Add project-scoped Codex execution over a private socket

2026-11-05 02:29:49 +08:00
parent 4d5e6e2512
commit 9e5d805f5a
7 changed files with 426 additions and 3 deletions
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+base=/opt/endoleap-infra
+dir=$base/foundry/codex
+binary=$(realpath "$1")
+test -x "$binary"
+test -s "$dir/home/auth.json"
+test -s "$dir/grants/projects.json"
+install -d -m 700 -o 1000 -g 1000 "$dir/run"
+
+# The host operator supplies an isolated Codex home and starts a single worker.
+# The Docker default bridge supplies egress independently of Foundry's network.
+docker run -d --name foundry-codex-worker --restart unless-stopped --init \
+  --network bridge --user 1000:1000 --cap-drop ALL --security-opt no-new-privileges \
+  --read-only --pids-limit 128 --memory 384m --tmpfs /tmp:rw,nosuid,nodev \
+  --tmpfs /work:ro,nosuid,nodev --workdir /work \
+  --mount "type=bind,source=$binary,target=/opt/foundry,readonly" \
+  --mount "type=bind,source=$base/codex-cli,target=/opt/codex,readonly" \
+  --mount "type=bind,source=$dir/home,target=/home/node/.codex" \
+  --mount "type=bind,source=$dir/run,target=/run/foundry-codex" \
+  --mount "type=bind,source=/etc/ssl/certs/ca-certificates.crt,target=/etc/ssl/certs/ca-certificates.crt,readonly" \
+  node:24-bookworm-slim /opt/foundry codex-worker