Class: GDKBox::Provisioner

Inherits:
Object
  • Object
show all
Defined in:
lib/gdkbox/provisioner.rb

Overview

Runs the in-container setup steps: enabling SSH access and (optionally) installing Claude Code. All steps are idempotent so they can be re-run safely, for example after a gdkbox start.

Constant Summary collapse

SSH_SETUP =

Installs and starts the OpenSSH server, then authorizes the gdkbox public key for the GDK user. Values are passed via the environment to dodge shell quoting.

The official GDK image ships an sshd_config that listens on a non-default port (2022) and runs GitLab's own gitlab-sshd for git-over-SSH, so we cannot assume a vanilla sshd on port 22. We drop in our own config (loaded via the Include near the top of sshd_config, so it overrides the image's later Port line) pinning the listen port to the container port gdkbox publishes, ensure host keys exist, and restart sshd so it rebinds. This is idempotent and also re-run by gdkbox start.

<<~'BASH'
  set -e
  if [ ! -x /usr/sbin/sshd ] && ! command -v sshd >/dev/null 2>&1; then
    apt-get update -qq
    DEBIAN_FRONTEND=noninteractive apt-get install -y -qq openssh-server >/dev/null
  fi
  mkdir -p /run/sshd
  ssh-keygen -A >/dev/null 2>&1 || true
  mkdir -p /etc/ssh/sshd_config.d
  printf 'Port %s\nPasswordAuthentication no\n' "$GDKBOX_SSH_PORT" \
    > /etc/ssh/sshd_config.d/00-gdkbox.conf
  # The stock ~/.bash_logout runs `clear_console -q`, which fails (no TTY)
  # under `docker exec ... bash -lc` and clobbers the command's exit
  # status with 1. We run agents through a login shell, so neutralize it
  # to keep `gdkbox dispatch` exit codes (and the rest) honest.
  : > "/home/$GDKBOX_USER/.bash_logout" 2>/dev/null || true
  # The GDK image manages its toolchain (ruby, node, bundle, ...) with mise
  # but only activates it in ~/.bashrc (interactive shells). `gdkbox
  # dispatch` and `gdkbox ssh <box> <cmd>` use non-interactive login shells,
  # which source ~/.profile, not ~/.bashrc. Put mise's shims on PATH there
  # so dispatched agents can actually run the GDK toolchain. Shims resolve
  # the correct tool version from the directory's mise/.tool-versions config.
  profile="/home/$GDKBOX_USER/.profile"
  touch "$profile"
  if ! grep -q 'gdkbox:mise-shims' "$profile" 2>/dev/null; then
    {
      echo '# gdkbox:mise-shims'
      echo 'if [ -d "$HOME/.local/share/mise/shims" ]; then PATH="$HOME/.local/share/mise/shims:$PATH"; fi'
    } >> "$profile"
  fi
  chown "$GDKBOX_USER:$GDKBOX_USER" "$profile"
  install -d -m 700 -o "$GDKBOX_USER" -g "$GDKBOX_USER" "/home/$GDKBOX_USER/.ssh"
  printf '%s\n' "$GDKBOX_PUBKEY" > "/home/$GDKBOX_USER/.ssh/authorized_keys"
  chown "$GDKBOX_USER:$GDKBOX_USER" "/home/$GDKBOX_USER/.ssh/authorized_keys"
  chmod 600 "/home/$GDKBOX_USER/.ssh/authorized_keys"
  /usr/sbin/sshd -t
  # Restart our sshd so it binds the configured port (gitlab-sshd and any
  # pre-existing sshd may be on other ports). Match only the OpenSSH daemon.
  pkill -x sshd >/dev/null 2>&1 || true
  sleep 1
  /usr/sbin/sshd
BASH
AGENT_SETUP =

Installs an agent harness CLI (an npm package) for the GDK user.

The official GDK image manages Node with mise, so node/npm are not on PATH in a plain shell. We install into ~/.local (which is on PATH for every shell) using mise's npm when a direct npm is unavailable, and symlink the mise-managed node so the agent's env node shebang can find an interpreter. Both npm and the plain-npm case are handled so this works on the GDK image and on simpler images alike. The binary name and package come from the harness via the environment.

<<~'BASH'
  set -e
  mkdir -p "$HOME/.local/bin"
  # Pin a concrete node: the agent CLIs are node scripts with `env node`
  # shebangs, and the mise *shim* for node errors outside a directory that
  # configures a node version. Symlinking the real mise install makes node
  # resolvable everywhere (and gets linked into /usr/local/bin afterwards).
  # Done before the early-exit so re-provisioning fixes the PATH too.
  if command -v mise >/dev/null 2>&1 && mise which node >/dev/null 2>&1; then
    ln -sf "$(mise which node)" "$HOME/.local/bin/node"
  fi
  if command -v "$GDKBOX_AGENT_BIN" >/dev/null 2>&1; then
    echo "$GDKBOX_AGENT_BIN already installed: $("$GDKBOX_AGENT_BIN" --version 2>/dev/null || echo unknown)"
    exit 0
  fi
  if command -v npm >/dev/null 2>&1; then
    npm install -g --prefix "$HOME/.local" $GDKBOX_NPM_FLAGS "$GDKBOX_NPM_PKG"
  elif command -v mise >/dev/null 2>&1 && mise which npm >/dev/null 2>&1; then
    mise exec -- npm install -g --prefix "$HOME/.local" $GDKBOX_NPM_FLAGS "$GDKBOX_NPM_PKG"
  else
    echo "Neither npm nor mise-managed node found in box; cannot install $GDKBOX_AGENT_BIN" >&2
    exit 1
  fi
  "$HOME/.local/bin/$GDKBOX_AGENT_BIN" --version || true
BASH
<<~'BASH'
  set -e
  home="/home/$GDKBOX_USER"
  if [ -e "$home/.local/bin/$GDKBOX_AGENT_BIN" ]; then
    ln -sf "$home/.local/bin/$GDKBOX_AGENT_BIN" "/usr/local/bin/$GDKBOX_AGENT_BIN"
  fi
  if [ -e "$home/.local/bin/node" ]; then
    ln -sf "$home/.local/bin/node" /usr/local/bin/node
  fi
BASH
API_KEY_SETUP =

Writes the harness's API key into the box so dispatched agents can authenticate without a human. The key is exported under the env var the harness's provider reads (e.g. ANTHROPIC_API_KEY, OPENAI_API_KEY). It is stored only inside the container, at a 0600 file owned by the GDK user, sourced explicitly by gdkbox dispatch and wired into interactive shells. The key never touches host-side metadata.

<<~'BASH'
  set -e
  home="/home/$GDKBOX_USER"
  install -d -m 700 -o "$GDKBOX_USER" -g "$GDKBOX_USER" "$home/.gdkbox"
  umask 077
  printf "export %s='%s'\n" "$GDKBOX_API_KEY_ENV" "$GDKBOX_API_KEY" > "$home/.gdkbox/env"
  chown "$GDKBOX_USER:$GDKBOX_USER" "$home/.gdkbox/env"
  chmod 600 "$home/.gdkbox/env"
  line='[ -f "$HOME/.gdkbox/env" ] && . "$HOME/.gdkbox/env"'
  for f in "$home/.bashrc" "$home/.profile"; do
    touch "$f"
    grep -qF "$line" "$f" || printf '%s\n' "$line" >> "$f"
    chown "$GDKBOX_USER:$GDKBOX_USER" "$f"
  done
BASH

Instance Method Summary collapse

Constructor Details

#initialize(docker:, config:) ⇒ Provisioner

Returns a new instance of Provisioner.



134
135
136
137
 
# File 'lib/gdkbox/provisioner.rb', line 134

def initialize(docker:, config:)
  @docker = docker
  @config = config
end

Instance Method Details

#setup_agent(container_name, harness) ⇒ Object

Install the given harness (an npm-installable agent CLI) into the box.



152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
 
# File 'lib/gdkbox/provisioner.rb', line 152

def setup_agent(container_name, harness)
  unless harness.installable?
    raise Error, "gdkbox cannot auto-install the '#{harness.id}' harness yet."
  end

  @docker.exec(
    container_name, AGENT_SETUP, user: @config.ssh_user,
    env: {
      "GDKBOX_AGENT_BIN" => harness.bin,
      "GDKBOX_NPM_PKG" => harness.npm_package,
      "GDKBOX_NPM_FLAGS" => harness.npm_flags.to_s
    }
  )
  @docker.exec(
    container_name, AGENT_LINK, user: "root",
    env: { "GDKBOX_USER" => @config.ssh_user, "GDKBOX_AGENT_BIN" => harness.bin }
  )
end

#setup_api_key(container_name, api_key, key_env) ⇒ Object 



171
172
173
174
175
176
177
178
179
180
181
 
# File 'lib/gdkbox/provisioner.rb', line 171

def setup_api_key(container_name, api_key, key_env)
  @docker.exec(
    container_name, API_KEY_SETUP,
    user: "root",
    env: {
      "GDKBOX_USER" => @config.ssh_user,
      "GDKBOX_API_KEY" => api_key,
      "GDKBOX_API_KEY_ENV" => key_env
    }
  )
end

#setup_ssh(container_name, public_key) ⇒ Object 



139
140
141
142
143
144
145
146
147
148
149
 
# File 'lib/gdkbox/provisioner.rb', line 139

def setup_ssh(container_name, public_key)
  @docker.exec(
    container_name, SSH_SETUP,
    user: "root",
    env: {
      "GDKBOX_USER" => @config.ssh_user,
      "GDKBOX_PUBKEY" => public_key,
      "GDKBOX_SSH_PORT" => Config::SSH_CONTAINER_PORT.to_s
    }
  )
end