blob: 89f2448f06e2475e838f04d197beb851517fbf90 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
|
FROM debian:trixie-slim
ENV DEBIAN_FRONTEND=noninteractive
# core tooling
RUN apt-get update && apt-get install -y --no-install-recommends \
sudo \
curl \
wget \
git \
ca-certificates \
gnupg \
jq \
ripgrep \
less \
vim \
sqlite3 \
python3 \
python3-pip \
python3-venv \
build-essential \
pkg-config \
procps \
iputils-ping \
&& rm -rf /var/lib/apt/lists/*
# Narrow sudo: senia can run apt/apt-get only, no password.
RUN echo "senia ALL=(root) NOPASSWD: /usr/bin/apt, /usr/bin/apt-get" \
> /etc/sudoers.d/senia-apt \
&& chmod 440 /etc/sudoers.d/senia-apt \
&& visudo -c -f /etc/sudoers.d/senia-apt
# the visudo -c validates the file syntax; build fails if it's malformed
# nodejs (for claude code) — using nodesource for a recent version
RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
&& apt-get install -y --no-install-recommends nodejs \
&& rm -rf /var/lib/apt/lists/*
RUN npm install -g npm@11.14.0
# claude code itself
RUN npm install -g @anthropic-ai/claude-code
RUN pip3 install --break-system-packages mcp
# create non-root user matching common host uid (1000) so mounted volumes have correct ownership
ARG USER_UID=750
ARG USER_GID=750
RUN groupadd --system --gid ${USER_GID} senia \
&& useradd --system --uid ${USER_UID} --gid ${USER_GID} -m -s /bin/bash senia \
&& echo "umask 002" >> /home/senia/.bashrc
USER senia
# Install uv (the modern python package manager) system-wide so senia can use it
# We install it as senia to avoid root-owned install paths.
RUN curl -LsSf https://astral.sh/uv/install.sh | sh
# uv installs to /home/senia/.local/bin/uv
# Set up npm to install globally into senia's home (no sudo needed)
RUN mkdir -p /home/senia/.npm-global \
&& npm config set prefix /home/senia/.npm-global
# Make sure her PATH includes the user-local bin dirs
ENV PATH=/home/senia/.local/bin:/home/senia/.npm-global/bin:$PATH
WORKDIR /workspace
CMD ["bash"]
|
