mirror of
https://github.com/different-ai/openwork
synced 2026-04-25 17:15:34 +02:00
f3da381606
* feat(server): add scoped tokens, inbox/outbox, toy UI, and auth hardening - TokenService with file-based persistence (tokens.json) - /tokens CRUD (host auth), /whoami (client auth) - Bearer token auth accepting OPENWORK_TOKEN or scoped tokens - POST /workspace/:id/inbox (multipart upload) - GET /workspace/:id/artifacts, /workspace/:id/artifacts/:id - Toy UI at /ui with SSE, prompt send, inbox upload, outbox download - Extended GET /capabilities with schemaVersion, serverVersion, approvals info - Updated README with all new endpoints and auth model * feat(headless): add sandbox runtime with Docker and Apple container backends - --sandbox none|auto|docker|container CLI flag - --sandbox-image, --sandbox-persist-dir, --sandbox-mount options - Mount security: allowlist, blocked patterns, symlink resolution - Docker backend: workspace/persist volumes, sidecar staging, entrypoint - Apple container backend: --mount type=bind for ro mounts - Sandbox mode proxies all OpenCode access through openwork-server - Proxy health check (waitForHealthyViaProxy) avoids SDK auth issues - Sandbox-specific check suite (runSandboxChecks) for --check mode - Non-fatal verifyOpenworkServer in sandbox mode for version mismatches - Updated README with sandbox docs and mount security * feat(packaging): add Docker/docker-compose PaaS packaging - Dockerfile (node:22-bookworm-slim, installs openwrk via npm) - docker-compose.yml with workspace and data volumes - README with usage instructions * fix(headless): define sandbox owpenbot internal health port
49 lines
1.1 KiB
Docker
49 lines
1.1 KiB
Docker
FROM node:22-bookworm-slim
|
|
|
|
ARG OPENWRK_VERSION=0.11.22
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
curl \
|
|
git \
|
|
tar \
|
|
unzip \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN npm install -g "openwrk@${OPENWRK_VERSION}"
|
|
|
|
# Persistent directories (mount volumes here on PaaS/SSH).
|
|
ENV OPENWRK_DATA_DIR=/data/openwrk
|
|
ENV OPENWRK_SIDECAR_DIR=/data/sidecars
|
|
|
|
# The workspace is mounted from the host/volume.
|
|
ENV OPENWORK_WORKSPACE=/workspace
|
|
|
|
# OpenWork host contract surface.
|
|
EXPOSE 8787
|
|
|
|
# Optional: owpenbot health (only relevant if you enable owpenbot).
|
|
EXPOSE 3005
|
|
|
|
VOLUME ["/workspace", "/data"]
|
|
|
|
# Defaults:
|
|
# - OpenWork server is public (0.0.0.0:8787)
|
|
# - OpenCode stays internal (127.0.0.1:4096)
|
|
# - OpenWork server proxies OpenCode via localhost
|
|
# - Owpenbot disabled by default
|
|
CMD [
|
|
"openwrk",
|
|
"serve",
|
|
"--workspace", "/workspace",
|
|
"--openwork-host", "0.0.0.0",
|
|
"--openwork-port", "8787",
|
|
"--opencode-host", "127.0.0.1",
|
|
"--opencode-port", "4096",
|
|
"--connect-host", "127.0.0.1",
|
|
"--cors", "*",
|
|
"--approval", "manual",
|
|
"--no-owpenbot"
|
|
]
|