52 lines
1.9 KiB
Docker
52 lines
1.9 KiB
Docker
FROM node:20-alpine
|
|
|
|
# Install runtime dependencies
|
|
RUN apk add --no-cache \
|
|
git \
|
|
curl \
|
|
ca-certificates \
|
|
bash
|
|
|
|
# Install kubectl — architecture-aware, checksum-verified
|
|
RUN KUBECTL_VERSION=$(curl -fsSL https://dl.k8s.io/release/stable.txt) \
|
|
&& ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') \
|
|
&& curl -fsSL "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${ARCH}/kubectl" \
|
|
-o /usr/local/bin/kubectl \
|
|
&& curl -fsSL "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${ARCH}/kubectl.sha256" \
|
|
-o /tmp/kubectl.sha256 \
|
|
&& echo "$(cat /tmp/kubectl.sha256) /usr/local/bin/kubectl" | sha256sum -c \
|
|
&& rm /tmp/kubectl.sha256 \
|
|
&& chmod +x /usr/local/bin/kubectl
|
|
|
|
# System-level Claude Code policy — owned by root, not writable by the node user.
|
|
# Restricts available models; cannot be bypassed via CLI flags or env vars.
|
|
COPY settings.json /etc/claude-code/managed-settings.json
|
|
|
|
# Install Claude Code stable release
|
|
RUN curl -fsSL https://claude.ai/install.sh | bash -s stable
|
|
|
|
|
|
# Install MCP servers globally — entry points land in /usr/local/lib/node_modules/
|
|
RUN npm install -g \
|
|
@modelcontextprotocol/server-github \
|
|
@yoda.digital/gitlab-mcp-server \
|
|
@aashari/mcp-server-atlassian-jira \
|
|
@aashari/mcp-server-atlassian-confluence
|
|
|
|
# Workspace and Claude config dir — owned by the built-in node user (uid 1000).
|
|
# Pre-creating ~/.claude ensures the named volume is initialised with the
|
|
# correct ownership when first mounted (Docker copies image content into
|
|
# an empty named volume on first use).
|
|
RUN mkdir -p /workspace /home/node/.claude \
|
|
&& chown -R node:node /workspace /home/node/.claude
|
|
|
|
USER node
|
|
WORKDIR /workspace
|
|
|
|
# Proxy traffic through sidecar — override at runtime if needed
|
|
ENV HTTP_PROXY=http://proxy:3128
|
|
ENV HTTPS_PROXY=http://proxy:3128
|
|
ENV ALL_PROXY=http://proxy:3128
|
|
ENV NO_PROXY=localhost,127.0.0.1
|
|
|
|
ENTRYPOINT ["claude"]
|