instant (dev) sandbox (#171)

* instant (dev) sandbox

* leave Dockerfile as is to pass deploy test

* fix comma

* fix prod build

* do not use "images exists" which docker does not support

* separate dev-mode flag

* Merge remote-tracking branch 'origin/main' into instant_sandbox

5 files changed, 86 insertions, 25 deletions

diff --git a/.vscode/launch.json b/.vscode/launch.json
index d172567f..cc8b3ef6 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -11,7 +11,10 @@
       "skipFiles": ["<node_internals>/**"],
       "type": "node",
       // fix source mapping when debugging in sandbox
-      "remoteRoot": "/usr/local/share/npm-global/lib/node_modules/@gemini-code",
+      // we assume debugging is done on gemini-code project itself (see CLI_PATH setup in start_sandbox.sh)
+      // there seems to be no way to map two distinct remoteRoots to same localRoot under same configuration
+      // "remoteRoot": "/usr/local/share/npm-global/lib/node_modules/@gemini-code",
+      "remoteRoot": "/sandbox/gemini-code/packages",
       "localRoot": "${workspaceFolder}/packages"
     },
     {
diff --git a/Dockerfile-dev b/Dockerfile-dev
new file mode 100644
index 00000000..33eb889a
--- /dev/null
+++ b/Dockerfile-dev
@@ -0,0 +1,31 @@
+FROM docker.io/library/node:20-slim
+
+# install minimal set of packages, then clean up
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  man-db \
+  curl \
+  dnsutils \
+  less \
+  jq \
+  bc \
+  gh \
+  git \
+  unzip \
+  rsync \
+  ripgrep \
+  procps \
+  psmisc \
+  lsof \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
+
+# set up npm global package folder under /usr/local/share
+# give it to non-root user node, already set up in base image
+RUN mkdir -p /usr/local/share/npm-global \
+  && chown -R node:node /usr/local/share/npm-global
+ENV NPM_CONFIG_PREFIX=/usr/local/share/npm-global
+ENV PATH=$PATH:/usr/local/share/npm-global/bin
+
+# switch to non-root user node
+USER node
+
diff --git a/scripts/build.sh b/scripts/build.sh
index 46304919..f14c3984 100755
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -25,6 +25,7 @@ npm run build --workspaces
 
 # also build container image if sandboxing is enabled
 # skip (-s) npm install + build since we did that above
+# use (-d) for dev build that can reuse existing image
 if scripts/sandbox_command.sh -q; then
-    scripts/build_sandbox.sh -s
+    scripts/build_sandbox.sh -sd
 fi
diff --git a/scripts/build_sandbox.sh b/scripts/build_sandbox.sh
index 20a255a0..710f884b 100755
--- a/scripts/build_sandbox.sh
+++ b/scripts/build_sandbox.sh
@@ -24,16 +24,19 @@ CMD=$(scripts/sandbox_command.sh)
 echo "using $CMD for sandboxing"
 
 IMAGE=gemini-code-sandbox
+DOCKERFILE=${DOCKERFILE:-Dockerfile}
 
 SKIP_NPM_INSTALL_BUILD=false
-while getopts "s" opt; do
+while getopts "sd" opt; do
     case ${opt} in
-        s) SKIP_NPM_INSTALL_BUILD=true ;;
-        \?)
-            echo "usage: $(basename "$0") [-s]"
-            echo "  -s: skip npm install + npm run build"
-            exit 1
-            ;;
+    s) SKIP_NPM_INSTALL_BUILD=true ;;
+    d) DOCKERFILE=Dockerfile-dev ;;
+    \?)
+        echo "usage: $(basename "$0") [-s] [-d]"
+        echo "  -s: skip npm install + npm run build"
+        echo "  -d: use Dockerfile-dev"
+        exit 1
+        ;;
     esac
 done
 shift $((OPTIND - 1))
@@ -44,30 +47,40 @@ if [ "$SKIP_NPM_INSTALL_BUILD" = false ]; then
     npm run build
 fi
 
-# pack cli
-echo "packing @gemini-code/cli ..."
-rm -f packages/cli/dist/gemini-code-cli-*.tgz
-npm pack -w @gemini-code/cli --pack-destination ./packages/cli/dist &> /dev/null
-
-# pack server
-echo "packing @gemini-code/server ..."
-rm -f packages/server/dist/gemini-code-server-*.tgz
-npm pack -w @gemini-code/server --pack-destination ./packages/server/dist &> /dev/null
+# if using Dockerfile-dev, then skip rebuild unless REBUILD_SANDBOX is set
+# rebuild should not be necessary unless Dockerfile-dev is modified
+if [ "$DOCKERFILE" = "Dockerfile-dev" ]; then
+    if $CMD images -q "$IMAGE" | grep -q . && [ -z "${REBUILD_SANDBOX:-}" ]; then
+        echo "using existing $IMAGE (set REBUILD_SANDBOX=true to force rebuild)"
+        exit 0
+    fi
+fi
 
-# give node user access to tgz files
-chmod 755 packages/*/dist/gemini-code-*.tgz
+# prepare global installation files for prod build
+if [ "$DOCKERFILE" = "Dockerfile" ]; then
+    # pack cli
+    echo "packing @gemini-code/cli ..."
+    rm -f packages/cli/dist/gemini-code-cli-*.tgz
+    npm pack -w @gemini-code/cli --pack-destination ./packages/cli/dist &>/dev/null
+    # pack server
+    echo "packing @gemini-code/server ..."
+    rm -f packages/server/dist/gemini-code-server-*.tgz
+    npm pack -w @gemini-code/server --pack-destination ./packages/server/dist &>/dev/null
+    # give node user (used during installation, see Dockerfile) access to these files
+    chmod 755 packages/*/dist/gemini-code-*.tgz
+fi
 
 # build container image & prune older unused images
 echo "building $IMAGE ... (can be slow first time)"
 
 if [[ "$CMD" == "podman" ]]; then
     # use empty --authfile to skip unnecessary auth refresh overhead
-    $CMD build --authfile=<(echo '{}') -t "$IMAGE" . >/dev/null
+    $CMD build --authfile=<(echo '{}') -f "$DOCKERFILE" -t "$IMAGE" . >/dev/null
 elif [[ "$CMD" == "docker" ]]; then
     # use an empty config directory to skip unnecessary auth refresh overhead
-    $CMD --config="empty" build -t "$IMAGE" . >/dev/null
+    $CMD --config="empty" build -f "$DOCKERFILE" -t "$IMAGE" . >/dev/null
 else
-    $CMD build -t "$IMAGE" . >/dev/null
+    $CMD build -f "$DOCKERFILE" -t "$IMAGE" . >/dev/null
 fi
 $CMD image prune -f >/dev/null
 echo "built $IMAGE"
diff --git a/scripts/start_sandbox.sh b/scripts/start_sandbox.sh
index 1c3e2417..1661fa14 100755
--- a/scripts/start_sandbox.sh
+++ b/scripts/start_sandbox.sh
@@ -22,10 +22,23 @@ fi
 
 CMD=$(scripts/sandbox_command.sh)
 IMAGE=gemini-code-sandbox
-WORKDIR=/sandbox/$(basename "$PWD")
-CLI_PATH=/usr/local/share/npm-global/lib/node_modules/\@gemini-code/cli
 DEBUG_PORT=9229
 
+PROJECT=$(basename "$PWD")
+WORKDIR=/sandbox/$PROJECT
+CLI_PATH=/usr/local/share/npm-global/lib/node_modules/\@gemini-code/cli
+
+# if project is gemini-code, then run CLI from $WORKDIR/packages/cli
+# note this means the global installation is not required in this case
+if [[ "$PROJECT" == "gemini-code" ]]; then
+    CLI_PATH="$WORKDIR/packages/cli"
+elif [ -n "${DEBUG:-}" ]; then
+    # refuse to debug using global installation
+    # (requires a separate attach config in launch.json, see comments there around remoteRoot)
+    echo "ERROR: debugging is sandbox is not supported when target/root is not gemini-code"
+    exit 1
+fi
+
 # use interactive tty mode and auto-remove container on exit
 run_args=(-it --rm)