OpenSource/ECC
1
0 Fork 0
mirror of https://github.com/affaan-m/ECC.git synced 2026-10-26 18:35:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(projections): reconcile current Docker guidance and registry binding

Browse Source
This commit is contained in:
haelyra committed 2026-10-11 04:00:37 -04:00
1 parent bb1a3bacea
commit 74fa43fd78
2 files changed
+10 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

manifests/context-packs/skill-triggers@1.json
+1 -1
View File
@@ -10,7 +10,7 @@
"id": "hand-seeded", "id": "hand-seeded",
"source": "manual-curation-pending-regeneration" "source": "manual-curation-pending-regeneration"
}, },
"registryDigest": "2f875b395c5ccc302976234366e93d2bb9e284039081de35a702b3566389e791", "registryDigest": "5dd7259b7c6706ef2d6223330654a7dd1bf84893655fddb3d003a56b35b8c18a",
"schemaVersion": 1, "schemaVersion": 1,
"triggers": { "triggers": {
"skill:agent-runtime-gateway-smoke-test": [ "skill:agent-runtime-gateway-smoke-test": [
pi/core/skills/docker-patterns/SKILL.md
+9 -3
View File
@@ -409,8 +409,10 @@ docker compose -p ecc-plugin-session \
Host credentials are absent by default and credential directories are never Host credentials are absent by default and credential directories are never
mounted. The default service also has no network access. When an authenticated mounted. The default service also has no network access. When an authenticated
provider session genuinely needs a network, build `real-cli` first and then opt provider session genuinely needs a network, build `real-cli` first and then opt
in visibly with `docker compose --profile networked run real-cli-networked in visibly with `docker compose -f docker/plugin-setup/compose.yaml
shell`. Prefer authenticating inside that disposable session. If a CI run must --profile networked run --service-ports real-cli-networked shell`. The
`--service-ports` flag publishes the service's loopback callback mapping.
Prefer authenticating inside that disposable session. If a CI run must
inherit a host environment credential, make that opt-in at invocation with an inherit a host environment credential, make that opt-in at invocation with an
explicit Compose `--env NAME` flag, understand that the value is inspectable explicit Compose `--env NAME` flag, understand that the value is inspectable
and can be exfiltrated for the container lifetime, and remove the exact named and can be exfiltrated for the container lifetime, and remove the exact named
@@ -426,13 +428,17 @@ without a bridge. The `real-cli-networked` service publishes host
logging in: logging in:
```bash ```bash
npm install --global @openai/codex # the harness image does not ship codex npm install --global @openai/codex@0.162.0 # the harness image does not ship codex
node /ecc/docker/plugin-setup/codex-auth-relay.js & node /ecc/docker/plugin-setup/codex-auth-relay.js &
relay_pid=$! relay_pid=$!
codex login codex login
kill "$relay_pid" kill "$relay_pid"
``` ```
The networked service sets `NPM_CONFIG_PREFIX=/tmp/ecc-npm` and adds its `bin`
directory to `PATH`. This keeps the pinned installation writable for UID 1000
on the executable `/tmp` mount while the root filesystem remains read-only.
Complete the sign-in in the host browser. Each attempt mints a fresh Complete the sign-in in the host browser. Each attempt mints a fresh
`state`/`code`, so always follow the newest printed link. The token stays in `state`/`code`, so always follow the newest printed link. The token stays in
the disposable container's `~/.codex/auth.json`; removing the named container the disposable container's `~/.codex/auth.json`; removing the named container