dsh 0.2.0-rc.2: in-container update (experimental channel), path-agnostic compose, upstream patches adapted to 0.1.x/0.2.x

2026-10-01 19:21:19 +00:00
commit e6dcef9bf5
@@ -0,0 +1,174 @@
+ARG DSH_VERSION=latest
+ARG ENVIRONMENT_VERSION=development
+ARG TARGET_SEQUENCE=0
+ARG SIGNED_IMAGE_INPUT=false
+
+FROM node:24-bookworm-slim AS installer
+ARG DSH_VERSION
+ARG SIGNED_IMAGE_INPUT
+COPY container/platform/image-input /opt/dsh-platform-image-input
+COPY release/supported-target.json /opt/dsh-supported-target.json
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        g++ \
+        make \
+        python3 \
+    && case "$SIGNED_IMAGE_INPUT" in \
+       true) \
+         test -f /opt/dsh-platform-image-input/dsh.tgz \
+         && npm install --global /opt/dsh-platform-image-input/dsh.tgz \
+         ;; \
+       false) \
+         requested_version="$DSH_VERSION"; \
+         if [ "$requested_version" = latest ]; then \
+           requested_version="$(node -p "JSON.parse(require('fs').readFileSync('/opt/dsh-supported-target.json', 'utf8')).latestSupportedDsh")"; \
+         fi; \
+         npm install --global "@deepseek-ai/dsh@${requested_version}" \
+         ;; \
+       *) echo "SIGNED_IMAGE_INPUT must be true or false" >&2; exit 64 ;; \
+       esac \
+    && rm -rf /var/lib/apt/lists/* /root/.npm
+
+FROM node:24-bookworm-slim AS platform-seed
+ARG PLATFORM_REVISION=development
+ARG SIGNED_IMAGE_INPUT
+COPY --from=installer /usr/local/lib/node_modules/@deepseek-ai/dsh /opt/installed-dsh
+COPY container/control-plane/services/management/package.json container/control-plane/services/management/package-lock.json \
+    /opt/dsh-platform-source/control-plane/services/management/
+COPY container/environment/resources/plugins/platform-management/package/package.json \
+    container/environment/resources/plugins/platform-management/package/package-lock.json \
+    /opt/dsh-platform-source/environment/resources/plugins/platform-management/package/
+RUN npm ci --omit=dev --ignore-scripts --no-audit --no-fund \
+      --prefix /opt/dsh-platform-source/control-plane/services/management \
+    && npm ci --omit=dev --ignore-scripts --no-audit --no-fund --legacy-peer-deps \
+      --prefix /opt/dsh-platform-source/environment/resources/plugins/platform-management/package
+COPY container /opt/dsh-platform-source
+RUN case "$SIGNED_IMAGE_INPUT" in \
+      true) image_input=/opt/dsh-platform-source/platform/image-input ;; \
+      false) image_input=- ;; \
+      *) echo "SIGNED_IMAGE_INPUT must be true or false" >&2; exit 64 ;; \
+    esac \
+    && node /opt/dsh-platform-source/platform/tools/build-seed.mjs \
+      /opt/installed-dsh /opt/dsh-platform-seed "$image_input" "$PLATFORM_REVISION"
+
+FROM node:24-bookworm-slim AS runtime
+ARG PNPM_VERSION=11.7.0
+ARG DSH_VERSION
+ARG ENVIRONMENT_VERSION
+ARG TARGET_SEQUENCE
+
+LABEL org.opencontainers.image.title="DeepSeek Harness" \
+      org.opencontainers.image.description="Unofficial container image for DeepSeek Harness" \
+      org.opencontainers.image.source="https://github.com/yjrszcq/dsh-docker" \
+      org.opencontainers.image.licenses="MIT" \
+      org.opencontainers.image.version="$DSH_VERSION" \
+      io.dsh-docker.environment.version="$ENVIRONMENT_VERSION" \
+      io.dsh-docker.target-sequence="$TARGET_SEQUENCE"
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        bash \
+        ca-certificates \
+        curl \
+        g++ \
+        git \
+        jq \
+        make \
+        openssh-client \
+        p7zip-full \
+        procps \
+        python3 \
+        python3-venv \
+        ripgrep \
+        sudo \
+        tini \
+        unzip \
+        util-linux \
+        zip \
+    && groupadd --system dsh-sudo-true \
+    && groupadd --system dsh-sudo-false \
+    && groupadd --system --gid 991 dsh-proxy \
+    && useradd --system --uid 991 --gid 991 --home-dir /nonexistent --shell /usr/sbin/nologin dsh-proxy \
+    && groupadd --system --gid 992 dsh-access \
+    && useradd --system --uid 992 --gid 992 --home-dir /nonexistent --shell /usr/sbin/nologin dsh-access \
+    && npm install --global "pnpm@${PNPM_VERSION}" \
+    && rm -rf /var/lib/apt/lists/* /root/.npm
+
+COPY docker-sudoers /etc/sudoers.d/dsh-sudo
+RUN chmod 440 /etc/sudoers.d/dsh-sudo \
+    && visudo -cf /etc/sudoers.d/dsh-sudo
+
+COPY --from=platform-seed /opt/dsh-platform-seed /opt/dsh-platform/seed
+COPY container/platform /opt/dsh-platform/runtime/platform
+COPY container/control-plane /opt/dsh-platform/runtime/control-plane
+COPY --from=platform-seed /opt/dsh-platform-source/control-plane/services/management/node_modules /opt/dsh-platform/runtime/control-plane/services/management/node_modules
+COPY container/platform/tools/dsh-shim.sh /usr/local/bin/dsh
+COPY container/platform/tools/dsh-platform-shim.sh /usr/local/bin/dsh-platform
+RUN chmod 755 /usr/local/bin/dsh /usr/local/bin/dsh-platform
+
+ENV DSH_PLATFORM_DATA=/data/platform \
+    DSH_PLATFORM_MANAGED=1 \
+    DSH_PLATFORM_RUN=/run/dsh-platform \
+    DSH_HOME=/data/dsh \
+    DSH_DEFAULT_WORKSPACE=/workspace \
+    DSH_PROXY_POLYFILL=true \
+    DSH_TELEMETRY_DISABLED=true \
+    DSH_UPDATE_METADATA_URL=https://raw.githubusercontent.com/yjrszcq/dsh-docker/release-channel/ \
+    DSH_LOG_MAX_BYTES=104857600 \
+    DSH_LOG_RETENTION_DAYS=14 \
+    DSH_ACTIVATION_TIMEOUT_SECONDS=60 \
+    DSH_EXPERIMENTAL_PROBATION_SECONDS=120
+
+RUN mkdir -p /data/platform /data/dsh /workspace \
+    && chown -R node:node /data/dsh /workspace
+
+ARG INSTALL_DEVTOOLS=false
+ARG UV_VERSION=0.11.32
+
+RUN case "$INSTALL_DEVTOOLS" in \
+        true) apt-get update \
+            && apt-get install -y --no-install-recommends \
+                bash-completion \
+                build-essential \
+                dnsutils \
+                file \
+                htop \
+                iproute2 \
+                iputils-ping \
+                less \
+                lsof \
+                nano \
+                netcat-openbsd \
+                openssl \
+                pkg-config \
+                rsync \
+                tmux \
+                tree \
+                unzip \
+                vim \
+                wget \
+                xz-utils \
+                zip \
+            && curl --fail --location --silent --show-error \
+                "https://astral.sh/uv/${UV_VERSION}/install.sh" \
+                --output /tmp/uv-installer.sh \
+            && UV_UNMANAGED_INSTALL=/usr/local/bin sh /tmp/uv-installer.sh \
+            && mkdir -p /etc/uv \
+            && printf '%s\n' 'python-downloads = "manual"' > /etc/uv/uv.toml \
+            && rm /tmp/uv-installer.sh \
+            && rm -rf /var/lib/apt/lists/* \
+            ;; \
+        false) ;; \
+        *) echo "INSTALL_DEVTOOLS must be true or false" >&2; exit 64 ;; \
+    esac
+
+WORKDIR /workspace
+
+EXPOSE 3080
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
+    CMD /usr/bin/curl --fail --silent --show-error --noproxy '*' http://127.0.0.1:3080/_dsh_gateway/health >/dev/null || exit 1
+
+ENTRYPOINT ["/usr/bin/tini", "--"]
+CMD ["/usr/local/bin/node", "/opt/dsh-platform/runtime/platform/stage0/index.mjs"]