overlay consistency - Add security warning comment for sandbox overlay attack surface
15 lines
522 B
YAML
15 lines
522 B
YAML
# Optional overlay: install Claude CLI and sync credentials from host into container.
|
|
# Mounts host ~/.claude as read-only; entrypoint copies credentials to the data volume.
|
|
# Adds ENABLE_CLAUDE_CLI build arg to install nodejs + @anthropic-ai/claude-code.
|
|
#
|
|
# Usage:
|
|
# docker compose -f docker-compose.yml -f docker-compose.postgres.yml -f docker-compose.claude-cli.yml up -d --build
|
|
|
|
services:
|
|
goclaw:
|
|
build:
|
|
args:
|
|
ENABLE_CLAUDE_CLI: "true"
|
|
volumes:
|
|
- ${HOME}/.claude:/app/.claude-host:ro
|