chore(sandbox): Node 24, agent CLIs, persistent config, agent tooling - #133
Conversation
|
@codex review |
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 72ab54e098
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| 'CLAUDE_CONFIG_DIR=/workplace/.claude' \ | ||
| 'CODEX_HOME=/workplace/.codex' \ | ||
| 'XDG_CONFIG_HOME=/workplace/.config' \ | ||
| 'XDG_DATA_HOME=/workplace/.local/share' \ | ||
| 'XDG_STATE_HOME=/workplace/.local/state' \ |
There was a problem hiding this comment.
When a sandbox is created with --env or --env-file, createApp() supplies those values only as container environment variables, but sshd does not copy arbitrary variables inherited by its parent into a new SSH session. This block writes only the hard-coded PATH and config variables to /etc/environment, so credentials such as OPENAI_API_KEY remain invisible to codex or opencode when users connect through bunny sandbox ssh or exec, despite the newly documented create-time-key workflow. Persist the supplied environment safely for SSH sessions or explicitly forward it when launching remote commands.
Useful? React with 👍 / 👎.
| # layer when it hasn't. Kept after the apt/Node/Bun layers on purpose — busting | ||
| # it only reruns the cheap steps that follow. | ||
| ADD https://downloads.claude.ai/claude-code-releases/latest /tmp/claude-code-version | ||
| RUN curl -fsSL https://claude.ai/install.sh | bash \ |
There was a problem hiding this comment.
If curl fails before producing installer content—for example because claude.ai returns an error or has a transient connection failure—the pipeline's status is still the status of bash, which exits successfully on empty input because pipefail is not enabled. The workflow can consequently publish an image with no claude executable even though the build passed; download the script before executing it or enable pipefail for this layer.
Useful? React with 👍 / 👎.
| # up new releases without a commit. The Dockerfile keys each install layer on | ||
| # the upstream version, so a day with no releases is a fully cached no-op. | ||
| # Off the hour on purpose — the top of the hour is the busiest Actions slot. | ||
| schedule: |
There was a problem hiding this comment.
claude code does a lot of releases so it's a hassle to follow. and since it only effects the new sandboxes it seems fine.
3 participants
No description provided.