Marcos
c7c6c3edd2
The npm prefix in the Dockerfile is /usr, so opencode installs to
/usr/bin/opencode (symlink to /usr/lib/node_modules/...), not
/usr/local/bin/opencode. The cluster E2E failed with ENOENT on
/usr/local/bin/opencode. Fix in three places:
- Dockerfile ENV PRAGENT_OPENCODE_BIN=/usr/bin/opencode
- ~/k8s/pragent-webhook.yaml env value
- _opencode_bin() now defensive: if the configured path is missing,
falls back to shutil.which('opencode') before the linuxbrew last-resort.
- Dockerfile + README deploy notes: containerd import is sudoless via
the group-readable raw socket (the microk8s ctr wrapper sudo-wraps).
Verified: rebuilt + reimported + rolled out; PR #5 (sha 985061c0) review
posted in-pod via the opencode engine (findings=2 inline=2 ok=True),
summary + 2 [CRITICAL] inline comments with suggestions + refs + sha marker.
Co-Authored-By: Claude <noreply@anthropic.com>
54 lines
2.4 KiB
Docker
54 lines
2.4 KiB
Docker
# pragent pilot — combined webhook + opencode review-engine image.
|
|
#
|
|
# One container runs the Gitea webhook server (python) and subprocess-calls the
|
|
# opencode CLI headlessly to analyze each PR. Includes node + the LSPs / linters
|
|
# the pragent agent's bash tool can invoke on the checked-out repo. The factory
|
|
# (opencode.json + .opencode/ agents/skills) lives at /app and is discovered via
|
|
# PRAGENT_FACTORY_DIR=/app.
|
|
#
|
|
# Build:
|
|
# docker build -t pragent-webhook:opencode -f pilot/Dockerfile .
|
|
# Import into microk8s containerd (sudoless — the raw socket is group-readable
|
|
# by the microk8s group; the `microk8s ctr` wrapper itself sudo-wraps, so use
|
|
# the raw binary against the socket directly):
|
|
# docker save pragent-webhook:opencode | \
|
|
# /snap/microk8s/current/bin/ctr --address /var/snap/microk8s/common/run/containerd.sock \
|
|
# --namespace k8s.io image import -
|
|
#
|
|
FROM python:3.12-slim
|
|
|
|
# System deps: git (archive/repo reads by the agent), ripgrep (opencode dep),
|
|
# curl + ca-certs (archive fetch), xz-utils (node install).
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
git ripgrep curl ca-certificates xz-utils \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Node 20 — opencode runtime + the npm-installed LSP servers below.
|
|
RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
|
|
&& apt-get install -y --no-install-recommends nodejs \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# opencode CLI, pinned to the verified version. opencode bun-installs its
|
|
# @opencode-ai runtime into $HOME/.config/opencode/node_modules on first run
|
|
# (cold-start ~30-60s, once per pod lifetime; the webhook returns 202 async so
|
|
# no Gitea delivery timeout is risked). HOME is an emptyDir at runtime.
|
|
RUN npm install -g opencode-ai@1.3.10
|
|
|
|
# LSPs + linters the pragent agent's bash tool can invoke on reviewed repos.
|
|
# (opencode's own LSP tool is opportunistic; the real signal is the agent
|
|
# running the repo's own tsc/ruff/eslint/go vet — these make that available.)
|
|
RUN npm install -g pyright typescript-language-server typescript eslint \
|
|
&& pip install --no-cache-dir ruff
|
|
|
|
# pragent repo: factory (opencode.json + .opencode/) + pilot scripts.
|
|
WORKDIR /app
|
|
COPY . /app
|
|
|
|
ENV PRAGENT_FACTORY_DIR=/app \
|
|
PRAGENT_OPENCODE_BIN=/usr/bin/opencode \
|
|
PRAGENT_ENGINE=opencode \
|
|
OPENCODE_MODEL=headroom/glm-5.2:cloud \
|
|
OPENCODE_EXPERIMENTAL_LSP_TOOL=true \
|
|
PRAGENT_RTK_DIR=""
|
|
|
|
CMD ["python3", "/app/pilot/webhook_server.py"] |