sandbox-blaxel (sha256:b0caa3198069d3e06a2d47bf5bb3647122d1ac7d68e23c9b50cce408f8e25fdb)

Published 2026-09-16 14:24:05 +00:00 by qwolff

Pull the image from the command line:

docker pull code.tilo.so/public/sandbox-blaxel@sha256:b0caa3198069d3e06a2d47bf5bb3647122d1ac7d68e23c9b50cce408f8e25fdb

Digest

sha256:b0caa3198069d3e06a2d47bf5bb3647122d1ac7d68e23c9b50cce408f8e25fdb

For more information on the Container registry, see the documentation.

KIWI 10.3.0

RUN /bin/sh -c dnf install -y nodejs capnproto gcc gcc-c++ make cmake perl perl-FindBin python3 git jq time yt-dlp clang clang-devel pkgconf-pkg-config libxkbcommon-devel wayland-devel libseat-devel libinput-devel systemd-devel libdrm-devel mesa-libgbm-devel mesa-libGL-devel mesa-libEGL-devel pipewire-devel ffmpeg-free-devel libva-devel gstreamer1 gstreamer1-devel gstreamer1-plugins-base-devel gstreamer1-plugins-good gstreamer1-plugins-bad-free gstreamer1-plugin-openh264 openssl-devel sqlite-devel zlib-ng-compat-devel fontconfig-devel freetype-devel harfbuzz-devel expat-devel google-noto-sans-fonts google-noto-sans-mono-fonts google-noto-serif-fonts google-noto-color-emoji-fonts google-noto-sans-symbols-fonts google-noto-sans-symbols-2-fonts google-noto-sans-math-fonts google-noto-sans-cjk-fonts google-noto-sans-arabic-fonts google-noto-sans-hebrew-fonts google-noto-sans-devanagari-fonts google-noto-sans-bengali-fonts google-noto-sans-thai-fonts fuse3-devel dbus-devel nasm vulkan-loader mesa-vulkan-drivers bubblewrap gnome-text-editor qt6-qtbase-examples libreoffice-writer && dnf clean all # buildkit

ENV RUSTUP_HOME=/usr/local/rustup CARGO_HOME=/usr/local/cargo PATH=/usr/local/cargo/bin:/usr/local/bin:/usr/bin

ARG RUST_CHANNEL=1.97.1

RUN |1 RUST_CHANNEL=1.97.1 /bin/sh -c curl -fsSL https://sh.rustup.rs | sh -s -- -y --no-modify-path --profile minimal --default-toolchain "${RUST_CHANNEL}" --component rustfmt --component clippy --component rust-src --component rust-analyzer && cargo --version && rustc --version && rust-analyzer --version # buildkit

ARG SCCACHE_VERSION=0.17.0

ARG SCCACHE_SHA256_X86_64=67c4a96dd237c1f518f6b36083f270f9976d516f1e57fce891755ea782e50006

ARG SCCACHE_SHA256_AARCH64=821a86343191aa1cbab74bd42f9e93c9a63bf85e4742945f40d3ae84193c1c77

RUN |4 RUST_CHANNEL=1.97.1 SCCACHE_VERSION=0.17.0 SCCACHE_SHA256_X86_64=67c4a96dd237c1f518f6b36083f270f9976d516f1e57fce891755ea782e50006 SCCACHE_SHA256_AARCH64=821a86343191aa1cbab74bd42f9e93c9a63bf85e4742945f40d3ae84193c1c77 /bin/sh -c case "$(uname -m)" in x86_64) sccache_arch=x86_64; sccache_sha="$SCCACHE_SHA256_X86_64" ;; aarch64) sccache_arch=aarch64; sccache_sha="$SCCACHE_SHA256_AARCH64" ;; *) echo "unsupported sccache architecture: $(uname -m)" >&2; exit 1 ;; esac && archive="sccache-v${SCCACHE_VERSION}-${sccache_arch}-unknown-linux-musl.tar.gz" && echo "${sccache_sha} /qos-assets/${archive}" | sha256sum -c - && tar -xzf "/qos-assets/${archive}" -C /tmp && install -m 0755 "/tmp/sccache-v${SCCACHE_VERSION}-${sccache_arch}-unknown-linux-musl/sccache" /usr/local/bin/sccache && rm -rf "/tmp/sccache-v${SCCACHE_VERSION}-${sccache_arch}-unknown-linux-musl" && sccache --version # buildkit

COPY tools/check-build-env.sh /usr/local/bin/qos-check-build-env # buildkit

LABEL org.opencontainers.image.source=https://code.podesta.ai/PodestaAI/agent-platform

RUN /bin/sh -c dnf install -y jq tmux ripgrep less git-lfs openssh-clients vulkan-tools mesa-dri-drivers xz unzip procps-ng podman buildah skopeo fuse-overlayfs chromium && dnf clean all # buildkit

RUN /bin/sh -c dnf install -y sudo dosfstools btrfs-progs e2fsprogs xfsprogs util-linux systemd-udev swtpm swtpm-tools sbsigntools efitools sshpass socat qemu-system-x86-core qemu-img edk2-ovmf && dnf clean all && echo 'node ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/node && chmod 440 /etc/sudoers.d/node # buildkit

RUN /bin/sh -c curl -fsSL -o /usr/local/bin/kubectl https://dl.k8s.io/release/v1.35.4/bin/linux/amd64/kubectl && curl -fsSL -o /usr/local/bin/talosctl https://github.com/siderolabs/talos/releases/download/v1.13.9/talosctl-linux-amd64 && chmod +x /usr/local/bin/kubectl /usr/local/bin/talosctl # buildkit

RUN /bin/sh -c curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh # buildkit

RUN /bin/sh -c curl -fsSL https://bun.sh/install | env BUN_INSTALL=/usr/local bash # buildkit

COPY /wheels/omnigent-0.12.0-py3-none-any.whl /tmp/omnigent-0.12.0-py3-none-any.whl # buildkit

RUN /bin/sh -c UV_PYTHON_INSTALL_DIR=/opt/uv-python UV_TOOL_DIR=/opt/uv-tools UV_TOOL_BIN_DIR=/usr/local/bin uv tool install --python 3.12 /tmp/omnigent-0.12.0-py3-none-any.whl && grep -R -q 'OMNIGENT_EXTERNALIZE_SUBAGENTS' /opt/uv-tools/omnigent/lib/python3.12/site-packages/omnigent/inner/codex_executor.py && chmod -R a+rX /opt/uv-tools /opt/uv-python && rm /tmp/omnigent-0.12.0-py3-none-any.whl # buildkit

ARG CODEX_VERSION=0.153.1

ENV PLAYWRIGHT_BROWSERS_PATH=/opt/ms-playwright

RUN |1 CODEX_VERSION=0.153.1 /bin/sh -c npm install -g opencode-ai @anthropic-ai/claude-code "@openai/codex@${CODEX_VERSION}" playwright && playwright install chromium && chmod -R a+rX /opt/ms-playwright && CODEX_PACKAGE_ROOT="$(npm root -g)/@openai/codex" && CODEX_WRAPPER="${CODEX_PACKAGE_ROOT}/bin/codex.js" && CODEX_NATIVE="$(find "${CODEX_PACKAGE_ROOT}/node_modules/@openai" -type f -name codex -perm /111 -print -quit)" && test -x "${CODEX_WRAPPER}" && test -n "${CODEX_NATIVE}" && test -x "${CODEX_NATIVE}" && ln -sfnT "${CODEX_NATIVE}" /usr/local/bin/codex && ln -sfnT "${CODEX_NATIVE}" /usr/local/bin/codex-native && env -u NODE_ICU_DATA /usr/local/bin/codex --version && env -u NODE_ICU_DATA /usr/local/bin/codex-native --version # buildkit

RUN |1 CODEX_VERSION=0.153.1 /bin/sh -c curl -fsSL https://happier.dev/install | env HAPPIER_NONINTERACTIVE=1 HAPPIER_WITH_DAEMON=0 HAPPIER_INSTALL_DIR=/opt/happier HAPPIER_BIN_DIR=/usr/local/bin HAPPIER_NO_PATH_UPDATE=1 bash && happier --version && chmod -R a+rX /opt/happier # buildkit

COPY /fgj /usr/local/bin/fgj # buildkit

COPY entrypoint.sh /usr/local/bin/sandbox-entrypoint # buildkit

COPY bootstrap-repositories.sh configure-model-gateway.sh refresh-forgejo-credential.sh forgejo-credential-helper.sh podman-sidecar.sh /usr/local/bin/ # buildkit

COPY configure-omnigent-provider.py configure-codex-ci-hook.py forgejo-ci-hook.py wait-for-sandbox-assignment.sh /usr/local/bin/ # buildkit

COPY sccache-wrapper.sh /usr/local/bin/sccache-wrapper # buildkit

RUN |1 CODEX_VERSION=0.153.1 /bin/sh -c chmod +x /usr/local/bin/sandbox-entrypoint && for helper in bootstrap-repositories configure-model-gateway refresh-forgejo-credential forgejo-credential-helper podman-sidecar wait-for-sandbox-assignment; do chmod +x "/usr/local/bin/${helper}.sh"; ln -s "/usr/local/bin/${helper}.sh" "/usr/local/bin/${helper}"; done && chmod +x /usr/local/bin/configure-codex-ci-hook.py /usr/local/bin/forgejo-ci-hook.py /usr/local/bin/sccache-wrapper && ln -s /usr/local/bin/configure-codex-ci-hook.py /usr/local/bin/configure-codex-ci-hook && ln -s /usr/local/bin/forgejo-ci-hook.py /usr/local/bin/forgejo-ci-hook && mv /usr/local/bin/sccache /usr/local/bin/sccache-real && ln -s /usr/local/bin/sccache-wrapper /usr/local/bin/sccache # buildkit

RUN |1 CODEX_VERSION=0.153.1 /bin/sh -c useradd -u 1000 -M -d /data/home node && chmod -R a+rwX /usr/local/rustup /usr/local/cargo # buildkit

RUN |1 CODEX_VERSION=0.153.1 /bin/sh -c sed -i '/^node:/d' /etc/subuid /etc/subgid && mkdir -p /etc/containers && printf '[storage]\ndriver = "overlay"\nrunroot = "/tmp/containers-run"\ngraphroot = "/data/home/.local/share/containers/storage"\n\n[storage.options]\nignore_chown_errors = "true"\n' > /etc/containers/storage.conf # buildkit

USER node

ENV HOME=/data/home

RUN |1 CODEX_VERSION=0.153.1 /bin/sh -c set -eu; test "$(id -u)" = 1000; for command_name in codex codex-native claude omnigent omni fgj happier cargo uv bun capnp qos-check-build-env playwright qemu-system-x86_64 qemu-img podman kubectl talosctl sudo bootstrap-repositories configure-model-gateway configure-codex-ci-hook forgejo-ci-hook refresh-forgejo-credential wait-for-sandbox-assignment forgejo-credential-helper podman-sidecar; do command -v "$command_name" >/dev/null; done; sudo -n true; test -z "$(find /usr/local/cargo -type f ! -readable -print -quit)"; qos-check-build-env; playwright --version; playwright screenshot about:blank /tmp/browser-smoke.png; test -s /tmp/browser-smoke.png; rm /tmp/browser-smoke.png; /opt/uv-tools/omnigent/bin/python -c 'from omnigent.inner.codex_executor import CODEX_EXTERNALIZE_SUBAGENTS_ENV_VAR as key; assert key == "OMNIGENT_EXTERNALIZE_SUBAGENTS"'; provider_test_home=$(mktemp -d); HOME="$provider_test_home" MODEL_GATEWAY_URL=https://gateway.invalid LITELLM_API_KEY=test-only OMNIGENT_HOST_CONFIG_B64=e30= /opt/uv-tools/omnigent/bin/python /usr/local/bin/configure-omnigent-provider.py; HOME="$provider_test_home" LITELLM_API_KEY=test-only /opt/uv-tools/omnigent/bin/python -c 'from omnigent.onboarding.provider_config import _load_config, default_provider_for_harness; p=default_provider_for_harness(_load_config(), "codex"); assert p and p.name == "podesta-gateway" and p.family("openai").default_model == "gpt-5.6-sol"'; rm -rf "$provider_test_home"; env -u SCCACHE_BUCKET -u SCCACHE_ENDPOINT -u SCCACHE_AWS_ACCESS_KEY_ID -u SCCACHE_AWS_SECRET_ACCESS_KEY timeout 10s sccache --show-stats >/dev/null; timeout 30s omnigent --help >/dev/null; timeout 30s fgj --help >/dev/null # buildkit

CMD ["sandbox-entrypoint"]

COPY /sandbox-api /usr/local/bin/sandbox-api # buildkit

USER node

EXPOSE [8080/tcp]

ENTRYPOINT ["/usr/local/bin/sandbox-api"]

CMD []

Key	Value
io.buildah.version	1.43.1
license	MIT
name	fedora
org.opencontainers.image.license	MIT
org.opencontainers.image.licenses	MIT
org.opencontainers.image.name	fedora
org.opencontainers.image.source	https://code.podesta.ai/PodestaAI/agent-platform
org.opencontainers.image.title	fedora
org.opencontainers.image.url	https://fedoraproject.org/
org.opencontainers.image.vendor	Fedora Project
org.opencontainers.image.version	42
vendor	Fedora Project
version	42