Dockerfile

# syntax=docker/dockerfile:1

FROM node:24-slim AS build

ARG CODEX_WEB_REF=0f71e2c901cc901931c8f43730fb41e899f71293

ENV NPM_CONFIG_PREFIX=/opt/npm-global \
    NPM_CONFIG_UPDATE_NOTIFIER=false \
    NPM_CONFIG_FUND=false \
    NPM_CONFIG_AUDIT=false \
    PATH=/opt/npm-global/bin:$PATH \
    NODE_ENV=production

RUN mkdir -p /opt/npm-global \
 && apt-get update \
 && apt-get install -y --no-install-recommends \
      ca-certificates curl unzip patch python3 build-essential \
 && rm -rf /var/lib/apt/lists/* \
 && curl -fsSL "https://github.com/0xcaff/codex-web/archive/${CODEX_WEB_REF}.tar.gz" \
      | tar -xz -C /opt \
 && mv /opt/codex-web-${CODEX_WEB_REF} /opt/codex-web

COPY --chmod=0755 <<'PY' /opt/apply-hf-patches.py
#!/usr/bin/env python3
from pathlib import Path

root = Path("/opt/codex-web")

# server: long-lived IPC websocket
main = (root / "src/server/main.ts").read_text()

old_ws = 'const websocketServer = new WebSocketServer({ noServer: true });'
new_ws = 'const websocketServer = new WebSocketServer({ noServer: true, perMessageDeflate: false });'
if old_ws not in main:
    raise SystemExit("patch fail: websocketServer constructor")
main = main.replace(old_ws, new_ws, 1)

old_conn = """  websocketServer.on("connection", (socket) => {
    sockets.add(socket);
"""
new_conn = """  websocketServer.on("connection", (socket) => {
    sockets.add(socket);
    try {
      const raw = (socket as unknown as { _socket?: { setKeepAlive?: (on: boolean, ms?: number) => void; setNoDelay?: (on: boolean) => void; setTimeout?: (ms: number) => void } })._socket;
      raw?.setKeepAlive?.(true, 15000);
      raw?.setNoDelay?.(true);
      raw?.setTimeout?.(0);
    } catch {
      /* ignore */
    }
    const pingInterval = setInterval(() => {
      if (socket.readyState === WebSocket.OPEN) {
        try { socket.ping(); } catch { /* proxy may strip ping frames */ }
        try { socket.send(JSON.stringify({ type: "keepalive", t: Date.now() })); } catch { /* ignore */ }
      }
    }, 12000);
"""
if old_conn not in main:
    raise SystemExit("patch fail: connection handler")
main = main.replace(old_conn, new_conn, 1)

old_close = """    socket.on("close", () => {
      sockets.delete(socket);
"""
new_close = """    socket.on("close", () => {
      clearInterval(pingInterval);
      sockets.delete(socket);
"""
if old_close not in main:
    raise SystemExit("patch fail: close handler")
main = main.replace(old_close, new_close, 1)

old_msg = """    socket.on("message", (rawData) => {
      let message: RendererToMainMessage;
      try {
        message = JSON.parse(String(rawData)) as RendererToMainMessage;
      } catch (error) {
        console.error("[ipc-bridge] invalid JSON payload", error);
        return;
      }
"""
new_msg = """    socket.on("message", (rawData) => {
      let message: RendererToMainMessage;
      try {
        message = JSON.parse(String(rawData)) as RendererToMainMessage;
      } catch (error) {
        console.error("[ipc-bridge] invalid JSON payload", error);
        return;
      }

      const maybeType = (message as { type?: string }).type;
      if (maybeType === "keepalive" || maybeType === "keepalive-ack") {
        if (maybeType === "keepalive" && socket.readyState === WebSocket.OPEN) {
          try { socket.send(JSON.stringify({ type: "keepalive-ack", t: (message as { t?: number }).t })); } catch { /* ignore */ }
        }
        return;
      }
"""
if old_msg not in main:
    raise SystemExit("patch fail: message handler")
main = main.replace(old_msg, new_msg, 1)

old_static = """  await app.register(fastifyStatic, {
    root: path.resolve(__dirname, "../../scratch/asar/webview"),
    prefix: "/",
  });
"""
new_static = """  await app.register(fastifyStatic, {
    root: path.resolve(__dirname, "../../scratch/asar/webview"),
    prefix: "/",
    maxAge: 86400,
    setHeaders: (res, filePath) => {
      if (filePath.endsWith("index.html") || filePath.endsWith(".html")) {
        res.setHeader("Cache-Control", "no-cache");
      } else if (/\\.[0-9a-f]{8,}\\.(js|css|woff2?|png|svg|webp)$/i.test(filePath)) {
        res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
      } else {
        res.setHeader("Cache-Control", "public, max-age=86400");
      }
    },
  });
"""
if old_static not in main:
    raise SystemExit("patch fail: static register")
main = main.replace(old_static, new_static, 1)

old_listen = """  await app.listen({ host: options.host, port: options.port });
  console.log(`IPC bridge listening at ws://${options.host}:${options.port}`);
"""
new_listen = """  app.server.requestTimeout = 0;
  app.server.headersTimeout = 0;
  app.server.keepAliveTimeout = 120000;
  app.server.timeout = 0;
  await app.listen({ host: options.host, port: options.port });
  console.log(`IPC bridge listening at ws://${options.host}:${options.port}`);
"""
if old_listen not in main:
    raise SystemExit("patch fail: listen")
main = main.replace(old_listen, new_listen, 1)

# gzip static assets only — never a streaming/IPC path
if 'import fastifyCompress' not in main:
    main = main.replace(
        'import fastifyStatic from "@fastify/static";',
        'import fastifyCompress from "@fastify/compress";\nimport fastifyStatic from "@fastify/static";',
        1,
    )
if "fastifyCompress" in main and "app.register(fastifyCompress" not in main:
    main = main.replace(
        "  await app.register(fastifyMultipart, {",
        """  await app.register(fastifyCompress, {
    global: true,
    threshold: 1024,
    encodings: ["gzip", "deflate"],
    customTypes: /^text\\/|javascript|json|xml|svg|wasm/,
  });

  await app.register(fastifyMultipart, {""",
        1,
    )

(root / "src/server/main.ts").write_text(main)

pkg = (root / "package.json").read_text()
if '"@fastify/compress"' not in pkg:
    pkg = pkg.replace(
        '"@fastify/multipart": "^10.0.0",',
        '"@fastify/compress": "^9.2.0",\n    "@fastify/multipart": "^10.0.0",',
        1,
    )
    (root / "package.json").write_text(pkg)

# browser shim: application keepalive (proxies ignore WS ping frames)
shim = (root / "src/browser/shim.ts").read_text()
shim = shim.replace(
    "const RECONNECT_DELAY_MS = 1_000;",
    "const RECONNECT_DELAY_MS = 400;",
    1,
)

old_in = """function handleIncomingMessage(message: MainToRendererMessage): void {
  if (message.type === "ipc-main-event") {
"""
new_in = """function handleIncomingMessage(message: MainToRendererMessage): void {
  const maybeType = (message as { type?: string }).type;
  if (maybeType === "keepalive" || maybeType === "keepalive-ack") {
    return;
  }
  if (message.type === "ipc-main-event") {
"""
if old_in not in shim:
    raise SystemExit("patch fail: shim handleIncomingMessage")
shim = shim.replace(old_in, new_in, 1)

old_open = """  socket.addEventListener("open", () => {
    flushOutboundQueue();
  });
"""
new_open = """  socket.addEventListener("open", () => {
    flushOutboundQueue();
    try { socket.send(JSON.stringify({ type: "keepalive", t: Date.now() })); } catch { /* ignore */ }
  });
"""
if old_open not in shim:
    raise SystemExit("patch fail: shim open")
shim = shim.replace(old_open, new_open, 1)

needle = "ensureSocket();\n\nexport const contextBridge"
if needle not in shim:
    raise SystemExit("patch fail: shim ensureSocket trailer")
shim = shim.replace(
    needle,
    """ensureSocket();

setInterval(() => {
  if (socket && socket.readyState === WebSocket.OPEN) {
    try { socket.send(JSON.stringify({ type: "keepalive", t: Date.now() })); } catch { /* ignore */ }
  } else {
    ensureSocket();
  }
}, 12000);

document.addEventListener("visibilitychange", () => {
  if (document.visibilityState === "visible") {
    ensureSocket();
  }
});
window.addEventListener("online", () => ensureSocket());
window.addEventListener("pageshow", () => ensureSocket());

export const contextBridge""",
    1,
)
(root / "src/browser/shim.ts").write_text(shim)

# electron getPath: cache/temp off the bucket, userdata stays persisted
elec = (root / "src/server/electron/index.ts").read_text()
old_gp = """  getPath(name: string): string {
    log("app.getPath", [name]);
    return process.cwd();
  },
"""
new_gp = """  getPath(name: string): string {
    log("app.getPath", [name]);
    const home = process.env.HOME || "/home/user";
    const persist = process.env.CODEX_WEB_USERDATA || home + "/app-data";
    const tmp = process.env.CODEX_WEB_CACHE || "/var/tmp/codex-electron";
    switch (name) {
      case "home":
        return home;
      case "temp":
      case "cache":
      case "userCache":
      case "crashDumps":
        return tmp;
      case "logs":
        return tmp + "/logs";
      case "desktop":
      case "documents":
      case "downloads":
      case "music":
      case "pictures":
      case "videos":
        return home;
      default:
        return persist;
    }
  },
"""
if old_gp not in elec:
    raise SystemExit("patch fail: electron getPath")
elec = elec.replace(old_gp, new_gp, 1)
(root / "src/server/electron/index.ts").write_text(elec)

# smaller, faster webview preload bundle
vite = (root / "vite.browser.config.ts").read_text()
vite = vite.replace("minify: false,", "minify: true,", 1)
vite = vite.replace("sourcemap: true,", "sourcemap: false,", 1)
(root / "vite.browser.config.ts").write_text(vite)

print("hf patches applied")
PY

RUN python3 /opt/apply-hf-patches.py \
 && cd /opt/codex-web \
 && npm install --omit=dev \
 && npm install -g @openai/codex \
 && npm cache clean --force \
 && chmod -R a+rX /opt/codex-web /opt/npm-global

FROM node:24-slim

ENV NPM_CONFIG_PREFIX=/opt/npm-global \
    NPM_CONFIG_UPDATE_NOTIFIER=false \
    NPM_CONFIG_FUND=false \
    NPM_CONFIG_AUDIT=false \
    PATH=/opt/npm-global/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
    NODE_ENV=production \
    NODE_OPTIONS=--dns-result-order=ipv4first

RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      ca-certificates curl wget git tini sudo gosu \
      python3 python3-pip python3-venv python3-dev \
      gcc g++ make cmake pkg-config \
      unzip zip \
      libssl-dev libffi-dev \
      procps bash \
      ripgrep fd-find \
 && rm -rf /var/lib/apt/lists/* \
 && ln -sf "$(command -v fdfind || true)" /usr/local/bin/fd || true \
 && groupmod -n user node \
 && usermod -l user -d /home/user -m node \
 && usermod -aG sudo user \
 && mkdir -p /home/user/app /data /var/tmp/codex-ephemeral /opt/npm-global \
 && echo "user ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/user \
 && chmod 440 /etc/sudoers.d/user \
 && chown -R user:user /home/user /data /var/tmp/codex-ephemeral

COPY --from=build /opt/codex-web /opt/codex-web
COPY --from=build /opt/npm-global /opt/npm-global
RUN chown -R user:user /opt/npm-global \
 && chmod -R a+rX /opt/codex-web /opt/npm-global

COPY --chmod=0755 <<'EOF' /usr/local/bin/entrypoint
#!/usr/bin/env bash
set -euo pipefail

DATA_DIR="/data"
EPHEM="/var/tmp/codex-ephemeral"
mkdir -p "$EPHEM" /var/tmp/codex-electron /tmp

log() { echo "[entrypoint] $*"; }

# Persist $HOME onto the bucket; never ls/du/rm -rf large FUSE trees on the boot path.
if [ -w "$DATA_DIR" ]; then
  log "storage bucket detected at $DATA_DIR — persisting the entire home directory."
  PERSIST_HOME="$DATA_DIR/home"
  mkdir -p "$PERSIST_HOME"

  LISTING="$(timeout 8 ls -A "$PERSIST_HOME" 2>/dev/null || true)"
  if [ -z "$LISTING" ]; then
    log "bucket looks empty — seeding from the image's baked-in \$HOME"
    timeout 60 cp -a /home/user/. "$PERSIST_HOME"/ 2>/dev/null \
      || log "WARNING: seed copy timed out or failed — continuing"
  fi
  export HOME="$PERSIST_HOME"
else
  log "WARNING: no writable storage bucket at $DATA_DIR — EPHEMERAL storage, lost on restart."
  log "Attach a bucket at mount path '/data', Access: Read & Write, in Settings -> Storage."
  export HOME="${HOME:-/home/user}"
fi

# If started as root: chown the persist tree, bind-mount /usr/local, then re-exec as uid 1000
# before any Codex files are written so bucket objects are not stuck root-owned.
if [ "$(id -u)" = "0" ] && [ "${1:-}" != "--as-user" ]; then
  mkdir -p "$HOME/.usr-local" "$HOME/.local" "$HOME/.codex" "$HOME/app-data"
  chown user:user "$HOME" "$HOME/.usr-local" "$HOME/.local" "$HOME/.codex" "$HOME/app-data" 2>/dev/null || true
  if [ -z "$(timeout 5 ls -A "$HOME/.usr-local" 2>/dev/null || true)" ]; then
    timeout 30 cp -a /usr/local/. "$HOME/.usr-local"/ 2>/dev/null || true
    chown -R user:user "$HOME/.usr-local" 2>/dev/null || true
  fi
  if mount --bind "$HOME/.usr-local" /usr/local 2>/dev/null; then
    log "bind-mounted \$HOME/.usr-local -> /usr/local (compilers you install here persist)"
  else
    log "could not bind-mount /usr/local (no CAP_SYS_ADMIN) — use \$HOME/.local instead"
  fi
  log "dropping privileges to user uid 1000"
  exec gosu user "$0" --as-user
fi

export CODEX_HOME="$HOME/.codex"
mkdir -p "$CODEX_HOME" "$HOME/.local/bin" "$HOME/.local/lib" "$HOME/app-data" "$HOME/.usr-local"

if ! timeout 15 touch "$HOME/.write-probe" 2>/dev/null; then
  log "FATAL: $HOME is not writable by uid $(id -u) (or the bucket didn't respond within 15s)."
  log "Check Settings -> Storage: Access mode must be Read & Write, then do a full Restart."
  exit 1
fi
rm -f "$HOME/.write-probe" || true

# Divert only Codex runtime bloat onto fast local disk; the rest of $HOME stays on the bucket.
# Symlink, not env-var: Codex hardcodes ~/.cache/codex-runtimes and ignores XDG_CACHE_HOME.
divert_to_ephemeral() {
  local src="$1"
  local dest="$2"
  mkdir -p "$(dirname "$src")" "$dest"
  if [ -L "$src" ]; then
    ln -sfn "$dest" "$src"
    return 0
  fi
  if [ -e "$src" ]; then
    local stale="${src}.STALE.$$"
    if mv "$src" "$stale" 2>/dev/null; then
      log "moved existing $(basename "$src") off the live path — deleting in background"
      ( nice rm -rf "$stale" >/dev/null 2>&1 || true ) &
    else
      log "WARNING: could not rename $src — leaving it and still linking"
    fi
  fi
  ln -sfn "$dest" "$src"
}

mkdir -p "$HOME/.cache" "$HOME/.local/state/codex"
divert_to_ephemeral "$HOME/.cache/codex-runtimes"            "$EPHEM/codex-runtimes"
divert_to_ephemeral "$HOME/.cache/codex-primary-runtime"     "$EPHEM/codex-primary-runtime"
divert_to_ephemeral "$HOME/.local/state/codex/logs"          "$EPHEM/codex-logs-xdg"

if compgen -G "$HOME/.cache/codex-runtimes.STALE*" >/dev/null \
   || compgen -G "$HOME/.cache/codex-primary-runtime.STALE*" >/dev/null; then
  log "sweeping leftover STALE runtime dirs in the background"
  ( nice rm -rf "$HOME/.cache"/codex-runtimes.STALE* \
                 "$HOME/.cache"/codex-primary-runtime.STALE* >/dev/null 2>&1 || true ) &
fi

# Do NOT export XDG_CACHE_HOME / XDG_STATE_HOME to /tmp — that would throw
# non-Codex caches (pip, huggingface, etc.) off the bucket too.
export CODEX_WEB_USERDATA="$HOME/app-data"
export CODEX_WEB_CACHE="/var/tmp/codex-electron"
export PYTHONUSERBASE="$HOME/.local"
export PIP_USER=1
export npm_config_prefix="$HOME/.local"
export NPM_CONFIG_PREFIX="$HOME/.local"
export CARGO_HOME="$HOME/.cargo"
export RUSTUP_HOME="$HOME/.rustup"
export GOPATH="$HOME/go"
export PATH="$HOME/.local/bin:$HOME/.cargo/bin:$HOME/go/bin:/opt/npm-global/bin:$PATH"

mkdir -p "$HOME/.local/bin" "$CARGO_HOME/bin" "$GOPATH/bin" "$CODEX_WEB_USERDATA"

# Codex CLI: image ships a working binary; only install if missing.
if ! command -v codex >/dev/null 2>&1; then
  log "codex missing from PATH — installing latest into \$HOME/.local ..."
  npm install -g @openai/codex \
    || { log "FATAL: could not install @openai/codex"; exit 1; }
fi

export CODEX_CLI_PATH="$(command -v codex)"
if [ -z "${CODEX_CLI_PATH}" ]; then
  log "FATAL: 'codex' isn't on PATH."
  exit 1
fi
log "codex: $($CODEX_CLI_PATH --version 2>/dev/null || echo unknown) at $CODEX_CLI_PATH"

if [ -n "${OPENAI_API_KEY:-}" ] && [ ! -f "$CODEX_HOME/auth.json" ]; then
  log "logging in to Codex from \$OPENAI_API_KEY ..."
  printenv OPENAI_API_KEY | codex login --with-api-key \
    || log "WARNING: codex login failed — check that OPENAI_API_KEY is valid."
elif [ -z "${OPENAI_API_KEY:-}" ] && [ ! -f "$CODEX_HOME/auth.json" ]; then
  log "WARNING: no OPENAI_API_KEY and no existing login — Codex won't be usable until set."
fi

(
  set +e
  sleep 8
  LATEST="$(timeout 40 npm view @openai/codex version 2>/dev/null || true)"
  CURRENT="$(codex --version 2>/dev/null | awk '{print $NF}' || true)"
  if [ -n "$LATEST" ] && [ -n "$CURRENT" ] && [ "$LATEST" != "$CURRENT" ]; then
    log "codex: $CURRENT -> $LATEST (background, into \$HOME/.local)"
    npm install -g "@openai/codex@${LATEST}" \
      && log "codex: now $(codex --version 2>/dev/null)"
  fi
) &

(
  set +e
  SEL="$HOME/.dpkg-selections"
  if [ -f "$SEL" ] && command -v sudo >/dev/null 2>&1; then
    log "replaying persisted apt selections in the background"
    timeout 90 sudo apt-get update -qq
    timeout 300 sudo dpkg --set-selections < "$SEL"
    timeout 600 sudo apt-get dselect-upgrade -y -qq
  fi
  while true; do
    if command -v dpkg >/dev/null 2>&1; then
      dpkg --get-selections > "$SEL.tmp" 2>/dev/null && mv "$SEL.tmp" "$SEL"
    fi
    sleep 180
  done
) &

cd "$CODEX_WEB_USERDATA"
log "serving on 0.0.0.0:7860 — no auth in front of this (codex-web has none by design)"
exec node /opt/codex-web/src/server/main.js --host 0.0.0.0 --port 7860
EOF

ENV HOME=/home/user
WORKDIR /home/user/app

EXPOSE 7860

ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/entrypoint"]