Dockerfile

ARG REGISTRY_MIRROR=docker.io
ARG GOPROXY=https://proxy.golang.org,direct
ARG GITHUB_MIRROR=https://github.com
ARG BUF_VERSION=v1.68.1
ARG GO_VERSION=1.26.7

FROM ${REGISTRY_MIRROR}/library/golang:${GO_VERSION}-alpine AS golang-toolchain

FROM ${REGISTRY_MIRROR}/library/debian:bookworm AS boxlite-build
ARG BOXLITE_VERSION=v0.9.7
ARG GITHUB_MIRROR
ARG TARGETARCH
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl python3 tar &&     rm -rf /var/lib/apt/lists/*
RUN set -e;     target_arch="${TARGETARCH:-$(dpkg --print-architecture)}";     case "${target_arch}" in       amd64) BOXLITE_ARCH=x64 ;;       arm64) BOXLITE_ARCH=arm64 ;;       *) echo "unsupported BoxLite target arch: ${target_arch}" >&2; exit 1 ;;     esac;     mkdir -p /tmp/boxlite/runtime /tmp/boxlite/sdk /out/include /out/lib /out/runtime &&     BOXLITE_RUNTIME_NAME=boxlite-runtime-${BOXLITE_VERSION}-linux-${BOXLITE_ARCH}-gnu.tar.gz &&     BOXLITE_C_NAME=boxlite-c-${BOXLITE_VERSION}-linux-${BOXLITE_ARCH}-gnu.tar.gz &&     curl --http1.1 --retry 5 --retry-all-errors --retry-delay 2 -fsSL -o /tmp/boxlite/${BOXLITE_RUNTIME_NAME} ${GITHUB_MIRROR}/boxlite-ai/boxlite/releases/download/${BOXLITE_VERSION}/${BOXLITE_RUNTIME_NAME} &&     curl --http1.1 --retry 5 --retry-all-errors --retry-delay 2 -fsSL -o /tmp/boxlite/${BOXLITE_C_NAME} ${GITHUB_MIRROR}/boxlite-ai/boxlite/releases/download/${BOXLITE_VERSION}/${BOXLITE_C_NAME} &&     tar -xzf /tmp/boxlite/${BOXLITE_RUNTIME_NAME} -C /tmp/boxlite/runtime &&     tar -xzf /tmp/boxlite/${BOXLITE_C_NAME} -C /tmp/boxlite/sdk &&     cp -a /tmp/boxlite/runtime/boxlite-runtime/. /out/runtime/ &&     cp /tmp/boxlite/sdk/*/include/boxlite.h /out/include/boxlite.h &&     cp -a /tmp/boxlite/sdk/*/lib/libboxlite.* /out/lib/

# Fetch the prebuilt microsandbox artifacts for the target architecture. The Go
# FFI library (libmicrosandbox_go_ffi) ships as a release asset, so there is no
# need to build it from source with a Rust toolchain — we just download it
# alongside msb, agentd and libkrunfw and verify everything against the
# published checksums. This keeps the FFI lib in lockstep with the
# microsandbox/sdk/go module pinned in go.mod.
FROM ${REGISTRY_MIRROR}/library/debian:bookworm AS microsandbox-fetch
ARG MICROSANDBOX_VERSION=v0.6.14
ARG GITHUB_MIRROR
ARG TARGETARCH
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl binutils tar &&     rm -rf /var/lib/apt/lists/*
RUN set -e;     target_arch="${TARGETARCH:-$(dpkg --print-architecture)}";     case "${target_arch}" in       amd64) MICROSANDBOX_ARCH=x86_64 ;;       arm64) MICROSANDBOX_ARCH=aarch64 ;;       *) echo "unsupported Microsandbox target arch: ${target_arch}" >&2; exit 1 ;;     esac;     base="${GITHUB_MIRROR}/superradcompany/microsandbox/releases/download/${MICROSANDBOX_VERSION}";     mkdir -p /tmp/microsandbox/extract /out/bin /out/lib;     cd /tmp/microsandbox;     curl --http1.1 --retry 5 --retry-all-errors --retry-delay 2 -fsSL -O "${base}/microsandbox-linux-${MICROSANDBOX_ARCH}.tar.gz";     curl --http1.1 --retry 5 --retry-all-errors --retry-delay 2 -fsSL -O "${base}/agentd-${MICROSANDBOX_ARCH}";     curl --http1.1 --retry 5 --retry-all-errors --retry-delay 2 -fsSL -O "${base}/libmicrosandbox_go_ffi-linux-${target_arch}.so";     curl --http1.1 --retry 5 --retry-all-errors --retry-delay 2 -fsSL -O "${base}/checksums.sha256";     sha256sum -c --ignore-missing checksums.sha256;     tar -xzf "microsandbox-linux-${MICROSANDBOX_ARCH}.tar.gz" -C /tmp/microsandbox/extract;     install -m755 /tmp/microsandbox/extract/msb /out/bin/msb;     install -m755 "agentd-${MICROSANDBOX_ARCH}" /out/bin/agentd;     krunfw="$(find /tmp/microsandbox/extract -maxdepth 1 -type f -name 'libkrunfw.so.*' | sort | tail -n 1)";     test -n "${krunfw}";     krunfw_name="$(basename "${krunfw}")";     install -m644 "${krunfw}" "/out/lib/${krunfw_name}";     ln -sf "${krunfw_name}" /out/lib/libkrunfw.so.5;     ln -sf libkrunfw.so.5 /out/lib/libkrunfw.so;     install -m644 "libmicrosandbox_go_ffi-linux-${target_arch}.so" /out/lib/libmicrosandbox_go_ffi.so;     strip --strip-unneeded /out/lib/libmicrosandbox_go_ffi.so 2>/dev/null || true

FROM ${REGISTRY_MIRROR}/library/debian:bookworm AS go-build
ARG GOPROXY
ARG BUF_VERSION
RUN apt-get update && apt-get install -y --no-install-recommends build-essential ca-certificates curl git tar && rm -rf /var/lib/apt/lists/*
COPY --from=golang-toolchain /usr/local/go /usr/local/go
ENV PATH=/usr/local/go/bin:${PATH}
WORKDIR /app
COPY --from=boxlite-build /out /app/build/boxlite
COPY --from=microsandbox-fetch /out /app/build/microsandbox
COPY scripts/build-agent-compose-binary.sh scripts/build-agent-compose-binary.sh
COPY scripts/with-go-toolchain.sh scripts/with-go-toolchain.sh
COPY go.mod go.sum ./
# go.mod replaces the proto module with ./proto, so its module files have to
# be here before anything can resolve the graph. Only the module files: the
# generated sources arrive later and must not bust this layer's cache.
COPY proto/go.mod proto/go.sum ./proto/
RUN go env -w GOPROXY="${GOPROXY}" && go mod download
RUN GOBIN=/usr/local/bin go install github.com/bufbuild/buf/cmd/buf@${BUF_VERSION}
COPY cmd ./cmd
COPY internal ./internal
COPY pkg ./pkg
COPY assets ./assets
COPY proto ./proto
COPY buf.yaml buf.gen.yaml ./
RUN buf generate
ARG VERSION=0
ARG TARGETARCH
RUN target_arch="${TARGETARCH:-$(dpkg --print-architecture)}" && \
    ./scripts/build-agent-compose-binary.sh \
      --profile linux-full \
      --goarch "${target_arch}" \
      --output /out/agent-compose \
      --version "${VERSION}"

FROM scratch AS agent-compose-artifact
COPY --from=go-build /out/agent-compose /out/agent-compose

FROM ${REGISTRY_MIRROR}/library/debian:trixie-slim
RUN apt-get update &&     apt-get install -y --no-install-recommends ca-certificates git python3 tini tzdata e2fsprogs qemu-utils &&     rm -rf /var/lib/apt/lists/*
WORKDIR /app
COPY --from=go-build /out/agent-compose /app/agent-compose
RUN ln -sf /app/agent-compose /usr/local/bin/agent-compose
COPY --from=boxlite-build /out/runtime /app/boxlite/runtime
COPY --from=microsandbox-fetch /out /app/microsandbox
RUN test -x /app/agent-compose && \
    command -v qemu-img >/dev/null && \
    mkfs.ext4 2>&1 | grep -Fq -- '[-d root-directory' && \
    test -x /app/boxlite/runtime/boxlite-guest && \
    test -x /app/boxlite/runtime/boxlite-shim && \
    test -x /app/microsandbox/bin/msb && \
    test -x /app/microsandbox/bin/agentd && \
    test -s /app/microsandbox/lib/libmicrosandbox_go_ffi.so && \
    test -s /app/microsandbox/lib/libkrunfw.so
ENV RUNTIME_DRIVER=docker
ENV DATA_ROOT=/data
ENV HTTP_LISTEN=0.0.0.0:7410
ENV CAP_GRPC_LISTEN=0.0.0.0:7420
ENV CAP_GRPC_TARGET=agent-compose:7420
ENV DEFAULT_IMAGE=debian:bookworm-slim
ENV LLM_TIMEOUT=60s
ENV CODEX_REQUEST_MAX_RETRIES=1
ENV CODEX_STREAM_MAX_RETRIES=1
ENV GUEST_WORKSPACE=/workspace
ENV GUEST_STATE_ROOT=/data/state
ENV GUEST_RUNTIME_ROOT=/data/runtime
ENV GUEST_LOG_ROOT=/data/logs
ENV BOXLITE_RUNTIME_DIR=/app/boxlite/runtime
ENV MICROSANDBOX_HOME=/data/microsandbox
ENV MICROSANDBOX_MSB_PATH=/app/microsandbox/bin/msb
ENV MICROSANDBOX_LIB_PATH=/app/microsandbox/lib/libmicrosandbox_go_ffi.so
ENV LD_LIBRARY_PATH=/app/boxlite/runtime:/app/microsandbox/lib
ENTRYPOINT ["/usr/bin/tini", "--", "/app/agent-compose"]
CMD ["daemon"]