instant (dev) sandbox (#171)

* instant (dev) sandbox

* leave Dockerfile as is to pass deploy test

* fix comma

* fix prod build

* do not use "images exists" which docker does not support

* separate dev-mode flag

* Merge remote-tracking branch 'origin/main' into instant_sandbox

.vscode/launch.json

@@ -11,7 +11,10 @@
       "skipFiles": ["<node_internals>/**"],
       "type": "node",
       // fix source mapping when debugging in sandbox
-      "remoteRoot": "/usr/local/share/npm-global/lib/node_modules/@gemini-code",
+      // we assume debugging is done on gemini-code project itself (see CLI_PATH setup in start_sandbox.sh)
+      // there seems to be no way to map two distinct remoteRoots to same localRoot under same configuration
+      // "remoteRoot": "/usr/local/share/npm-global/lib/node_modules/@gemini-code",
+      "remoteRoot": "/sandbox/gemini-code/packages",
       "localRoot": "${workspaceFolder}/packages"
     },
     {

Dockerfile-dev

@@ -0,0 +1,31 @@
+FROM docker.io/library/node:20-slim
+
+# install minimal set of packages, then clean up
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  man-db \
+  curl \
+  dnsutils \
+  less \
+  jq \
+  bc \
+  gh \
+  git \
+  unzip \
+  rsync \
+  ripgrep \
+  procps \
+  psmisc \
+  lsof \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
+
+# set up npm global package folder under /usr/local/share
+# give it to non-root user node, already set up in base image
+RUN mkdir -p /usr/local/share/npm-global \
+  && chown -R node:node /usr/local/share/npm-global
+ENV NPM_CONFIG_PREFIX=/usr/local/share/npm-global
+ENV PATH=$PATH:/usr/local/share/npm-global/bin
+
+# switch to non-root user node
+USER node
+

scripts/build.sh

@@ -25,6 +25,7 @@ npm run build --workspaces
 
 # also build container image if sandboxing is enabled
 # skip (-s) npm install + build since we did that above
+# use (-d) for dev build that can reuse existing image
 if scripts/sandbox_command.sh -q; then
-    scripts/build_sandbox.sh -s
+    scripts/build_sandbox.sh -sd
 fi

scripts/build_sandbox.sh

@@ -24,14 +24,17 @@ CMD=$(scripts/sandbox_command.sh)
 echo "using $CMD for sandboxing"
 
 IMAGE=gemini-code-sandbox
+DOCKERFILE=${DOCKERFILE:-Dockerfile}
 
 SKIP_NPM_INSTALL_BUILD=false
-while getopts "s" opt; do
+while getopts "sd" opt; do
     case ${opt} in
     s) SKIP_NPM_INSTALL_BUILD=true ;;
+    d) DOCKERFILE=Dockerfile-dev ;;
     \?)
-            echo "usage: $(basename "$0") [-s]"
+        echo "usage: $(basename "$0") [-s] [-d]"
         echo "  -s: skip npm install + npm run build"
+        echo "  -d: use Dockerfile-dev"
         exit 1
         ;;
     esac
@@ -44,30 +47,40 @@ if [ "$SKIP_NPM_INSTALL_BUILD" = false ]; then
     npm run build
 fi
 
+# if using Dockerfile-dev, then skip rebuild unless REBUILD_SANDBOX is set
+# rebuild should not be necessary unless Dockerfile-dev is modified
+if [ "$DOCKERFILE" = "Dockerfile-dev" ]; then
+    if $CMD images -q "$IMAGE" | grep -q . && [ -z "${REBUILD_SANDBOX:-}" ]; then
+        echo "using existing $IMAGE (set REBUILD_SANDBOX=true to force rebuild)"
+        exit 0
+    fi
+fi
+
+# prepare global installation files for prod build
+if [ "$DOCKERFILE" = "Dockerfile" ]; then
     # pack cli
     echo "packing @gemini-code/cli ..."
     rm -f packages/cli/dist/gemini-code-cli-*.tgz
     npm pack -w @gemini-code/cli --pack-destination ./packages/cli/dist &>/dev/null
-
     # pack server
     echo "packing @gemini-code/server ..."
     rm -f packages/server/dist/gemini-code-server-*.tgz
     npm pack -w @gemini-code/server --pack-destination ./packages/server/dist &>/dev/null
-
-# give node user access to tgz files
+    # give node user (used during installation, see Dockerfile) access to these files
     chmod 755 packages/*/dist/gemini-code-*.tgz
+fi
 
 # build container image & prune older unused images
 echo "building $IMAGE ... (can be slow first time)"
 
 if [[ "$CMD" == "podman" ]]; then
     # use empty --authfile to skip unnecessary auth refresh overhead
-    $CMD build --authfile=<(echo '{}') -t "$IMAGE" . >/dev/null
+    $CMD build --authfile=<(echo '{}') -f "$DOCKERFILE" -t "$IMAGE" . >/dev/null
 elif [[ "$CMD" == "docker" ]]; then
     # use an empty config directory to skip unnecessary auth refresh overhead
-    $CMD --config="empty" build -t "$IMAGE" . >/dev/null
+    $CMD --config="empty" build -f "$DOCKERFILE" -t "$IMAGE" . >/dev/null
 else
-    $CMD build -t "$IMAGE" . >/dev/null
+    $CMD build -f "$DOCKERFILE" -t "$IMAGE" . >/dev/null
 fi
 $CMD image prune -f >/dev/null
 echo "built $IMAGE"

scripts/start_sandbox.sh

@@ -22,10 +22,23 @@ fi
 
 CMD=$(scripts/sandbox_command.sh)
 IMAGE=gemini-code-sandbox
-WORKDIR=/sandbox/$(basename "$PWD")
-CLI_PATH=/usr/local/share/npm-global/lib/node_modules/\@gemini-code/cli
 DEBUG_PORT=9229
 
+PROJECT=$(basename "$PWD")
+WORKDIR=/sandbox/$PROJECT
+CLI_PATH=/usr/local/share/npm-global/lib/node_modules/\@gemini-code/cli
+
+# if project is gemini-code, then run CLI from $WORKDIR/packages/cli
+# note this means the global installation is not required in this case
+if [[ "$PROJECT" == "gemini-code" ]]; then
+    CLI_PATH="$WORKDIR/packages/cli"
+elif [ -n "${DEBUG:-}" ]; then
+    # refuse to debug using global installation
+    # (requires a separate attach config in launch.json, see comments there around remoteRoot)
+    echo "ERROR: debugging is sandbox is not supported when target/root is not gemini-code"
+    exit 1
+fi
+
 # use interactive tty mode and auto-remove container on exit
 run_args=(-it --rm)