External/roboco
1
0
Fork 0
mirror of https://github.com/rennf93/roboco.git synced 2026-08-03 07:23:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(docker): install codex CLI via npm, not the CDN-denied installer

Browse Source 
The chatgpt.com/codex/install.sh installer returns 'resource is denied'
to non-browser clients in CI, breaking the agent-codex image build.
Switch to npm install -g @openai/codex@<pinned>: the package has no
postinstall network fetch (verified) — its native binary rides an
optionalDependency served from the public npm registry, and node is
already in the base image. Verified locally: install succeeds, codex
--version runs.
This commit is contained in:
Renn F
2026-07-23 03:34:52 +02:00
parent c70ff3cf9a
commit 13abb2ece0
1 changed files with 10 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/agent-codex.Dockerfile
+10 -11
View File
@@ -19,18 +19,17 @@ FROM roboco-agent-base
USER root
# Install the official codex CLI for the agent user. Pinned — untrusted model
# output runs under it, so bump the version deliberately, never float. Download
# the installer to a file first (a `curl | bash` pipe hides a curl failure as a
# silent no-op) and verify the binary installed AND runs, so a broken install
# fails the build here, not at spawn. (curl/bash from the base.)
# Install the official codex CLI globally via npm. Pinned — untrusted model
# output runs under it, so bump the version deliberately, never float. The
# npm route (not chatgpt.com/codex/install.sh, which the CDN denies to
# non-browser clients) has no postinstall network fetch: the native binary
# rides an optionalDependency (@openai/codex-linux-x64) served from the
# public npm registry. Global install symlinks `codex` onto PATH for the
# agent user; verify it runs so a broken install fails the build, not spawn.
ARG CODEX_CLI_VERSION=0.145.0
RUN su agent -s /bin/bash -c "set -euo pipefail; export HOME=/home/agent; \
curl -fsSL https://chatgpt.com/codex/install.sh -o /tmp/codex-install.sh; \
bash /tmp/codex-install.sh ${CODEX_CLI_VERSION}; \
test -x /home/agent/.codex/bin/codex || command -v codex; \
codex --version" \
&& rm -rf /tmp/*
RUN npm install -g @openai/codex@${CODEX_CLI_VERSION} \
&& command -v codex \
&& codex --version
# Entrypoint: render ~/.codex/config.toml + execpolicy rules + the per-role
# sandbox flag, then run codex headless (overrides the base image's `claude`