dtoro
b37f85ae08
Root cause of "asks permission but never acts": the approved pct_create execution failed to parse because the LLM emitted `"privileged":0` / `"nesting":1` (numbers) into strict `bool` fields, so the container was never created. Compounded by a hardcoded template name (debian-13.0-1) that no longer exists on the host, and no way for the agent to read the web. - flexBool: accept 0/1, "true", bool for privileged/nesting (the exact prod failure) - pct_create template pre-flight: list host cache, validate/auto-pick newest debian - pct_create services[] + post_install: one approval provisions a working service - new http_get MCP tool (sanitized, size-capped, SSRF-guarded) — agent can read repos/sites - request_execution description: target=host, full JSON schema + example - SOUL.md: agent CAN fetch the web; prefer one-step provisioning - default model deepseek-v4-flash -> v4-pro; maxIterations 15 -> 25 - unit tests for flexBool, template resolve, pkg sanitize, HTML sanitize + SSRF block Verified live on host:strong with a throwaway VMID 999: template auto-resolved, container created + booted, services installed, post_install ran, then destroyed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
27 lines
578 B
Docker
27 lines
578 B
Docker
# Nomos agent container — standalone MCP client gateway (Phase 4)
|
|
FROM golang:1.26-alpine AS builder
|
|
|
|
RUN apk add --no-cache git ca-certificates
|
|
|
|
WORKDIR /build
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
RUN CGO_ENABLED=0 go build -o /nomos -tags timetzdata -ldflags="-s -w" ./cmd/nomos
|
|
|
|
FROM gcr.io/distroless/static:nonroot
|
|
|
|
COPY --from=builder /nomos /nomos
|
|
COPY nomos/ /app/nomos/
|
|
|
|
ENV NOMOS_MCP_URL=http://api:8090/mcp
|
|
ENV NOMOS_AGENT_SLUG=agent:nomos
|
|
ENV NOMOS_LISTEN=:8092
|
|
ENV NOMOS_MODEL=deepseek/deepseek-v4-pro
|
|
|
|
EXPOSE 8092
|
|
|
|
ENTRYPOINT ["/nomos", "serve"]
|