From b37b7bef53b7ae78887d9d624b7465a931b6746d Mon Sep 17 00:00:00 2001 From: NorD Date: Sun, 11 Oct 2026 12:58:17 +0300 Subject: [PATCH] chore: bump oven/bun to 1.4.2 (upstream 8d30945) and drop stale docker-compose.yaml --- Dockerfile | 5 +++-- README.en.md | 2 +- README.md | 2 +- docker-compose.yaml | 47 --------------------------------------------- 4 files changed, 5 insertions(+), 51 deletions(-) delete mode 100644 docker-compose.yaml diff --git a/Dockerfile b/Dockerfile index 3db8622..ea39e12 100644 --- a/Dockerfile +++ b/Dockerfile @@ -10,8 +10,9 @@ # . # Both stages must pin the SAME oven/bun tag BY DIGEST; a tag alone is not a production pin. -# Digest resolved from docker.io for oven/bun:1.4.0 (multi-arch OCI index). -ARG BUN_IMAGE=oven/bun:1.4.0@sha256:5ff609364c049b54eb0ff560ec96319729a972078ef2c755d758f0c6ef89c2d6 +# Digest resolved from docker.io for oven/bun:1.4.2 (multi-arch OCI index); same pin as +# upstream lidge-jun/opencodex 8d30945 (#6713, runtime Bun 1.4.2). +ARG BUN_IMAGE=oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895 FROM ${BUN_IMAGE} AS build RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates && rm -rf /var/lib/apt/lists/* diff --git a/README.en.md b/README.en.md index 83e9b6f..945ecda 100644 --- a/README.en.md +++ b/README.en.md @@ -270,7 +270,7 @@ gh attestation verify oci://ghcr.io/nordz0r/opencodex:2.83.0 -R nordz0r/opencode - **Non-root** (`USER bun`), read-only-rootfs compatible; only `/home/bun/.opencodex`, `/home/bun/.codex` (state volumes) and `/tmp` are writable. - **Multi-arch**: `linux/amd64` and `linux/arm64` from the pinned - `oven/bun:1.4.0@sha256:` base. + `oven/bun:1.4.2@sha256:` base. - **Embedded CLIs**: `codex`, `claude`, `grok`, `omp` (`@oh-my-pi/pi-coding-agent`). - **Upstream container contract**: `OCX_SERVICE=1`, separate `CODEX_HOME`, compatibility-version gate (`docker/verify-compatibility.ts`), hub seed diff --git a/README.md b/README.md index 749ea3c..c2433af 100644 --- a/README.md +++ b/README.md @@ -269,7 +269,7 @@ gh attestation verify oci://ghcr.io/nordz0r/opencodex:2.83.0 -R nordz0r/opencode - **Не root** (`USER bun`), совместим с read-only rootfs; записывать можно только в `/home/bun/.opencodex`, `/home/bun/.codex` (тома состояния) и `/tmp`. - **Мультиархитектурность**: `linux/amd64` и `linux/arm64` на закреплённой базе - `oven/bun:1.4.0@sha256:`. + `oven/bun:1.4.2@sha256:`. - **Встроенные CLI**: `codex`, `claude`, `grok`, `omp` (`@oh-my-pi/pi-coding-agent`). - **Контракт контейнера upstream**: `OCX_SERVICE=1`, отдельный `CODEX_HOME`, проверка версии совместимости (`docker/verify-compatibility.ts`), начальный конфиг хаба `docker/config.json` diff --git a/docker-compose.yaml b/docker-compose.yaml deleted file mode 100644 index f5e6375..0000000 --- a/docker-compose.yaml +++ /dev/null @@ -1,47 +0,0 @@ -# Identical to compose.yaml (Compose v1 filename). Keep both in lockstep. -name: opencodex - -services: - hub: - image: ghcr.io/nordz0r/opencodex:2.59.0 - # Prefer an exact digest in production: - # image: ghcr.io/nordz0r/opencodex@sha256: - init: true - read_only: true - environment: - NODE_ENV: production - OCX_SERVICE: "1" - OPENCODEX_HOME: /home/bun/.opencodex - CODEX_HOME: /home/bun/.codex - ports: - - "${OPENCODEX_BIND_ADDRESS:-127.0.0.1}:${OPENCODEX_PORT:-10100}:10100" - volumes: - - ocx-state:/home/bun/.opencodex - - codex-state:/home/bun/.codex - # Operator extras (not in upstream compose): persist CLI auth/state. - - claude-state:/home/bun/.claude - - grok-state:/home/bun/.grok - tmpfs: - - /tmp:rw,noexec,nosuid,size=64m,mode=1777 - secrets: - - source: ocx_api_token - target: ocx_api_token - uid: "1000" - gid: "1000" - mode: 0440 - security_opt: - - no-new-privileges:true - cap_drop: - - ALL - restart: unless-stopped - stop_grace_period: 30s - -volumes: - ocx-state: - codex-state: - claude-state: - grok-state: - -secrets: - ocx_api_token: - file: ./secrets/ocx_api_token