jason.woltje
bb5cecb348
- adapters/README.md: the harness boundary contract (env in, response on stdout, diagnostics stderr, exit 0 success) - adapters/pi: extracted current invocation unchanged - adapters/mock: deterministic MOSAIC_MOCK_RESPONSE echo (test-only) - run-agent.sh: name-validated dispatch to adapters/<name>/adapter.sh - config: optional execution.adapter (pi|mock), default pi, configVersion stays 1 — existing configs remain valid; selection authority is the config file (load_config exports it) - compose: MOSAIC_ADAPTER / MOSAIC_MOCK_RESPONSE passthrough; Containerfile installs adapters read-only; RELEASE -> 0.0.5 Verified: hello unchanged; mock verbatim via config; unknown adapter and path-traversal names refused in-container; invalid adapter exits 2. Closes #16
44 lines
1.7 KiB
Docker
44 lines
1.7 KiB
Docker
# Minimal Mosaic Stack POC agent image.
|
|
# Base: maintained Node.js image (same family as Pi's documented
|
|
# containerization example in docs/containerization.md).
|
|
FROM node:24-bookworm-slim
|
|
|
|
# Tools Pi's documented container image expects (bash, CA certs, git, ripgrep).
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends bash ca-certificates git ripgrep \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Non-root user: the maintained node image ships a 'node' user at
|
|
# uid/gid 1000, which matches the host user that owns the runtime
|
|
# state directory mounted at /var/lib/mosaic. It is reused as-is.
|
|
|
|
# Pinned Pi install: package.json pins the exact version and
|
|
# package-lock.json is installed with npm ci. No unversioned installs.
|
|
WORKDIR /opt/app
|
|
COPY package.json package-lock.json ./
|
|
RUN npm ci --ignore-scripts
|
|
|
|
# Immutable contract fixtures (required location), runtime scripts, and
|
|
# runtime adapters.
|
|
COPY contracts /opt/mosaic/contracts
|
|
COPY src /opt/mosaic/src
|
|
COPY adapters /opt/mosaic/adapters
|
|
RUN chmod 0555 /opt/mosaic/contracts /opt/mosaic/contracts/* \
|
|
&& chmod 0555 /opt/mosaic/src /opt/mosaic/src/*.sh \
|
|
&& chmod 0555 /opt/mosaic/adapters /opt/mosaic/adapters/*/adapter.sh
|
|
|
|
# Writable state, workspace, and pi agent directory (auth.json is
|
|
# bind-mounted read-only at runtime; nothing is copied into the image).
|
|
RUN mkdir -p /var/lib/mosaic /workspace /home/node/.pi/agent \
|
|
&& chown -R node:node /var/lib/mosaic /workspace /home/node /opt/app
|
|
|
|
USER node
|
|
WORKDIR /workspace
|
|
ENV HOME=/home/node \
|
|
PATH="/opt/app/node_modules/.bin:${PATH}" \
|
|
PI_OFFLINE=1
|
|
|
|
# One-shot agent: args form the user request (default is the startup
|
|
# verification request defined in compose.yaml).
|
|
ENTRYPOINT ["/opt/mosaic/src/run-agent.sh"]
|