Repository navigation
feat: embed codex, claude, and grok CLIs + add docker-compose - #4
Conversation
- Install nodejs, npm, @openai/codex, and @anthropic-ai/claude-code - Install official xAI Grok standalone binary (multi-arch x86_64/aarch64) - Add verification assertions to scripts/smoke-test.sh - Add docker-compose.yaml for local standalone development and testing
◈ PR Lens
Architecture 
7 components touched across 4 lanes. Inside the changed components — 2 viewsComponent view — Runtime and CLI Toolchains OpenCodex Hub daemon integration with embedded coding CLIs and persistent volumes. 
Component view — Build and Smoke Verification Build orchestration, upstream resolution, CLI fetching, and smoke testing. 
Data flow 
View
Tip Open a diagram on the canvas, then press W or click play to walk through the change one step at a time. 🪧 More tips
Thanks for using PR Lens! It's built by Coldtea, free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7e14a354f1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ARG GROK_VERSION=1.0.30 | ||
| RUN npm install -g @openai/codex @anthropic-ai/claude-code \ | ||
| && rm -rf /root/.npm \ | ||
| && GROK_ARCH="$(case \"${TARGETARCH:-$(dpkg --print-architecture)}\" in amd64) echo x86_64 ;; arm64) echo aarch64 ;; *) echo \"unsupported: ${TARGETARCH}\" >&2; exit 1 ;; esac)" \ |
There was a problem hiding this comment.
Every image build fails at this layer: the \" sequences are passed literally to /bin/sh, so the case subject becomes "amd64" (or "arm64") rather than amd64/arm64. It consequently reaches the default branch and exits with unsupported, blocking the amd64 smoke build in .github/workflows/build.yml as well as multi-arch publishing.
Useful? React with 👍 / 👎.
| - OPENCODEX_HOME=/home/bun/.opencodex | ||
| - CODEX_HOME=/home/bun/.opencodex/codex-home | ||
| # Optional: set an explicit API token for proxy requests | ||
| # - OPENCODEX_API_AUTH_TOKEN=your-secret-token |
There was a problem hiding this comment.
On a fresh ocx-state volume, the entrypoint creates a 0.0.0.0 hub configuration, but this Compose file neither sets OPENCODEX_API_AUTH_TOKEN nor mounts the default /run/secrets/ocx_api_token token file. OpenCodex rejects non-loopback startup without one (as the existing smoke-test setup documents), so docker compose -f docker-compose.yaml up exits by default; the comment calling the token optional makes this especially likely. Make a token source required, as compose.yaml does.
Useful? React with 👍 / 👎.
…lify compose build to 'build: .'
…request.yml; bump test version to 2.54.0
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1a6518af4d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ARG UPSTREAM_COMMIT | ||
| RUN git clone --depth 1 --branch "v${UPSTREAM_VERSION}" \ | ||
| https://github.com/lidge-jun/opencodex.git /tmp/opencodex-src \ | ||
| RUN set -euo pipefail \ |
There was a problem hiding this comment.
pipefail
The Dockerfile does not set SHELL, so this RUN instruction uses Linux's default /bin/sh; in the Debian-based Bun image that is dash, which rejects set -o pipefail with Illegal option. Consequently, the new source-fetch layer aborts before resolving or cloning upstream on every local and CI image build. Invoke Bash explicitly or remove pipefail while retaining appropriate pipeline error handling.
Useful? React with 👍 / 👎.
| - ocx-codex:/home/bun/.codex | ||
| - ocx-claude:/home/bun/.claude | ||
| - ocx-grok:/home/bun/.grok |
There was a problem hiding this comment.
After a user supplies the required hub token and starts this Compose file with fresh default volumes, ocx-claude and ocx-grok are mounted root-owned at paths the image never creates or chowns. The service runs as bun, so those CLIs cannot persist their login, configuration, or cache in their default homes; the smoke test only checks which, so it does not expose this. Initialize these volume targets as UID 1000 or avoid mounting uninitialized CLI home directories.
Useful? React with 👍 / 👎.
Summary
@openai/codex(Node/npm)@anthropic-ai/claude-code(Node/npm)xAI Grokstandalone binary (multi-archx86_64/aarch64)which codex claude groksucceeds.docker-compose.yamlwith persistent volumes for.opencodex,.codex,.claude, and.grok.Resolves operator need to configure and test client tooling directly inside the hub container.