From 82a11d6dd8980411d396c29cf330a4795c54765a Mon Sep 17 00:00:00 2001 From: yursds Date: Sun, 5 Apr 2026 11:10:14 +0200 Subject: [PATCH 1/6] fix: move user directive from Dockerfile to compose and restore capabilities Remove USER directive from both Dockerfiles and set user: 1000:1000 in docker-compose.yml. Replace cap_drop: ALL with targeted drops and add capabilities needed for sudo (SETUID, SETGID, DAC_OVERRIDE, FOWNER). Set no-new-privileges:false to allow privilege escalation. --- Dockerfile.cpu | 2 -- Dockerfile.gpu | 2 -- docker-compose.yml | 28 ++++++++++++++++++++++++---- 3 files changed, 24 insertions(+), 8 deletions(-) diff --git a/Dockerfile.cpu b/Dockerfile.cpu index 33c7190..da05b69 100644 --- a/Dockerfile.cpu +++ b/Dockerfile.cpu @@ -81,7 +81,5 @@ RUN cp /opt/project-configs/opencode/oh-my-opencode-free.json /opt/opencode-conf cp /opt/project-configs/opencode/oh-my-opencode-paid.json /opt/opencode-config/ 2>/dev/null || true && \ cp /opt/project-configs/templates/AGENTS.md-global /opt/opencode-config/AGENTS.md 2>/dev/null || true -USER ${USERNAME} - ENTRYPOINT ["/entrypoint.sh"] CMD ["bash"] diff --git a/Dockerfile.gpu b/Dockerfile.gpu index e100c39..5b5a2b8 100644 --- a/Dockerfile.gpu +++ b/Dockerfile.gpu @@ -89,7 +89,5 @@ RUN cp /opt/project-configs/opencode/oh-my-opencode-free.json /opt/opencode-conf cp /opt/project-configs/opencode/oh-my-opencode-paid.json /opt/opencode-config/ 2>/dev/null || true && \ cp /opt/project-configs/templates/AGENTS.md-global /opt/opencode-config/AGENTS.md 2>/dev/null || true -USER ${USERNAME} - ENTRYPOINT ["/entrypoint.sh"] CMD ["bash"] diff --git a/docker-compose.yml b/docker-compose.yml index 258b8c7..b41ba9b 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -24,6 +24,7 @@ services: stdin_open: true tty: true + user: "1000:1000" volumes: - ${PROJECT_PATH:-.}:/home/hannya/workspace:rw @@ -58,14 +59,23 @@ services: capabilities: [ gpu ] security_opt: - - no-new-privileges:true + - no-new-privileges:false cap_drop: - - ALL + - SYS_ADMIN + - NET_RAW + - MKNOD + - AUDIT_WRITE + - SETFCAP cap_add: - CHOWN - SETUID - SETGID - SYS_PTRACE + - DAC_OVERRIDE + - FOWNER + - KILL + - NET_BIND_SERVICE + - NET_ADMIN restart: "no" @@ -82,6 +92,7 @@ services: stdin_open: true tty: true + user: "1000:1000" volumes: - ${PROJECT_PATH:-.}:/home/hannya/workspace:rw @@ -107,13 +118,22 @@ services: - QT_X11_NO_MITSHM=1 security_opt: - - no-new-privileges:true + - no-new-privileges:false cap_drop: - - ALL + - SYS_ADMIN + - NET_RAW + - MKNOD + - AUDIT_WRITE + - SETFCAP cap_add: - CHOWN - SETUID - SETGID - SYS_PTRACE + - DAC_OVERRIDE + - FOWNER + - KILL + - NET_BIND_SERVICE + - NET_ADMIN restart: "no" From 290e1c363d460c1dfe6520759c89f28311508da6 Mon Sep 17 00:00:00 2001 From: yursds Date: Sun, 5 Apr 2026 11:10:27 +0200 Subject: [PATCH 2/6] fix: make entrypoint conditional for root and non-root execution Add UID check to handle both compose user mode (1000:1000) and root mode. Root path performs chown and su -l to switch user. Non-root path skips chown and executes command directly. --- entrypoint.sh | 66 ++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 52 insertions(+), 14 deletions(-) diff --git a/entrypoint.sh b/entrypoint.sh index 9c10fdb..c7b39b2 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -1,23 +1,61 @@ #!/bin/bash set -e -sudo chown -R hannya:hannya "$HOME" 2>/dev/null || true +USERNAME=hannya +HOME_DIR=/home/$USERNAME +MYUID=1000 +MYGID=1000 -mkdir -p "$HOME/workspace" -cd "$HOME/workspace" +if [ "$(id -u)" = "0" ]; then + mkdir -p $HOME_DIR + chown $MYUID:$MYGID $HOME_DIR -mkdir -p "$HOME/.config/opencode" "$HOME/.local/bin" "$HOME/.local/share" + mkdir -p $HOME_DIR/workspace + chown $MYUID:$MYGID $HOME_DIR/workspace -if [ ! -f "$HOME/.config/opencode/opencode.json" ] && [ -d /opt/opencode-config ]; then - cp -r /opt/opencode-config/* "$HOME/.config/opencode/" 2>/dev/null || true -fi + mkdir -p $HOME_DIR/.config/opencode $HOME_DIR/.local/bin $HOME_DIR/.local/share + chown -R $MYUID:$MYGID $HOME_DIR/.config $HOME_DIR/.local -if [ -n "$OPENCODE_CONFIG" ] && [ "$OPENCODE_CONFIG" != "default" ]; then - SRC="/opt/opencode-config/oh-my-opencode-${OPENCODE_CONFIG}.json" - DEST="$HOME/.config/opencode/oh-my-opencode.json" - if [ -f "$SRC" ]; then - cp "$SRC" "$DEST" + if [ ! -f $HOME_DIR/.config/opencode/opencode.json ] && [ -d /opt/opencode-config ]; then + cp -r /opt/opencode-config/* $HOME_DIR/.config/opencode/ 2>/dev/null || true fi -fi -exec "$@" + if [ -n "$OPENCODE_CONFIG" ] && [ "$OPENCODE_CONFIG" != "default" ]; then + SRC="/opt/opencode-config/oh-my-opencode-${OPENCODE_CONFIG}.json" + DEST="$HOME_DIR/.config/opencode/oh-my-opencode.json" + if [ -f "$SRC" ]; then + cp "$SRC" "$DEST" + fi + fi + + if [ $# -gt 0 ]; then + CMD="$*" + else + CMD="bash" + fi + + exec su -l $USERNAME -c "cd ~/workspace && $CMD" +else + mkdir -p $HOME_DIR/workspace $HOME_DIR/.config/opencode $HOME_DIR/.local/bin $HOME_DIR/.local/share + cd $HOME_DIR/workspace + + if [ ! -f $HOME_DIR/.config/opencode/opencode.json ] && [ -d /opt/opencode-config ]; then + cp -r /opt/opencode-config/* $HOME_DIR/.config/opencode/ 2>/dev/null || true + fi + + if [ -n "$OPENCODE_CONFIG" ] && [ "$OPENCODE_CONFIG" != "default" ]; then + SRC="/opt/opencode-config/oh-my-opencode-${OPENCODE_CONFIG}.json" + DEST="$HOME_DIR/.config/opencode/oh-my-opencode.json" + if [ -f "$SRC" ]; then + cp "$SRC" "$DEST" + fi + fi + + if [ $# -gt 0 ]; then + CMD="$*" + else + CMD="bash" + fi + + exec $CMD +fi From c274d741e13d0d1db217522c65bf3620fe4926e3 Mon Sep 17 00:00:00 2001 From: yursds Date: Sun, 5 Apr 2026 11:10:36 +0200 Subject: [PATCH 3/6] docs: add no-hardcoded-values rule to global AGENTS.md --- configs/templates/AGENTS.md-global | 1 + 1 file changed, 1 insertion(+) diff --git a/configs/templates/AGENTS.md-global b/configs/templates/AGENTS.md-global index 5b6bd8e..4b507e6 100644 --- a/configs/templates/AGENTS.md-global +++ b/configs/templates/AGENTS.md-global @@ -10,6 +10,7 @@ Global rules for all AI agents in this environment. - Fail fast, fail loud: never silently swallow errors or hide failures behind fallbacks. - Minimal changes: touch only what is necessary. - Read before writing: understand existing patterns before modifying. +- **No hardcoded values**: all configurable values must be defined as constants, env vars, or in config files. Never inline literals for paths, ports, credentials, model names, or feature flags. --- From bd6dad3879e0b1a120b9b976e016faf70e511743 Mon Sep 17 00:00:00 2001 From: yursds Date: Mon, 6 Apr 2026 00:33:45 +0200 Subject: [PATCH 4/6] refactor: reorganize Dockerfiles for user-first installation --- Dockerfile.cpu | 57 ++++++++----------- Dockerfile.gpu | 57 ++++++++----------- ...de-free.json => oh-my-openagent-free.json} | 0 ...de-paid.json => oh-my-openagent-paid.json} | 0 4 files changed, 50 insertions(+), 64 deletions(-) rename configs/opencode/{oh-my-opencode-free.json => oh-my-openagent-free.json} (100%) rename configs/opencode/{oh-my-opencode-paid.json => oh-my-openagent-paid.json} (100%) diff --git a/Dockerfile.cpu b/Dockerfile.cpu index da05b69..ed0d4c5 100644 --- a/Dockerfile.cpu +++ b/Dockerfile.cpu @@ -11,7 +11,6 @@ ARG MYGID=1000 ARG USERNAME=hannya ENV DEBIAN_FRONTEND=noninteractive -ENV HOME=/root # ── System ──────────────────────────────────────────────────────────────────── RUN apt-get update && apt-get install -y --no-install-recommends \ @@ -25,24 +24,6 @@ RUN curl -fsSL https://nodejs.org/dist/v22.22.2/node-v22.22.2-linux-x64.tar.gz | # ── uv ──────────────────────────────────────────────────────────────────────── COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/ -# ── Bun ─────────────────────────────────────────────────────────────────────── -RUN curl -fsSL https://bun.sh/install | bash && \ - cp $HOME/.bun/bin/bun /usr/local/bin/bun && \ - cp $HOME/.bun/bin/bunx /usr/local/bin/bunx - -# ── OpenCode + oh-my-openagent ─────────────────────────────────────────────── -RUN curl -fsSL https://opencode.ai/install | bash -RUN npm install -g oh-my-opencode oh-my-opencode-linux-x64 -RUN bunx oh-my-opencode install --no-tui --claude=no --openai=no --gemini=no --copilot=no --opencode-zen=yes - -# Ensure opencode binary is on PATH -RUN cp $HOME/.opencode/bin/opencode /usr/local/bin/opencode - -# Save generated config + templates to a safe location -RUN mkdir -p /opt/opencode-config && \ - cp -r $HOME/.config/opencode/* /opt/opencode-config/ 2>/dev/null || true && \ - cp $HOME/.config/opencode/oh-my-opencode.json /opt/opencode-config/oh-my-opencode.json.backup 2>/dev/null || true - # ── User ────────────────────────────────────────────────────────────────────── RUN OLD_USER=$(awk -v uid="${MYUID}" -F ':' '$3==uid {print $1}' /etc/passwd) && \ if [ -z "${OLD_USER}" ]; then \ @@ -63,23 +44,35 @@ RUN OLD_USER=$(awk -v uid="${MYUID}" -F ':' '$3==uid {print $1}' /etc/passwd) && touch /home/${USERNAME}/.sudo_as_admin_successful && \ echo 'export PS1="\[\e[01;36m\][DOCKER] \u@\h\[\e[00m\]:\[\e[01;34m\]\w\[\e[00m\]\$ "' >> /home/${USERNAME}/.bashrc -ENV TERM=xterm-256color -ENV SHELL=/bin/bash +# ── Project configs ─────────────────────────────────────────────────────────── +COPY --chown=${USERNAME}:${MYGID} configs/opencode/ /home/${USERNAME}/.config/opencode/ +COPY --chown=${USERNAME}:${MYGID} configs/templates/AGENTS.md-global /home/${USERNAME}/.config/opencode/AGENTS.md +COPY --chown=${USERNAME}:${MYGID} configs/templates/switch-opencode-config.sh /usr/local/bin/switch-opencode-config +RUN chmod +x /usr/local/bin/switch-opencode-config + +# ── Everything else as user ────────────────────────────────────────────────── +USER ${USERNAME} ENV HOME=/home/${USERNAME} -ENV PATH="/home/${USERNAME}/.local/bin:/home/${USERNAME}/.bun/bin:${PATH}" +ENV PATH="/home/${USERNAME}/.opencode/bin:/home/${USERNAME}/.local/bin:/home/${USERNAME}/.bun/bin:${PATH}" -WORKDIR /workspace +# Bun +RUN curl -fsSL https://bun.sh/install | bash +# OpenCode +RUN curl -fsSL https://opencode.ai/install | bash + +# oh-my-openagent +RUN bunx oh-my-openagent install --no-tui --claude=no --openai=no --gemini=no --copilot=no --opencode-zen=yes && \ + cp ~/.config/opencode/oh-my-openagent.json ~/.config/opencode/oh-my-openagent-default.json + +# ── Entrypoint ──────────────────────────────────────────────────────────────── COPY --chown=${USERNAME}:${MYGID} entrypoint.sh /entrypoint.sh -COPY --chown=${USERNAME}:${MYGID} configs/ /opt/project-configs/ -RUN chmod +x /entrypoint.sh && \ - chmod +x /opt/project-configs/templates/switch-opencode-config.sh && \ - cp /opt/project-configs/templates/switch-opencode-config.sh /usr/local/bin/switch-opencode-config - -# Copy project configs into the safe config dir -RUN cp /opt/project-configs/opencode/oh-my-opencode-free.json /opt/opencode-config/ 2>/dev/null || true && \ - cp /opt/project-configs/opencode/oh-my-opencode-paid.json /opt/opencode-config/ 2>/dev/null || true && \ - cp /opt/project-configs/templates/AGENTS.md-global /opt/opencode-config/AGENTS.md 2>/dev/null || true +RUN chmod +x /entrypoint.sh + +ENV TERM=xterm-256color +ENV SHELL=/bin/bash + +WORKDIR /workspace ENTRYPOINT ["/entrypoint.sh"] CMD ["bash"] diff --git a/Dockerfile.gpu b/Dockerfile.gpu index 5b5a2b8..5abc334 100644 --- a/Dockerfile.gpu +++ b/Dockerfile.gpu @@ -14,7 +14,6 @@ ARG MYGID=1000 ARG USERNAME=hannya ENV DEBIAN_FRONTEND=noninteractive -ENV HOME=/root # ── System ──────────────────────────────────────────────────────────────────── RUN apt-get update && apt-get install -y --no-install-recommends \ @@ -28,24 +27,6 @@ RUN curl -fsSL https://nodejs.org/dist/v22.22.2/node-v22.22.2-linux-x64.tar.gz | # ── uv ──────────────────────────────────────────────────────────────────────── COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/ -# ── Bun ─────────────────────────────────────────────────────────────────────── -RUN curl -fsSL https://bun.sh/install | bash && \ - cp $HOME/.bun/bin/bun /usr/local/bin/bun && \ - cp $HOME/.bun/bin/bunx /usr/local/bin/bunx - -# ── OpenCode + oh-my-openagent ─────────────────────────────────────────────── -RUN curl -fsSL https://opencode.ai/install | bash -RUN npm install -g oh-my-opencode oh-my-opencode-linux-x64 -RUN bunx oh-my-opencode install --no-tui --claude=no --openai=no --gemini=no --copilot=no --opencode-zen=yes - -# Ensure opencode binary is on PATH -RUN cp $HOME/.opencode/bin/opencode /usr/local/bin/opencode - -# Save generated config + templates to a safe location -RUN mkdir -p /opt/opencode-config && \ - cp -r $HOME/.config/opencode/* /opt/opencode-config/ 2>/dev/null || true && \ - cp $HOME/.config/opencode/oh-my-opencode.json /opt/opencode-config/oh-my-opencode.json.backup 2>/dev/null || true - # ── User ────────────────────────────────────────────────────────────────────── RUN OLD_USER=$(awk -v uid="${MYUID}" -F ':' '$3==uid {print $1}' /etc/passwd) && \ if [ -z "${OLD_USER}" ]; then \ @@ -71,23 +52,35 @@ ENV NVIDIA_VISIBLE_DEVICES=all ENV NVIDIA_DRIVER_CAPABILITIES=compute,utility,graphics ENV LD_LIBRARY_PATH=/usr/local/nvidia/lib:/usr/local/nvidia/lib64:${LD_LIBRARY_PATH} -ENV TERM=xterm-256color -ENV SHELL=/bin/bash +# ── Project configs ─────────────────────────────────────────────────────────── +COPY --chown=${USERNAME}:${MYGID} configs/opencode/ /home/${USERNAME}/.config/opencode/ +COPY --chown=${USERNAME}:${MYGID} configs/templates/AGENTS.md-global /home/${USERNAME}/.config/opencode/AGENTS.md +COPY --chown=${USERNAME}:${MYGID} configs/templates/switch-opencode-config.sh /usr/local/bin/switch-opencode-config +RUN chmod +x /usr/local/bin/switch-opencode-config + +# ── Everything else as user ────────────────────────────────────────────────── +USER ${USERNAME} ENV HOME=/home/${USERNAME} -ENV PATH="/home/${USERNAME}/.local/bin:/home/${USERNAME}/.bun/bin:${PATH}" +ENV PATH="/home/${USERNAME}/.opencode/bin:/home/${USERNAME}/.local/bin:/home/${USERNAME}/.bun/bin:${PATH}" -WORKDIR /workspace +# Bun +RUN curl -fsSL https://bun.sh/install | bash +# OpenCode +RUN curl -fsSL https://opencode.ai/install | bash + +# oh-my-openagent +RUN bunx oh-my-openagent install --no-tui --claude=no --openai=no --gemini=no --copilot=no --opencode-zen=yes && \ + cp ~/.config/opencode/oh-my-openagent.json ~/.config/opencode/oh-my-openagent-default.json + +# ── Entrypoint ──────────────────────────────────────────────────────────────── COPY --chown=${USERNAME}:${MYGID} entrypoint.sh /entrypoint.sh -COPY --chown=${USERNAME}:${MYGID} configs/ /opt/project-configs/ -RUN chmod +x /entrypoint.sh && \ - chmod +x /opt/project-configs/templates/switch-opencode-config.sh && \ - cp /opt/project-configs/templates/switch-opencode-config.sh /usr/local/bin/switch-opencode-config - -# Copy project configs into the safe config dir -RUN cp /opt/project-configs/opencode/oh-my-opencode-free.json /opt/opencode-config/ 2>/dev/null || true && \ - cp /opt/project-configs/opencode/oh-my-opencode-paid.json /opt/opencode-config/ 2>/dev/null || true && \ - cp /opt/project-configs/templates/AGENTS.md-global /opt/opencode-config/AGENTS.md 2>/dev/null || true +RUN chmod +x /entrypoint.sh + +ENV TERM=xterm-256color +ENV SHELL=/bin/bash + +WORKDIR /workspace ENTRYPOINT ["/entrypoint.sh"] CMD ["bash"] diff --git a/configs/opencode/oh-my-opencode-free.json b/configs/opencode/oh-my-openagent-free.json similarity index 100% rename from configs/opencode/oh-my-opencode-free.json rename to configs/opencode/oh-my-openagent-free.json diff --git a/configs/opencode/oh-my-opencode-paid.json b/configs/opencode/oh-my-openagent-paid.json similarity index 100% rename from configs/opencode/oh-my-opencode-paid.json rename to configs/opencode/oh-my-openagent-paid.json From 662b0e9145c8b038cfb2c9162fdbf65cf0829551 Mon Sep 17 00:00:00 2001 From: yursds Date: Mon, 6 Apr 2026 00:33:51 +0200 Subject: [PATCH 5/6] refactor: fix entrypoint and switch script for openagent config naming --- configs/templates/switch-opencode-config.sh | 19 ++++++------ entrypoint.sh | 32 ++++++--------------- 2 files changed, 17 insertions(+), 34 deletions(-) diff --git a/configs/templates/switch-opencode-config.sh b/configs/templates/switch-opencode-config.sh index 1860f0c..db0d250 100644 --- a/configs/templates/switch-opencode-config.sh +++ b/configs/templates/switch-opencode-config.sh @@ -5,21 +5,20 @@ CONFIG_DIR="$HOME/.config/opencode" case "$1" in free) - cp "$CONFIG_DIR/oh-my-opencode-free.json" "$CONFIG_DIR/oh-my-apenagent.json" - echo "FREE activated (OpenCode Zen free models)" + cp "$CONFIG_DIR/oh-my-openagent-free.json" "$CONFIG_DIR/oh-my-openagent.json" + echo "Free config activated" ;; paid) - cp "$CONFIG_DIR/oh-my-opencode-paid.json" "$CONFIG_DIR/oh-my-openagent.json" - echo "PAID activated (GitHub Copilot models)" + cp "$CONFIG_DIR/oh-my-openagent-paid.json" "$CONFIG_DIR/oh-my-openagent.json" + echo "Paid config activated" ;; default) - cp "$CONFIG_DIR/oh-my-openagent.json.bak" "$CONFIG_DIR/oh-my-openagent.json" - echo "Default config restored (from installer backup)" + cp "$CONFIG_DIR/oh-my-openagent-default.json" "$CONFIG_DIR/oh-my-openagent.json" + echo "Default config restored" ;; *) - echo "Usage: $0 {free|paid|default}" - echo " free - OpenCode Zen free models only" - echo " paid - GitHub Copilot models" - echo " default - Restore installer-generated config" + echo "Usage: $0 {free|paid}" + echo " free - Free models only" + echo " paid - Paid models" ;; esac diff --git a/entrypoint.sh b/entrypoint.sh index c7b39b2..f85307e 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -3,26 +3,14 @@ set -e USERNAME=hannya HOME_DIR=/home/$USERNAME -MYUID=1000 -MYGID=1000 if [ "$(id -u)" = "0" ]; then - mkdir -p $HOME_DIR - chown $MYUID:$MYGID $HOME_DIR - mkdir -p $HOME_DIR/workspace - chown $MYUID:$MYGID $HOME_DIR/workspace - - mkdir -p $HOME_DIR/.config/opencode $HOME_DIR/.local/bin $HOME_DIR/.local/share - chown -R $MYUID:$MYGID $HOME_DIR/.config $HOME_DIR/.local - - if [ ! -f $HOME_DIR/.config/opencode/opencode.json ] && [ -d /opt/opencode-config ]; then - cp -r /opt/opencode-config/* $HOME_DIR/.config/opencode/ 2>/dev/null || true - fi + chown -R ${MYUID:-1000}:${MYGID:-1000} $HOME_DIR - if [ -n "$OPENCODE_CONFIG" ] && [ "$OPENCODE_CONFIG" != "default" ]; then - SRC="/opt/opencode-config/oh-my-opencode-${OPENCODE_CONFIG}.json" - DEST="$HOME_DIR/.config/opencode/oh-my-opencode.json" + if [ "$OPENCODE_CONFIG" = "free" ] || [ "$OPENCODE_CONFIG" = "paid" ]; then + SRC="$HOME_DIR/.config/opencode/oh-my-openagent-${OPENCODE_CONFIG}.json" + DEST="$HOME_DIR/.config/opencode/oh-my-openagent.json" if [ -f "$SRC" ]; then cp "$SRC" "$DEST" fi @@ -36,16 +24,12 @@ if [ "$(id -u)" = "0" ]; then exec su -l $USERNAME -c "cd ~/workspace && $CMD" else - mkdir -p $HOME_DIR/workspace $HOME_DIR/.config/opencode $HOME_DIR/.local/bin $HOME_DIR/.local/share + mkdir -p $HOME_DIR/workspace cd $HOME_DIR/workspace - if [ ! -f $HOME_DIR/.config/opencode/opencode.json ] && [ -d /opt/opencode-config ]; then - cp -r /opt/opencode-config/* $HOME_DIR/.config/opencode/ 2>/dev/null || true - fi - - if [ -n "$OPENCODE_CONFIG" ] && [ "$OPENCODE_CONFIG" != "default" ]; then - SRC="/opt/opencode-config/oh-my-opencode-${OPENCODE_CONFIG}.json" - DEST="$HOME_DIR/.config/opencode/oh-my-opencode.json" + if [ "$OPENCODE_CONFIG" = "free" ] || [ "$OPENCODE_CONFIG" = "paid" ]; then + SRC="$HOME_DIR/.config/opencode/oh-my-openagent-${OPENCODE_CONFIG}.json" + DEST="$HOME_DIR/.config/opencode/oh-my-openagent.json" if [ -f "$SRC" ]; then cp "$SRC" "$DEST" fi From 4f73869f53ef987e27f34b16c3aa784acd727a02 Mon Sep 17 00:00:00 2001 From: yursds Date: Mon, 6 Apr 2026 00:34:08 +0200 Subject: [PATCH 6/6] chore: clean up compose mounts and add AGENTS.md --- AGENTS.md | 69 ++++++++++++++++++++++++++++++++++++++++++++++ docker-compose.yml | 10 ++++--- 2 files changed, 75 insertions(+), 4 deletions(-) create mode 100644 AGENTS.md diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..794db2a --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,69 @@ +# AGENTS.md — docker-opencode + +## Repo Overview + +Docker-based AI development container. Provides OpenCode, uv, Bun, Node.js, and optional CUDA in an isolated Ubuntu 24.04 environment. + +**Two images**: `Dockerfile.cpu` and `Dockerfile.gpu` (CUDA 12). Selected via `--profile cpu` or `--profile gpu` in docker compose. + +--- + +## Key Directories + +| Path | Purpose | +|------|---------| +| `configs/` | Env templates, OpenCode configs, agent templates | +| `configs/opencode/` | `oh-my-opencode-free.json` and `oh-my-opencode-paid.json` | +| `configs/templates/` | `AGENTS.md-global` (deployed to `~/.config/opencode/AGENTS.md` in container) | +| `data/` | Persistent per-project OpenCode data (gitignored) | +| `.github/workflows/` | CI: docker-build (PR/push), version-check (monthly cron) | + +--- + +## Commands + +```bash +# Create project config +cp configs/_template.env configs/my-project.env + +# Start container +docker compose --env-file configs/my-project.env --profile cpu up -d + +# Enter container +docker exec -it my-project-cpu bash + +# Stop +docker compose --env-file configs/my-project.env down +``` + +Inside the container: +```bash +switch-opencode-config free # Free models (no API keys) +switch-opencode-config paid # GitHub Copilot models +switch-opencode-config default # Restore installer config +``` + +--- + +## Conventions + +- **No hardcoded values**. All configurable values must be defined as constants, env vars, or in config files. Never inline literals for paths, ports, credentials, model names, or feature flags. +- `configs/*.env` files are gitignored except `_template.env`. Never commit personal configs or API keys. +- CI triggers on `Dockerfile.*`, `docker-compose.yml`, and workflow changes only. + +--- + +## Git Rules + +- NEVER execute git commands without explicit user permission. Read-only commands (status, log, diff) are allowed for context. +- NEVER mention AI tool names in comments, commit messages, or documentation. +- ALWAYS ask before creating branches for substantial changes. Suggest a branch name and wait for confirmation. +- NEVER commit unless explicitly requested. + +--- + +## References + +- Global agent rules: `configs/templates/AGENTS.md-global` +- Project-specific templates: `configs/templates/AGENTS.md-python` +- Full setup: `README.md` diff --git a/docker-compose.yml b/docker-compose.yml index b41ba9b..4ccf8c1 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -28,7 +28,6 @@ services: volumes: - ${PROJECT_PATH:-.}:/home/hannya/workspace:rw - - ${HOME}/.mujoco:/home/hannya/.mujoco:ro - /tmp/.X11-unix:/tmp/.X11-unix:rw - /dev/dri:/dev/dri @@ -39,11 +38,13 @@ services: environment: - HOME=/home/hannya + - MYUID=${MYUID:-1000} + - MYGID=${MYGID:-1000} - TERM=xterm-256color - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-} - OPENAI_API_KEY=${OPENAI_API_KEY:-} - GOOGLE_API_KEY=${GOOGLE_API_KEY:-} - - OPENCODE_CONFIG=${OPENCODE_CONFIG:-default} + - OPENCODE_CONFIG=free - XLA_PYTHON_CLIENT_MEM_FRACTION=${XLA_PYTHON_CLIENT_MEM_FRACTION:-0.7} - XLA_PYTHON_CLIENT_PREALLOCATE=${XLA_PYTHON_CLIENT_PREALLOCATE:-false} - UV_PROJECT_ENVIRONMENT=$HOME/workspace/.venv @@ -96,7 +97,6 @@ services: volumes: - ${PROJECT_PATH:-.}:/home/hannya/workspace:rw - - ${HOME}/.mujoco:/home/hannya/.mujoco:ro - /tmp/.X11-unix:/tmp/.X11-unix:rw - /dev/dri:/dev/dri @@ -107,11 +107,13 @@ services: environment: - HOME=/home/hannya + - MYUID=${MYUID:-1000} + - MYGID=${MYGID:-1000} - TERM=xterm-256color - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-} - OPENAI_API_KEY=${OPENAI_API_KEY:-} - GOOGLE_API_KEY=${GOOGLE_API_KEY:-} - - OPENCODE_CONFIG=${OPENCODE_CONFIG:-default} + - OPENCODE_CONFIG=free - JAX_PLATFORMS=cpu - UV_PROJECT_ENVIRONMENT=$HOME/workspace/.venv - DISPLAY=${DISPLAY:-}