mirror of
https://github.com/rennf93/roboco.git
synced 2026-08-03 07:23:24 +02:00
Renn F
433a85784e
Running the built grok-prompter container surfaced a second EACCES the mechanism analysis missed: bind-mounting the opencode store at ~/.local/share/opencode makes docker create the intermediate ~/.local AS ROOT, so the non-root agent user then cannot create its sibling ~/.local/state and opencode dies at boot. Pre-create the ~/.local tree agent-owned in the image so the mount leaves the parents writable. Complements the orchestrator 0777 host-source pre-create (which covers the bind source on Linux). Verified live: with this fix the container starts clean, opencode serve opens the session, a POST /turn produces a real grok reply, and all chunks (thinking/text/turn_end) reach the relay endpoint.
47 lines
2.3 KiB
Docker
47 lines
2.3 KiB
Docker
# Grok (xAI) Agent Image
|
|
# =============================================================================
|
|
# Runs grok-build-0.1 through the opencode CLI (OpenAI protocol) instead of
|
|
# Claude Code, while reusing the base image's roboco venv + uv + the RoboCo MCP
|
|
# gateway servers. The entrypoint renders opencode.json from the spawn env +
|
|
# mounted mcp-config.json (see roboco.llm.providers.opencode_config) and runs
|
|
# opencode. One runtime image serves every role — role behaviour comes from the
|
|
# mounted system prompt / manifest / mcp-config, exactly as on the Claude path.
|
|
# =============================================================================
|
|
|
|
FROM roboco-agent-base
|
|
|
|
USER root
|
|
|
|
# opencode — the OpenAI-protocol agent runtime. grok-build-0.1 is driven via the
|
|
# OpenAI Responses API, so the provider package is @ai-sdk/openai (NOT
|
|
# @ai-sdk/openai-compatible, which is chat/completions only and errors with
|
|
# "responses is not a function"). opencode resolves it at runtime, but
|
|
# pre-installing keeps first spawn off the network.
|
|
RUN npm install -g opencode-ai @ai-sdk/openai \
|
|
&& npm cache clean --force \
|
|
&& rm -rf /root/.npm /tmp/*
|
|
|
|
# Command guard / secret-scrub plugin (bash-guard parity for the opencode runtime).
|
|
# Referenced from the generated opencode.json `plugin:` array.
|
|
COPY docker/grok/secret-scrub.js /app/opencode-plugins/secret-scrub.js
|
|
|
|
# Entrypoint: render opencode.json, then run opencode (overrides base's `claude`).
|
|
COPY docker/scripts/grok-agent-entrypoint.sh /app/scripts/grok-agent-entrypoint.sh
|
|
RUN chmod 0755 /app/scripts/grok-agent-entrypoint.sh
|
|
|
|
# opencode persists data under ~/.local/share and state under ~/.local/state.
|
|
# When the orchestrator bind-mounts the opencode store at
|
|
# ~/.local/share/opencode, docker creates the intermediate ~/.local AS ROOT, so
|
|
# the non-root agent can no longer create its sibling ~/.local/state and opencode
|
|
# EACCESes at boot. Pre-create the tree agent-owned so the mount leaves the
|
|
# parents writable (complements the orchestrator's 0777 host-source pre-create).
|
|
RUN mkdir -p /home/agent/.local/share/opencode /home/agent/.local/state \
|
|
&& chown -R agent:agent /home/agent/.local
|
|
|
|
USER agent
|
|
|
|
LABEL role="grok-runtime"
|
|
LABEL description="Grok (xAI) agent runtime — grok-build-0.1 via opencode (OpenAI protocol)"
|
|
|
|
ENTRYPOINT ["/app/scripts/grok-agent-entrypoint.sh"]
|