jcarr
/
gemini-cli
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

custom sandboxing via sandbox.Dockerfile and sandbox.bashrc in project settings (#249)

This commit is contained in:
Olcan 2025-05-02 14:07:40 -07:00 committed by GitHub
parent cc838fad44
commit 69d1c644d9
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 27 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
packages/cli/src/utils/sandbox.ts
View File

@ -83,7 +83,17 @@ export async function start_sandbox(sandbox: string) {
} else { } else {
console.log('building sandbox ...'); console.log('building sandbox ...');
const gcRoot = gcPath.split('/packages/')[0]; const gcRoot = gcPath.split('/packages/')[0];
spawnSync(`cd ${gcRoot} && scripts/build_sandbox.sh`, { // if project folder has sandbox.Dockerfile under project settings folder, use that
let buildArgs = '';
const projectSandboxDockerfile = path.join(
SETTINGS_DIRECTORY_NAME,
'sandbox.Dockerfile',
);
if (fs.existsSync(projectSandboxDockerfile)) {
console.log(`using ${projectSandboxDockerfile} for sandbox`);
buildArgs += `-f ${path.resolve(projectSandboxDockerfile)}`;
}
spawnSync(`cd ${gcRoot} && scripts/build_sandbox.sh ${buildArgs}`, {
stdio: 'inherit', stdio: 'inherit',
shell: true, shell: true,
}); });
@ -266,6 +276,15 @@ export async function start_sandbox(sandbox: string) {
bashCmd += `export PYTHONPATH="$PYTHONPATH${pythonPathSuffix}"; `; // suffix includes leading ':' bashCmd += `export PYTHONPATH="$PYTHONPATH${pythonPathSuffix}"; `; // suffix includes leading ':'
} }
// source sandbox.bashrc if exists under project settings directory
const projectSandboxBashrc = path.join(
SETTINGS_DIRECTORY_NAME,
'sandbox.bashrc',
);
if (fs.existsSync(projectSandboxBashrc)) {
bashCmd += `source ${projectSandboxBashrc}; `;
}
// open additional ports if SANDBOX_PORTS is set // open additional ports if SANDBOX_PORTS is set
// also set up redirects (via socat) so servers can listen on localhost instead of 0.0.0.0 // also set up redirects (via socat) so servers can listen on localhost instead of 0.0.0.0
if (process.env.SANDBOX_PORTS) { if (process.env.SANDBOX_PORTS) {

10
scripts/build_sandbox.sh
View File

@ -27,17 +27,21 @@ IMAGE=gemini-code-sandbox
DOCKERFILE=Dockerfile DOCKERFILE=Dockerfile
SKIP_NPM_INSTALL_BUILD=false SKIP_NPM_INSTALL_BUILD=false
while getopts "sd" opt; do while getopts "sdf:" opt; do
case ${opt} in case ${opt} in
s) SKIP_NPM_INSTALL_BUILD=true ;; s) SKIP_NPM_INSTALL_BUILD=true ;;
d) d)
DOCKERFILE=Dockerfile-dev DOCKERFILE=Dockerfile-dev
IMAGE+="-dev" IMAGE+="-dev"
;; ;;
f)
DOCKERFILE=$OPTARG
;;
\?) \?)
echo "usage: $(basename "$0") [-s] [-d]" echo "usage: $(basename "$0") [-s] [-d] [-f <dockerfile>]"
echo " -s: skip npm install + npm run build" echo " -s: skip npm install + npm run build"
echo " -d: build dev image (using Dockerfile-dev)" echo " -d: build dev image (use Dockerfile-dev)"
echo " -f <dockerfile>: use <dockerfile>"
exit 1 exit 1
;; ;;
esac esac