Jonathan KirkwoodandClaude Fable 5
1dde915540
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
29 lines
1.3 KiB
Docker
29 lines
1.3 KiB
Docker
# Boardroom Map reviewer image — BUILT ON THE HEAD SPARK (aarch64), not packed into the
|
|
# s9pk (the orchestrator ships this build context and builds it on the Spark; see
|
|
# reviewers.ensure_reviewer_image).
|
|
#
|
|
# One-shot, read-only document reviewer (grader_agent.py) speaking the
|
|
# OpenAI-compatible API directly — a lean pure-Python image that builds fast.
|
|
#
|
|
# At RUN time the orchestrator launches this HARDENED (non-root, --cap-drop ALL,
|
|
# --security-opt no-new-privileges, read-only rootfs, no docker socket, only
|
|
# /docs (ro), /persona (ro), /RUBRIC.md (ro) and /out (rw) mounted, cpu/mem/pid
|
|
# caps) and attached to the per-job network. In air-gapped mode that network is
|
|
# --internal, so the container can reach ONLY the on-Spark model proxy.
|
|
FROM python:3.11-slim
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates curl && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
# Non-root user matching the orchestrator's --user 1000:1000 (HOME=/home/rev,
|
|
# mounted as a writable tmpfs at run time).
|
|
RUN useradd -u 1000 -m -d /home/rev -s /bin/bash reviewer || true
|
|
|
|
COPY grader_agent.py /opt/boardroom/grader_agent.py
|
|
|
|
WORKDIR /out
|
|
ENV PYTHONUNBUFFERED=1
|
|
# grader_agent.py uses only the Python stdlib (urllib) — no pip deps to install.
|
|
ENTRYPOINT ["python3", "/opt/boardroom/grader_agent.py"]
|