mirror of
https://github.com/open-webui/open-terminal.git
synced 2026-11-04 08:10:53 +00:00
98 lines
3.4 KiB
Docker
98 lines
3.4 KiB
Docker
# Pin to a specific patch version for reproducible builds.
|
|
# To pick up security patches, bump this version and rebuild.
|
|
FROM python:3.12.13
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
# Core utilities
|
|
coreutils findutils grep sed gawk diffutils patch \
|
|
less file tree bc man-db \
|
|
# Networking
|
|
curl wget net-tools iputils-ping dnsutils netcat-openbsd socat telnet \
|
|
openssh-client rsync \
|
|
# Browser tabs
|
|
chromium chromium-sandbox fonts-noto-cjk fonts-noto-color-emoji \
|
|
# Editors
|
|
vim nano \
|
|
# Version control
|
|
git \
|
|
# Build tools
|
|
build-essential cmake make \
|
|
# Scripting & languages
|
|
perl ruby-full lua5.4 \
|
|
# Data processing
|
|
jq xmlstarlet sqlite3 \
|
|
# Media & documents
|
|
ffmpeg pandoc poppler-utils imagemagick texlive-latex-base \
|
|
libreoffice-nogui fonts-dejavu fonts-crosextra-caladea fonts-crosextra-carlito \
|
|
# Compression
|
|
zip unzip tar gzip bzip2 xz-utils zstd p7zip-full \
|
|
# System
|
|
procps htop lsof strace sysstat \
|
|
sudo tmux screen tini iptables ipset dnsmasq \
|
|
ca-certificates gnupg apt-transport-https \
|
|
# Capabilities (needed for setcap on Python binary)
|
|
libcap2-bin \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Node.js (LTS)
|
|
RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
|
|
&& apt-get install -y --no-install-recommends nodejs \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Docker CLI + Compose + Buildx (mount socket at runtime for access)
|
|
RUN curl -fsSL https://get.docker.com | sh
|
|
|
|
# Uncomment to apply security patches beyond what the base image provides.
|
|
# Not recommended for reproducible builds; prefer bumping the base image tag.
|
|
# RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
|
|
|
|
|
|
WORKDIR /app
|
|
|
|
RUN pip install --no-cache-dir \
|
|
numpy pandas scipy scikit-learn \
|
|
matplotlib seaborn plotly \
|
|
jupyter ipython \
|
|
requests beautifulsoup4 lxml \
|
|
sqlalchemy psycopg2-binary \
|
|
pyyaml toml jsonlines \
|
|
tqdm rich \
|
|
openpyxl weasyprint \
|
|
python-docx python-pptx pypdf csvkit
|
|
|
|
# Desktop sessions are started on demand and streamed through the terminal API.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
tigervnc-standalone-server xfce4 xfce4-terminal dbus-x11 \
|
|
xauth xdotool xclip scrot libreoffice libreoffice-gtk3 pulseaudio pulseaudio-utils \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Debian's launcher resets CHROMIUM_FLAGS before reading this directory.
|
|
RUN printf '%s\n' \
|
|
'case "${OPEN_TERMINAL_BROWSER_NO_SANDBOX:-false}" in' \
|
|
' [tT][rR][uU][eE]|1|[yY][eE][sS]) export CHROMIUM_FLAGS="$CHROMIUM_FLAGS --no-sandbox" ;;' \
|
|
'esac' > /etc/chromium.d/open-terminal
|
|
|
|
COPY . .
|
|
# Create a capability-bearing Python copy for the server process only.
|
|
# The system python3 stays clean so user-spawned Python processes remain
|
|
# dumpable (readable via /proc/[pid]/fd/ for port detection).
|
|
RUN pip install --no-cache-dir . \
|
|
&& cp "$(readlink -f "$(which python3)")" /usr/local/bin/python3-ot \
|
|
&& setcap cap_setgid+ep /usr/local/bin/python3-ot \
|
|
&& sed -i "1s|.*|#!/usr/local/bin/python3-ot|" "$(which open-terminal)"
|
|
|
|
RUN useradd -m -s /bin/bash user && echo 'user ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
|
|
|
|
USER user
|
|
ENV SHELL=/bin/bash
|
|
ENV OPEN_TERMINAL_BROWSER_NO_SANDBOX=true
|
|
ENV PATH="/home/user/.local/bin:${PATH}"
|
|
WORKDIR /home/user
|
|
|
|
EXPOSE 8000
|
|
|
|
COPY entrypoint.sh /app/entrypoint.sh
|
|
|
|
ENTRYPOINT ["/usr/bin/tini", "--", "/app/entrypoint.sh"]
|
|
CMD ["run"]
|