feat: shared read-only toolchain volumes (one copy of Go/Rust/JDK for all projects) - #20
Open
ai-anant wants to merge 1 commit into
Open
feat: shared read-only toolchain volumes (one copy of Go/Rust/JDK for all projects)#20ai-anant wants to merge 1 commit into
ai-anant wants to merge 1 commit into
Conversation
… all projects) Go/Rust/Java toolchains were baked into every project image (~1-2GB each, compiled from source for gosec/cargo-audit). Move them to ONE shared named volume (aidc_toolchains), populated once and mounted READ-ONLY into every project container at /opt/toolchains — the 'mount snapshots of pre-verified tools as shared read-only memory' idea. - templates/devcontainer/Dockerfile.toolchain.tmpl (new): builds a store image per toolchain (go1.26.5 + gosec, rustup stable + cargo-audit, Temurin 21 + nothing) into /opt/toolchains-store, then copies into the volume when run. Pinned versions; content-hashed image tag. - lib/aidc.sh: aidc tools <install [go|rust|java|all]|status> manages the volume; ensure_toolchain_volumes auto-populates on up/rebuild/rescan and before tool commands. - Dockerfile.tmpl: go/rust/java arms are now no-ops (volume provides them); PATH + GOROOT/RUSTUP_HOME/JAVA_HOME point at /opt/toolchains. - compose.yaml.tmpl: aidc_toolchains volume mounted read_only at /opt/toolchains. Verified end-to-end: store image builds, volume populates, go1.26.5 + gosec run from the mounted volume, and the read-only mount rejects writes. Refs cyfinoid#9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Go/Rust/Java toolchains were baked into every project image —
golang-goapt (~1 GB), rustup stable + compiledcargo-audit(~1.5–2 GB),default-jdk(~400 MB), each rebuilt per project. This PR moves them to one shared named volume (aidc_toolchains), populated once and mounted read-only into every project container at/opt/toolchains.This is the core of the "mount snapshots of pre-verified tools as shared read-only memory, one copy of Python serves 10,000 sandboxes" idea from https://x.com/AlexJonesax/status/2083617647342600591:
docker volume rm aidc_toolchains && aidc tools installrepopulates and a bad toolchain disappears from every container.Changes
templates/devcontainer/Dockerfile.toolchain.tmpl(new) — per-toolchain store image:go: Go 1.26.5 tarball +gosec(prebuilt viago install)rust: rustup stable (minimal profile) +cargo-audit(prebuilt viacargo install)java: Temurin 21 (pinnedjdk-21.0.12+8)/opt/toolchains-store/<lang>, writes a.aidc-readymarker, and when run with the volume mounted copies the toolchain into it. Pinned versions; content-hashed image tag (aidc-toolchain-store-<lang>:<hash>).lib/aidc.shaidc tools install [go|rust|java|all]— build store image once + populate volume once.aidc tools status— show which shared toolchains are installed.aidc::ensure_toolchain_volumes— auto-ensures the toolchains a project needs; wired intocmd_up,cmd_rebuild,cmd_rescan,ensure_container_runningbefore the compose build.AIDC_TOOLCHAIN_VOLUMEenv override for the volume name.templates/devcontainer/Dockerfile.tmpl—go/rust/javatoolchain arms are now no-ops (the volume provides them);ENV PATH+GOROOT/RUSTUP_HOME/JAVA_HOMEpoint at/opt/toolchains/*.templates/devcontainer/compose.yaml.tmpl—aidc_toolchainsnamed volume mountedread_onlyat/opt/toolchains.README.md/docs/install.md— documentaidc toolsand the shared-volume model.Verification (measured)
gobuilds; volume populates;go version go1.26.5 linux/arm64runs from the mounted volume;go,gofmt,gosecall present;.aidc-readymarker written.touch /opt/toolchains/go/evil→Read-only file system.bash -n(bash 5 + 3.2),shellcheck -x, bash-3.2 compat,tests/resolve-oauth-token.test.sh(7/7) — clean.Merge note
Touches the same toolchain block as #15/#16/#17/#18 — expect small conflicts if merged before those; the toolchain arms are self-contained per PR.
AIDC_AGENTS/AIDC_BASE_IMAGEinteractions are documented in the respective PRs.Closes #9