Conversation
Adds an Ubuntu 24.04 image with Node, pnpm (via corepack) and the Google Cloud CLI for running a Root CMS project against a real Firestore project. The project is mounted at /workspace rather than baked in, and gcloud credentials live in $HOME/.config/gcloud so a named volume persists both `gcloud auth login` and `gcloud auth application-default login` across runs. Includes an entrypoint that installs dependencies on first start and warns when ADC is missing, a compose file wiring up the volumes, and a README covering first-time sign-in, service-account keys and baking a project in. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q3fsygkHJZtnYPN64syuvy
Adds docker/Dockerfile.claude, a child image (FROM root-cms) that installs the Claude Code CLI and defaults to `claude remote-control`, so a session running against the mounted project can be driven from claude.ai or the Claude app. Keeping it separate from the base image avoids shipping an agent CLI into images built FROM root-cms for deployment, and keeps the claude.ai token and the project's Google Cloud credentials on separate volumes so each can be granted independently. CLAUDE_CONFIG_DIR points at ~/.claude so the volume mounted there persists .claude.json (OAuth account and workspace trust) along with the token. The CLI installs into a user-owned npm prefix so its self-updater can write to it. The compose service sits behind a `claude` profile so `up` doesn't start an agent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q3fsygkHJZtnYPN64syuvy
Matches the image name to the `root` CLI command. The base image, its compose service and the compose project are now `root`, and the Claude Code child image is `root-ai-claude`. Example volume names follow (`root-gcloud`, `root-pnpm-store`, `root-ai-claude-config`). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q3fsygkHJZtnYPN64syuvy
stevenle
changed the title
Prepares the images for Claude Code Remote Control sessions that create branches and worktrees: - Install the GitHub CLI in the Claude image, which Claude reaches for to open pull requests and read CI results. - Mirror GIT_AUTHOR_* to GIT_COMMITTER_* in the entrypoint and drop empty GIT_* values, since git rejects an empty ident more loudly than a missing one. Warn at startup when a repository has no identity available at all. - Group-own $HOME and /workspace by gid 0 with the owner's permissions, so a pulled image still works via `--user "$(id -u):0"` when the host user isn't 1000, and set safe.directory=* so git doesn't refuse the bind-mounted repo as dubiously owned. - Give the compose claude service `--spawn worktree` and publish 4008-4013, because `root dev` scans upward from 4007 and a second concurrent session's dev server would otherwise be unreachable. Pushing still has no credentials; the README says so explicitly. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q3fsygkHJZtnYPN64syuvy
The entrypoint now runs `gh auth setup-git` when it finds a credential, so `git push`, `git fetch` and `gh pr create` work from the container. A credential is either GH_TOKEN/GITHUB_TOKEN in the environment or a `gh auth login` persisted in a volume at ~/.config/gh, which the compose claude service now declares alongside the token passthrough. Details worth noting: - Some gh versions refuse `auth setup-git` when the only credential is an environment token, so the helper it would have written is set directly as a fallback. - A token only authenticates https remotes, so an `insteadOf` rewrite is added for ssh remotes when a token is present — a checkout cloned over ssh would otherwise fail to push with no key in the container. - Existing logins are detected by reading gh's hosts.yml rather than calling `gh auth status`, which would validate the token over the network on every container start. - The config is written to the container's own ~/.gitconfig in the writable layer, so no token is persisted to a volume or to the host. Empty GH_TOKEN/GITHUB_TOKEN/GH_HOST values are dropped, as with the GIT_* identity variables. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q3fsygkHJZtnYPN64syuvy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a complete Docker-based development environment for Root.js CMS projects, enabling local development against real Firebase/Firestore backends without manual toolchain setup.
Changes
docker/Dockerfile— Ubuntu 24.04 base image with Node.js 24.16.0, pnpm 11.17.0, and Google Cloud CLI pre-installed. Runs as a non-root user (uid/gid 1000 by default) so mounted project files retain host ownership. Includes an entrypoint script that auto-installs dependencies and validates credentials.docker/entrypoint.sh— Container startup script that:node_modulesis missing (controlled byROOT_DOCKER_INSTALLenv var)GOOGLE_APPLICATION_CREDENTIALS)docker/Dockerfile.claude— Child image that adds Claude Code CLI on top of the base image, enabling AI agent sessions (via Remote Control) to run against the project with the same Node/pnpm/gcloud environment.docker/docker-compose.yml— Declarative compose configuration that:ROOT_PROJECT_DIRandROOT_PROJECT_SUBDIRfor flexible project mountingclaudeservice behind a profile so agent sessions don't start unexpectedly.envfrom the project automaticallydocker/README.md— Comprehensive documentation covering:AGENTS.md— Updated to reference the new Docker setup in the project structure section.Implementation Details
root-gcloud,root-ai-claude-config) so users sign in once and reuse credentials across container runs.UID,GID,USERNAME) allow the container to match the host user's ownership, preventing permission issues on mounted files.https://claude.ai/code/session_01Q3fsygkHJZtnYPN64syuvy