mirror of
https://github.com/tiennm99/goclaw.git
synced 2026-07-31 08:25:03 +00:00
Viet Tran
765bec2287
Introduce optional Docker sandbox for agent code execution with defense-in-depth security patterns. Add ENABLE_SANDBOX build arg to conditionally install docker-cli in runtime image. Create docker-compose.sandbox.yml overlay with sandbox configuration (512MB memory, 1 CPU, no network, session-scoped containers). Expand shell command deny patterns to cover data exfiltration (DNS tunneling, curl POST), reverse
77 lines
2.0 KiB
Docker
77 lines
2.0 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# ── Stage 1: Build ──
|
|
FROM golang:1.25-bookworm AS builder
|
|
|
|
WORKDIR /src
|
|
|
|
# Cache dependencies
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
# Copy source
|
|
COPY . .
|
|
|
|
# Build args
|
|
ARG ENABLE_OTEL=false
|
|
ARG ENABLE_TSNET=false
|
|
ARG VERSION=dev
|
|
|
|
# Build static binary (CGO disabled for scratch/alpine compatibility)
|
|
RUN set -eux; \
|
|
TAGS=""; \
|
|
if [ "$ENABLE_OTEL" = "true" ]; then TAGS="otel"; fi; \
|
|
if [ "$ENABLE_TSNET" = "true" ]; then \
|
|
if [ -n "$TAGS" ]; then TAGS="$TAGS,tsnet"; else TAGS="tsnet"; fi; \
|
|
fi; \
|
|
if [ -n "$TAGS" ]; then TAGS="-tags $TAGS"; fi; \
|
|
CGO_ENABLED=0 GOOS=linux \
|
|
go build -ldflags="-s -w -X main.version=${VERSION}" \
|
|
${TAGS} -o /out/goclaw .
|
|
|
|
# ── Stage 2: Runtime ──
|
|
FROM alpine:3.22
|
|
|
|
ARG ENABLE_SANDBOX=false
|
|
|
|
# Install ca-certificates + wget (healthcheck) + optionally docker-cli (sandbox)
|
|
RUN set -eux; \
|
|
apk add --no-cache ca-certificates wget; \
|
|
if [ "$ENABLE_SANDBOX" = "true" ]; then \
|
|
apk add --no-cache docker-cli; \
|
|
fi
|
|
|
|
# Non-root user
|
|
RUN adduser -D -u 1000 -h /app goclaw
|
|
WORKDIR /app
|
|
|
|
# Copy binary and migrations
|
|
COPY --from=builder /out/goclaw /app/goclaw
|
|
COPY --from=builder /src/migrations/ /app/migrations/
|
|
COPY docker-entrypoint.sh /app/docker-entrypoint.sh
|
|
RUN chmod +x /app/docker-entrypoint.sh
|
|
|
|
# Create data directories (owned by goclaw user)
|
|
RUN mkdir -p /app/workspace /app/data /app/sessions /app/skills /app/tsnet-state \
|
|
&& chown -R goclaw:goclaw /app
|
|
|
|
# Default environment
|
|
ENV GOCLAW_CONFIG=/app/config.json \
|
|
GOCLAW_WORKSPACE=/app/workspace \
|
|
GOCLAW_DATA_DIR=/app/data \
|
|
GOCLAW_SESSIONS_STORAGE=/app/sessions \
|
|
GOCLAW_SKILLS_DIR=/app/skills \
|
|
GOCLAW_MIGRATIONS_DIR=/app/migrations \
|
|
GOCLAW_HOST=0.0.0.0 \
|
|
GOCLAW_PORT=18790
|
|
|
|
USER goclaw
|
|
|
|
EXPOSE 18790
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD wget -qO- http://localhost:18790/health || exit 1
|
|
|
|
ENTRYPOINT ["/app/docker-entrypoint.sh"]
|
|
CMD ["serve"]
|