Skip to content

build: bump debian from 3783cc0 to 7c7b2c9 in /sandbox/.devcontainer in the docker group #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
EraPartner merged 1 commit into from
Oct 20, 2026
Merged

build: bump debian from 3783cc0 to 7c7b2c9 in /sandbox/.devcontainer in the docker group #14

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion sandbox/.devcontainer/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Generic universal full-dev sandbox image — devcontainer-FREE (built by `container build`).
# Root entrypoint configures the firewall and proxy, then drops privileges.
FROM debian:bookworm-slim@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2e3687004faa906251
FROM debian:bookworm-slim@sha256:7c7b2c966bc9ee8cedfeef67e0e279108992c77681fa595db4a9d65c06ccc587

ARG TZ=UTC
ENV TZ="$TZ"
Expand All @@ -25,7 +25,7 @@
&& echo "C.UTF-8 UTF-8" > /etc/locale.gen && locale-gen

# GitHub CLI from the official cli.github.com apt repo.
RUN install -d -m 0755 /etc/apt/keyrings \

Check warning on line 28 in sandbox/.devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / dockerfile lint (sandbox/.devcontainer/Dockerfile) 

Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check
&& curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
| tee /etc/apt/keyrings/githubcli-archive-keyring.gpg >/dev/null \
&& chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
Expand All @@ -36,7 +36,7 @@

# --- Node.js — official static build (matches the other sandboxes) -----------
ARG NODE_VERSION=24.21.0
RUN set -eux; \

Check warning on line 39 in sandbox/.devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / dockerfile lint (sandbox/.devcontainer/Dockerfile) 

Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check
case "$(dpkg --print-architecture)" in amd64) na=x64 ;; arm64) na=arm64 ;; *) exit 1 ;; esac; \
curl -fsSLo /tmp/node.tar.xz "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${na}.tar.xz"; \
curl -fsSLo /tmp/node-SHASUMS256.txt "https://nodejs.org/dist/v${NODE_VERSION}/SHASUMS256.txt"; \
Expand All @@ -54,7 +54,7 @@
# pip + venv + ssl, no compile. Bump by editing PY_RELEASE/PY_VERSION.
ARG PY_RELEASE=20260510
ARG PY_VERSION=3.12.13
RUN set -eux; \

Check warning on line 57 in sandbox/.devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / dockerfile lint (sandbox/.devcontainer/Dockerfile) 

Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check
case "$(dpkg --print-architecture)" in arm64) pa=aarch64 ;; amd64) pa=x86_64 ;; *) exit 1 ;; esac; \
url="https://github.com/astral-sh/python-build-standalone/releases/download/${PY_RELEASE}/cpython-${PY_VERSION}+${PY_RELEASE}-${pa}-unknown-linux-gnu-install_only.tar.gz"; \
echo "python-build-standalone: $url"; \
Expand Down Expand Up @@ -88,7 +88,7 @@
ARG CLAUDE_CODE_VERSION=2.1.287
ARG CLAUDE_CODE_SHA256_ARM64=e4daf793d1e74fb0d9874dd09e98690bbfd7be515f78a87fd05b9e2b4bb33b03
ARG CLAUDE_CODE_SHA256_AMD64=3920489a5109cff5786a1a392c25277408ff22bc796d5edb9c16a60e5a1718f0
RUN set -eux; \

Check warning on line 91 in sandbox/.devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / dockerfile lint (sandbox/.devcontainer/Dockerfile) 

Use WORKDIR to switch to a directory

Check warning on line 91 in sandbox/.devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / dockerfile lint (sandbox/.devcontainer/Dockerfile) 

Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check
npm install -g --no-fund --no-audit "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}"; \
case "$(dpkg --print-architecture)" in arm64) na=linux-arm64; want="${CLAUDE_CODE_SHA256_ARM64}" ;; amd64) na=linux-x64; want="${CLAUDE_CODE_SHA256_AMD64}" ;; *) exit 1 ;; esac; \
root="$(npm root -g)/@anthropic-ai/claude-code"; \
Expand All @@ -112,7 +112,7 @@
ARG CODEX_VERSION=0.160.0
ARG CODEX_SHA256_ARM64=50b06603bdcdac39b714f5c3e68583c002b8ad8779ebfdaaf4932ff016b379c0
ARG CODEX_SHA256_AMD64=12eb3e81114588aca3b7998f4f19e8997b056aca08e57a7ca7c8a3ec8c652aad
RUN set -eux; \

Check warning on line 115 in sandbox/.devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / dockerfile lint (sandbox/.devcontainer/Dockerfile) 

Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check
npm install -g --no-fund --no-audit "@openai/codex@${CODEX_VERSION}"; \
case "$(dpkg --print-architecture)" in arm64) target=aarch64-unknown-linux-musl; want="${CODEX_SHA256_ARM64}" ;; amd64) target=x86_64-unknown-linux-musl; want="${CODEX_SHA256_AMD64}" ;; *) exit 1 ;; esac; \
root="$(npm root -g)/@openai/codex"; \
Expand Down Expand Up @@ -168,7 +168,7 @@
&& install -d -o dev -g dev -m 0755 /home/dev/.config /home/dev/.config/gh /home/dev/.local

# Fingerprint the resolved tools for the launch-time drift gate.
RUN set -eux; \

Check warning on line 171 in sandbox/.devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / dockerfile lint (sandbox/.devcontainer/Dockerfile) 

Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check
pinfile=/usr/local/share/dev-sandbox/binary-pins.txt; \
mkdir -p /usr/local/share/dev-sandbox; \
: > "$pinfile"; \
Expand Down Expand Up @@ -228,7 +228,7 @@
# NOTE: docker-only. apple/container 1.0.0 has no healthcheck runner, so this
# HEALTHCHECK is a no-op under the current runtime; real supervision is the
# entrypoint keep-alive loop (squid auto-restart). Kept for parity / docker use.
HEALTHCHECK --interval=30s --timeout=5s --start-period=90s --retries=3 \

Check warning on line 231 in sandbox/.devcontainer/Dockerfile

View workflow job for this annotation

GitHub Actions / dockerfile lint (sandbox/.devcontainer/Dockerfile) 

Use arguments JSON notation for CMD and ENTRYPOINT arguments
CMD bash -c 'pgrep -x squid >/dev/null && /usr/sbin/iptables -S OUTPUT 2>/dev/null | grep -q "^-P OUTPUT DROP"'

ENTRYPOINT ["/usr/local/sbin/dev-sandbox-entrypoint"]
Loading