29 lines
1.2 KiB
Bash
29 lines
1.2 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
base=/opt/endoleap-infra
|
|
dir=$base/foundry/codex
|
|
binary=$(realpath "$1")
|
|
test -x "$binary"
|
|
test -s "$dir/home/auth.json"
|
|
test -s "$dir/grants/projects.json"
|
|
install -d -m 700 "$dir/run"
|
|
chown 1000:1000 "$dir/run"
|
|
|
|
canvas_env=()
|
|
if [[ -s "$dir/canvas.env" ]]; then canvas_env=(--env-file "$dir/canvas.env"); fi
|
|
|
|
# The host operator supplies an isolated Codex home and starts a single worker.
|
|
# The Docker default bridge supplies egress independently of Foundry's network.
|
|
docker run -d --name foundry-codex-worker --restart unless-stopped --init \
|
|
--network bridge --user 1000:1000 --cap-drop ALL --security-opt no-new-privileges \
|
|
--read-only --pids-limit 128 --memory 1g --tmpfs /tmp:rw,nosuid,nodev \
|
|
--tmpfs /work:ro,nosuid,nodev --workdir /work \
|
|
--mount "type=bind,source=$binary,target=/opt/foundry,readonly" \
|
|
--mount "type=bind,source=$base/codex-cli,target=/opt/codex,readonly" \
|
|
--mount "type=bind,source=$dir/home,target=/home/node/.codex" \
|
|
--mount "type=bind,source=$dir/run,target=/run/foundry-codex" \
|
|
--mount "type=bind,source=/etc/ssl/certs/ca-certificates.crt,target=/etc/ssl/certs/ca-certificates.crt,readonly" \
|
|
"${canvas_env[@]}" \
|
|
node:24-bookworm-slim /opt/foundry codex-worker
|