vhaudiquet
c1059c23e0
The Durable Object, the sandbox daemon, and their deploy assets leave the rhema workspace for a repository of their own. The DO was already a deployment artifact (publish = false, worker feature wasm-only), and rhema-sandbox-server's only consumer was the image beside it — both are product, not framework. The harness and the seam stay behind: rhema-cloud-agent and the sandbox family join the rhema repository's publish list, and this tree consumes them from crates.io at 0.2.6, the same arrangement the claw keeps its framework crates under. The sandboxd image build carries the fix its extraction needed: the old Dockerfile still staged the claw's workspace (claw and tools manifests, integrations globs, the vendored crossterm) and missed rhema-provider-registry's manifest entirely. The manifest stage is now this workspace's two members, fetched from the registry. Not yet buildable: the rhema 0.2.6 batch (rhema-sandbox, -local, -http, rhema-cloud-agent) must publish first — then one cargo check generates Cargo.lock and CI goes green.
40 lines
1.4 KiB
Markdown
40 lines
1.4 KiB
Markdown
# Docker images
|
|
|
|
Every Dockerfile here builds from the repository root as its context:
|
|
|
|
```sh
|
|
docker build -f deploy/docker/<name>.Dockerfile -t <name> .
|
|
```
|
|
|
|
## rhema-sandboxd
|
|
|
|
The sandbox wire protocol served from a host: one root directory per
|
|
session under a fixed base, `bash -c` exec under a `timeout` budget,
|
|
files and seeds on the fs, the token checked on every route
|
|
(`specs/rhema-sandbox.md` §3).
|
|
|
|
Build and run:
|
|
|
|
```sh
|
|
docker build -f deploy/docker/sandboxd.Dockerfile -t rhema-sandboxd .
|
|
|
|
docker run -d --name sandboxd \
|
|
-p 7600:7600 \
|
|
-v sandboxd-base:/var/lib/rhema-sandboxd \
|
|
rhema-sandboxd --port 7600 --token "$(openssl rand -hex 32)"
|
|
```
|
|
|
|
- `--token` has no environment default: the runner passes the shared
|
|
secret on the command line; clients send it in `x-rhema-token`.
|
|
- `--port` must be passed — the binary's default is `0` (OS-picked),
|
|
which a published mapping cannot follow. The image binds `0.0.0.0`
|
|
(the binary's own default is loopback; overriding the host means
|
|
overriding the entrypoint).
|
|
- The base (`-v`) holds one directory per session name; mount a volume
|
|
or bind mount there, or every session dies with the container.
|
|
|
|
A client reaches it with `HttpSandbox` (feature `client`): the base URL
|
|
is `http://<host>:<port>`, and the session name is the first path
|
|
segment of every route — `POST {base}/{session}/exec|/put|/get|/seed`,
|
|
plus `GET /healthz` at the root, token required there too.
|