2026-10-31 16:51:07 +01:00
|
|
|
# Bounded executor image (NK-WP-0056-T13). Build context: the repository root.
|
|
|
|
|
# docker build -f bounded-executor/Containerfile .
|
|
|
|
|
# lldap_set_password comes from the same pinned LLDAP image production runs, so OPAQUE matches.
|
|
|
|
|
FROM docker.io/lldap/lldap@sha256:9e605a66c02514bfcffd1b67cafb1e98d50992216bb2871d7ae44622047dd09d AS lldap
|
|
|
|
|
FROM python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9
|
|
|
|
|
RUN useradd --create-home --uid 10001 executor
|
|
|
|
|
WORKDIR /app
|
|
|
|
|
COPY --from=lldap /app/lldap_set_password /app/lldap_set_password
|
|
|
|
|
COPY bounded-executor/requirements.txt /app/bounded-executor/requirements.txt
|
|
|
|
|
RUN python -m pip install --no-cache-dir --require-hashes -r /app/bounded-executor/requirements.txt
|
|
|
|
|
# The executed files keep their repository paths: admissions pin them by path and sha256.
|
|
|
|
|
COPY canon/schemas/bounded-execution-admission_v0.1.schema.json /app/canon/schemas/
|
|
|
|
|
COPY tools/bounded-execution-admission/validate.py /app/tools/bounded-execution-admission/
|
|
|
|
|
COPY sso-mfa/k8s/synthetic-journey/journey.py /app/sso-mfa/k8s/synthetic-journey/
|
NK-WP-0058-T08 worker protocol and excerpt tool; T06 window watch (row O5), first use of the protocol
T08: .claude/rules/worker-protocol.md (imported by CLAUDE.md, pointed to from AGENTS.md) and
tools/contract-tests/excerpt.py: name the rows, hand every worker one excerpt, one owner per step, check
with the excerpt's tests. A test requires every table row to have details and a contract test (found O4).
T06: bounded-executor/window_watch.py flags or closes the write role when no run Job is active or recent;
stub tests; in the image. Built from the excerpt for O5, E1, C1, E8, E9, R2.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
2026-11-06 01:36:09 +01:00
|
|
|
COPY bounded-executor/executor.py bounded-executor/operations.py bounded-executor/clients.py bounded-executor/cli.py \
|
|
|
|
|
bounded-executor/window_watch.py /app/bounded-executor/
|
2026-10-31 16:51:07 +01:00
|
|
|
USER 10001:10001
|
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1
|
|
|
|
|
ENTRYPOINT ["python", "/app/bounded-executor/cli.py"]
|
