mirror of
https://github.com/qwibitai/nanoclaw.git
synced 2026-06-12 18:11:51 +08:00
gavrielc
c8fc1da719
Replace the per-group "written once at init, owned by the group" CLAUDE.md
with a host-regenerated entry point that imports:
- a shared base (`container/CLAUDE.md` mounted RO at `/app/CLAUDE.md`)
- optional per-skill fragments (skills that ship `instructions.md`)
- optional per-MCP-server fragments (inline `instructions` field in
`container.json`)
- per-group agent memory (`CLAUDE.local.md`, auto-loaded by Claude Code)
Principle: RW = per-group memory, RO = shared content. Source/skills/base
are shared; personality, config, working files, and Claude state stay
per-group.
Key changes:
- New `src/claude-md-compose.ts` — per-spawn composition +
`migrateGroupsToClaudeLocal()` one-time cutover.
- New `container/CLAUDE.md` — shared base, seeded verbatim from the
former `groups/global/CLAUDE.md`.
- `src/container-runner.ts` — swap `/workspace/global` mount for RO
`/app/CLAUDE.md`; call `composeGroupClaudeMd()` after
`initGroupFilesystem()`.
- `src/group-init.ts` — drop `.claude-global.md` symlink + initial
`CLAUDE.md` write; seed `CLAUDE.local.md` from `opts.instructions`.
- `src/index.ts` — call `migrateGroupsToClaudeLocal()` at startup.
- `src/container-config.ts` — add optional `instructions` field to
`McpServerConfig` (inline per-MCP guidance fragment).
- `container/Dockerfile` — drop dead `/workspace/global` mkdir.
- Remove obsolete `scripts/migrate-group-claude-md.ts`.
Migration (runs once at host startup, idempotent):
- Delete `.claude-global.md` symlinks in each group.
- Rename each `groups/<folder>/CLAUDE.md` → `CLAUDE.local.md`
(preserves existing per-group content as memory).
- Delete `groups/global/` directory.
Design docs: `docs/claude-md-composition.md` and `docs/shared-source.md`
(the latter is the sibling design discussion this refactor builds on).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
122 lines
4.7 KiB
Docker
122 lines
4.7 KiB
Docker
# syntax=docker/dockerfile:1.7
|
|
# NanoClaw Agent Container
|
|
# Runs Claude Agent SDK in isolated Linux VM with browser automation.
|
|
#
|
|
# Runtime split:
|
|
# - agent-runner (our TypeScript code): Bun, mounted RO at /app/src by host
|
|
# - globally-installed Node CLIs (claude-code, agent-browser, vercel): pnpm + Node
|
|
#
|
|
# Source is never baked in — /app/src is provided by a shared read-only
|
|
# bind mount at runtime (see src/container-runner.ts). Source-only changes
|
|
# never require an image rebuild.
|
|
|
|
FROM node:22-slim
|
|
|
|
# ---- Build-time arguments ----------------------------------------------------
|
|
# CJK fonts add ~200MB. Opt in only if you render Chinese/Japanese/Korean text.
|
|
ARG INSTALL_CJK_FONTS=false
|
|
|
|
# Pin CLI versions for reproducibility. Bump deliberately — unpinned installs
|
|
# mean every rebuild silently picks up the latest and can break in lockstep
|
|
# across all users.
|
|
ARG CLAUDE_CODE_VERSION=2.1.116
|
|
ARG AGENT_BROWSER_VERSION=latest
|
|
ARG VERCEL_VERSION=latest
|
|
ARG BUN_VERSION=1.3.12
|
|
|
|
# ---- System dependencies -----------------------------------------------------
|
|
# tini: correct PID 1 / signal forwarding so outbound.db writes finalize on
|
|
# SIGTERM instead of being orphaned by the shell entrypoint.
|
|
RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
|
|
--mount=type=cache,target=/var/lib/apt,sharing=locked \
|
|
apt-get update && apt-get install -y --no-install-recommends \
|
|
chromium \
|
|
fonts-liberation \
|
|
fonts-noto-color-emoji \
|
|
libgbm1 \
|
|
libnss3 \
|
|
libatk-bridge2.0-0 \
|
|
libgtk-3-0 \
|
|
libx11-xcb1 \
|
|
libxcomposite1 \
|
|
libxdamage1 \
|
|
libxrandr2 \
|
|
libasound2 \
|
|
libpangocairo-1.0-0 \
|
|
libcups2 \
|
|
libdrm2 \
|
|
libxshmfence1 \
|
|
ca-certificates \
|
|
curl \
|
|
git \
|
|
tini \
|
|
unzip \
|
|
&& if [ "$INSTALL_CJK_FONTS" = "true" ]; then \
|
|
apt-get install -y --no-install-recommends fonts-noto-cjk; \
|
|
fi \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Chromium path for agent-browser / Playwright consumers
|
|
ENV AGENT_BROWSER_EXECUTABLE_PATH=/usr/bin/chromium
|
|
ENV PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/usr/bin/chromium
|
|
# Belt-and-braces: prevent Playwright's postinstall from downloading its own
|
|
# ~300MB Chromium. We've already installed the system one above.
|
|
ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
|
|
|
|
# ---- Bun runtime -------------------------------------------------------------
|
|
# Install via the official script (handles multi-arch detection), then move
|
|
# the binary to /usr/local/bin so the non-root `node` user can execute it.
|
|
RUN curl -fsSL https://bun.sh/install | bash -s "bun-v${BUN_VERSION}" && \
|
|
install -m 0755 /root/.bun/bin/bun /usr/local/bin/bun && \
|
|
rm -rf /root/.bun
|
|
|
|
# ---- agent-runner deps -------------------------------------------------------
|
|
# Deps are cached independently of CLI versions. Source is NOT baked in —
|
|
# it's provided by the shared RO mount at runtime.
|
|
WORKDIR /app
|
|
|
|
COPY agent-runner/package.json agent-runner/bun.lock ./
|
|
|
|
RUN --mount=type=cache,target=/root/.bun/install/cache \
|
|
bun install --frozen-lockfile
|
|
|
|
# ---- pnpm + global Node CLIs -------------------------------------------------
|
|
# Most stable first, most frequently bumped last. Bumping claude-code
|
|
# (the most common change) only invalidates one layer.
|
|
#
|
|
# only-built-dependencies gates pnpm's supply-chain policy:
|
|
# - agent-browser has a postinstall build step.
|
|
# - @anthropic-ai/claude-code's postinstall downloads the native Claude
|
|
# binary (linux-arm64 variant on our image). Without the allowlist
|
|
# the SDK fails at spawn time with "native binary not found".
|
|
ENV PNPM_HOME="/pnpm"
|
|
ENV PATH="$PNPM_HOME:$PATH"
|
|
RUN corepack enable
|
|
|
|
RUN --mount=type=cache,target=/root/.cache/pnpm \
|
|
echo "only-built-dependencies[]=agent-browser" > /root/.npmrc && \
|
|
echo "only-built-dependencies[]=@anthropic-ai/claude-code" >> /root/.npmrc && \
|
|
pnpm install -g "vercel@${VERCEL_VERSION}"
|
|
|
|
RUN --mount=type=cache,target=/root/.cache/pnpm \
|
|
pnpm install -g "agent-browser@${AGENT_BROWSER_VERSION}"
|
|
|
|
RUN --mount=type=cache,target=/root/.cache/pnpm \
|
|
pnpm install -g "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}"
|
|
|
|
# ---- Entrypoint --------------------------------------------------------------
|
|
COPY entrypoint.sh /app/entrypoint.sh
|
|
RUN chmod +x /app/entrypoint.sh
|
|
|
|
# ---- Workspace + permissions -------------------------------------------------
|
|
RUN mkdir -p /workspace/group /workspace/extra && \
|
|
chown -R node:node /workspace && \
|
|
chmod 755 /home/node
|
|
|
|
USER node
|
|
WORKDIR /workspace/group
|
|
|
|
# tini is PID 1, reaps zombies, forwards signals cleanly. entrypoint.sh does
|
|
# `exec bun ...` so bun runs as tini's direct child.
|
|
ENTRYPOINT ["/usr/bin/tini", "--", "/app/entrypoint.sh"]
|