Dockerfile.worker.codex

# Disposable worker image for Switchyard's Codex engine (SYD-187) -- the
# codex-exec counterpart of Dockerfile.worker (SYD-30). The container clones
# the target repo inside itself, works on a branch, and pushes the branch
# back out -- it never mutates the host filesystem directly.
#
# No CA-trust tooling is installed here: codex (Rust) honors SSL_CERT_FILE
# directly, so container-entry.codex.sh points it at the syd-egress CA
# mounted read-only at /ca/mitmproxy-ca-cert.pem (spike, Task 1) instead of
# installing the cert into the system trust store.
FROM node:24-slim

# python3/make/g++ (SYD-224): node-gyp's toolchain, so native modules like
# better-sqlite3 build from source via its `node-gyp rebuild` fallback --
# prebuild-install's GitHub Releases fetch isn't reachable inside the
# session's egress allowlist (EGRESS_BASELINE in scripts/worker-select.ts).
RUN apt-get update \
    && apt-get install -y --no-install-recommends git ca-certificates python3 make g++ \
    && rm -rf /var/lib/apt/lists/*

# Pinned so image rebuilds are reproducible (SYD-227) -- a plain `npm install -g
# @openai/codex` would silently pick up whatever is newest at build
# time. Bump via `--build-arg CODEX_CLI_VERSION=x.y.z` or by editing the
# default below; see README's containerized-mode section for the update steps.
ARG CODEX_CLI_VERSION=0.145.0
RUN npm install -g @openai/codex@${CODEX_CLI_VERSION} \
    && codex --version

# SYD-253: pnpm for target repos that commit pnpm-lock.yaml (yarn is bundled
# in the base image; the --version call asserts it) -- see the matching block
# in Dockerfile.worker for why this is a pinned binary, not `corepack enable`.
ARG PNPM_VERSION=11.17.0
RUN npm install -g pnpm@${PNPM_VERSION} \
    && pnpm --version \
    && yarn --version

COPY scripts/container-entry.codex.sh /entry.sh
COPY scripts/prime-workspace-trust.mjs /prime-workspace-trust.mjs
COPY scripts/install-guard.mjs /install-guard.mjs
RUN chmod +x /entry.sh

# Out-of-band attachment uploader (SYD-182): baked in so any dispatched worker
# can `switchyard-attach <ISSUE_REF> <FILE>` regardless of the target repo,
# streaming the bytes to the tracker instead of base64-ing them through an MCP
# tool arg. Shell wrapper (not a bare rename) so node runs the .mjs as ESM.
COPY scripts/attach.mjs /opt/switchyard/attach.mjs
RUN printf '#!/bin/sh\nexec node /opt/switchyard/attach.mjs "$@"\n' > /usr/local/bin/switchyard-attach \
    && chmod +x /usr/local/bin/switchyard-attach

# Run as the image's built-in non-root `node` user (SYD-117) instead of root
# -- narrows the blast radius of a compromised session and, combined with
# --security-opt no-new-privileges (worker-select.ts buildDockerArgs), stops
# it from regaining privilege inside the container. /work is where
# container-entry.codex.sh clones the repo, so it needs to be node-writable
# before we drop root.
RUN mkdir -p /work && chown node:node /work
USER node
WORKDIR /work

ENTRYPOINT ["/bin/sh", "/entry.sh"]