wehub-resource-sync
88 lines
4.6 KiB
Docker
88 lines
4.6 KiB
Docker
# Eval sandbox image: everything a Vercel Sandbox needs to scaffold, build,
|
|
# launch, and grade a Native SDK app on Linux, plus a pre-warmed build layer
|
|
# so per-case builds inside the sandbox are incremental instead of cold.
|
|
#
|
|
# Build context: a clean checkout of the repo at a pinned ref — use
|
|
# evals/sandbox/build-image.sh, which `git archive`s the ref and pushes the
|
|
# image to Vercel Container Registry. Vercel Sandbox only boots linux/amd64
|
|
# images, so the script builds with --platform linux/amd64.
|
|
#
|
|
# Rebuild triggers:
|
|
# - this file changes (package set, zig/node/pnpm/agent-CLI pins)
|
|
# - the zig version bumps (both caches below are compiler-version-keyed)
|
|
# - the SDK tip drifts far from the baked ref: runs stay CORRECT without a
|
|
# rebuild — the runner rsyncs the current working tree over the baked
|
|
# repo and zig rebuilds incrementally — but once the delta grows large
|
|
# enough that "incremental" stops being true, re-bake at the new tip.
|
|
FROM ubuntu:24.04
|
|
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
# Package set mirrors tools/linux-truth (the proven GTK4 + WebKitGTK loop):
|
|
# toolkit dev headers for -Dplatform=linux builds, Xvfb + xdpyinfo for the
|
|
# headless display, dbus for the toolkit's bus lookups, rsync for the
|
|
# working-tree refresh, git/curl/xz for toolchain installs. The X capture
|
|
# tools (xwd, imagemagick) are omitted: the eval lane's screenshot artifact
|
|
# comes from the engine's own screenshot channel, not X root captures.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates curl xz-utils rsync git sudo \
|
|
libgtk-4-dev libwebkitgtk-6.0-dev \
|
|
xvfb xauth x11-utils \
|
|
dbus \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
ARG ZIG_VERSION=0.16.0
|
|
RUN curl -fsSL "https://ziglang.org/download/${ZIG_VERSION}/zig-x86_64-linux-${ZIG_VERSION}.tar.xz" \
|
|
| tar -xJ -C /opt \
|
|
&& ln -s "/opt/zig-x86_64-linux-${ZIG_VERSION}/zig" /usr/local/bin/zig
|
|
|
|
# node >= 24 (the evals harness engine floor), pnpm pinned to the harness's
|
|
# packageManager, and the Claude Code CLI the agent-under-test runs as.
|
|
RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
|
|
&& apt-get install -y --no-install-recommends nodejs \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& npm install --global --silent pnpm@10.23.0 @anthropic-ai/claude-code
|
|
|
|
# The web process sandbox needs unprivileged user namespaces that microVM
|
|
# seccomp policies restrict; that sandbox is not what the evals test (same
|
|
# setting as the repo's Linux CI smoke).
|
|
ENV WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1
|
|
# No session bus provides an accessibility bus under Xvfb; without this the
|
|
# toolkit's accessibility init blocks ~25 s on a bus-name lookup at startup.
|
|
ENV GTK_A11Y=none
|
|
# Fixed cache locations, world-writable below, so whichever uid the sandbox
|
|
# runtime assigns to commands hits the caches this image bakes as root. The
|
|
# eval runner passes the same values to every command it runs in a sandbox
|
|
# (image ENV is metadata; the sandbox runtime is not guaranteed to apply it).
|
|
ENV ZIG_LOCAL_CACHE_DIR=/opt/native-sdk/zig-local-cache
|
|
ENV ZIG_GLOBAL_CACHE_DIR=/opt/native-sdk/zig-global-cache
|
|
ENV npm_config_store_dir=/opt/native-sdk/pnpm-store
|
|
|
|
# Bake the repo at the pinned ref and pre-warm every build graph the harness
|
|
# touches, so per-case builds are incremental:
|
|
# 1. repo-root `zig build` -> the native CLI
|
|
# 2. workspace `native test` -> the graph `pnpm eval` pre-warms, the
|
|
# build_test grader runs, and the agent
|
|
# iterates on (zero-config workspaces
|
|
# build through the CLI verbs)
|
|
# 3. workspace automation build -> the live-check graph
|
|
# The throwaway workspace is scaffolded at the same path shape the harness
|
|
# uses at runtime; its artifacts live on in the shared zig caches above
|
|
# (content-addressed, so any later workspace path hits them).
|
|
ARG BAKED_REF=unknown
|
|
COPY . /opt/native-sdk/repo
|
|
WORKDIR /opt/native-sdk/repo
|
|
RUN zig build \
|
|
&& zig-out/bin/native init evals/.workspaces/prewarm --frontend native \
|
|
&& cd evals/.workspaces/prewarm \
|
|
&& /opt/native-sdk/repo/zig-out/bin/native test \
|
|
&& /opt/native-sdk/repo/zig-out/bin/native build -Dplatform=linux -Dweb-engine=system -Dautomation=true -Doptimize=ReleaseSafe \
|
|
&& cd /opt/native-sdk/repo \
|
|
&& rm -rf evals/.workspaces
|
|
RUN cd evals && pnpm install --frozen-lockfile
|
|
# The @native-sdk/core transpiler's installed dependency: the TS track's
|
|
# check/dev/build graphs and the ts_transpile/ts_harness graders all run it.
|
|
RUN cd packages/core && npm ci --silent
|
|
|
|
RUN printf '%s\n' "${BAKED_REF}" > /opt/native-sdk/baked-ref \
|
|
&& chmod -R a+rwX /opt/native-sdk
|