fix(install): revert prebuilt image, use canonical A0 plugin pattern (v1.4.3)#7
Conversation
…(v1.4.3) The v1.4.0 prebuilt-image install path is broken in production. Three docker-publish runs in a row failed: v1.4.0/v1.4.1: /bin/sh: 1: pip: not found v1.4.2: /usr/bin/python3: No module named pip v1.4.2 retry: Cannot uninstall cryptography 46.0.7 (apt-managed) Root cause is upstream: the Dockerfile was FROM frdel/agent-zero-run, which is an outdated base. The current Agent Zero base is agent0ai/agent-zero-base:latest. The frdel image ships python3 without the pip module, has python3-cryptography 46.0.7 installed via apt with no pip record file, and our pessimistic version pin (<45.0) made pip try to downgrade the apt-managed package. The ghcr.io/notabotchef/phantom-bridge package was never published successfully — anyone following the v1.4.0/v1.4.1/v1.4.2 install instructions hit `pull access denied` and a broken stack. Fix: revert to the install pattern A0 documents for every plugin — clone into usr/plugins/, expose port 6080 via a compose override, click Execute in the A0 Plugins UI to run execute.py. This is the flow phantom-bridge has worked with for the entire 1.x line; v1.4.0 tried to "improve" it with a prebuilt image and that turned out to be the wrong tradeoff. Changes: - docker-compose.override.yml: removed the broken `image:` reference and the smart-entrypoint indirection. Now only adds the noVNC port mapping and the plugin volume mount. Your existing A0 image stays in use. - execute.py: hardened to bootstrap python3-pip via apt if the base image doesn't ship it, uses --break-system-packages for PEP 668, and --ignore-installed so pip doesn't fight with apt- managed packages. Now also checks `cryptography` import in addition to `websockets`. - README.md: Quick Start rewritten to the canonical 3-command flow (clone, override, restart, click Execute). What's New entry is honest about v1.4.0–v1.4.2 being broken. - .github/workflows/docker-publish.yml: gated to manual workflow_dispatch only. Stops failing on every push. Dockerfile and entrypoint stay in the repo for anyone who wants to fork and rebuild against agent0ai/agent-zero-base. - plugin.yaml: 1.4.3
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 681a15bde8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| print(f"[WARN] pip install failed: {result.stderr[:300]}") | ||
| print("Manual fix: python3 -m pip install --break-system-packages " + " ".join(needed)) |
There was a problem hiding this comment.
When pip install fails, the script only logs a warning and continues to print Setup complete!, then exits successfully; in the new v1.4.3 install flow this makes A0 report plugin setup as successful even though required deps are still missing. This occurs in common failure cases like network-restricted containers or pip permission/PEP668 issues, and leads to runtime failures later when CDP/WebSocket code imports these packages.
Useful? React with 👍 / 👎.
execute.py logged a warning but returned 0 (success) when pip install failed. A0's Plugin List UI interprets exit 0 as "setup succeeded", so users saw a green checkmark even though required deps were missing. The actual failure surfaces later as an ImportError at runtime.
|
Lesson learned: don't fight the base image. The canonical A0 plugin flow (clone + execute.py) has worked since v1.0 for a reason — it uses sys.executable so it always targets the right Python. The prebuilt image was solving a problem we didn't have. |
1 participant
Summary
The v1.4.0 prebuilt-image install path is broken in production. Three docker-publish runs in a row failed for different reasons:
Root cause is upstream: the Dockerfile was
FROM frdel/agent-zero-run:latest, which is an outdated base. The current Agent Zero base isagent0ai/agent-zero-base:latest. The frdel image shipspython3without thepipmodule, haspython3-cryptography 46.0.7installed via apt with no pip record file, and the pessimistic version pin (<45.0) made pip try to downgrade the apt-managed package.The
ghcr.io/notabotchef/phantom-bridgepackage was never published successfully — anyone following the v1.4.0/v1.4.1/v1.4.2 install instructions hitspull access deniedand a broken stack.Fix
Revert to the install pattern A0 documents for every plugin (per agent0ai/agent-zero docs/developer/plugins.md): clone into
usr/plugins/, expose port 6080 via a compose override, click Execute in A0's Plugin List UI to runexecute.py. This is the flow phantom-bridge has worked with for the entire 1.x line; v1.4.0 tried to "improve" it with a prebuilt image and that turned out to be the wrong tradeoff.New Quick Start (3 commands)
git clone https://github.com/notabotchef/phantom-bridge.git \ ./a0-data/usr/plugins/phantom_bridge curl -O https://raw.githubusercontent.com/notabotchef/phantom-bridge/main/docker-compose.override.yml docker compose up -dThen open A0 → Plugins → click Execute on Phantom Bridge.
Changes
docker-compose.override.yml— removed the brokenimage:reference and the smart-entrypoint indirection. Now only adds the noVNC port mapping (${PHANTOM_NOVNC_PORT:-6080}:6080) and the plugin volume mount. Your existing A0 image stays in use.execute.py— hardened to bootstrappython3-pipvia apt if the base image doesn't ship it (some don't), uses--break-system-packagesfor PEP 668, and--ignore-installedso pip doesn't fight with apt-managed packages likepython3-cryptography. Now also checkscryptographyimport in addition towebsockets, and only installs what's actually missing.README.md— Quick Start rewritten to the canonical 3-command flow. What's New entry is honest about v1.4.0–v1.4.2 being broken and tells users to pull the latest override..github/workflows/docker-publish.yml— gated to manualworkflow_dispatchonly. Stops failing on every push. Dockerfile and entrypoint stay in the repo for anyone who wants to fork and rebuild againstagent0ai/agent-zero-base.plugin.yaml— 1.4.3Test plan
python3 -m py_compile execute.py— cleanpython3 -c "import yaml; yaml.safe_load(...)"on all 3 yaml files — clean./a0-data/usr/plugins/phantom_bridge, drop the override,docker compose up -d, click Execute in the UI, verify Phantom Bridge sidebar opens.Files
docker-compose.override.yml— drop broken image refexecute.py— pip bootstrap + cryptography checkREADME.md— Quick Start rewrite + What's New entry.github/workflows/docker-publish.yml— manual dispatch onlyplugin.yaml— 1.4.3Action items after merge