Boot the sandbox image with the drukbox base entrypoint

.github/workflows/on-pull-request-images.yml

@@ -36,27 +36,21 @@ jobs:
           load: true
           tags: druks-sandbox:pr
           cache-from: type=gha,scope=sandbox
-      - name: Boot installs the proxy CA, the git helper, and the druks key
+      # dgoss boots the image the way the drukbox docker provider does and
+      # checks deploy/sandbox/goss.yaml inside it.
+      - name: Validate the sandbox image
+        env:
+          GOSS_VERSION: 0.4.10
+          GOSS_FILES_PATH: deploy/sandbox
+          GOSS_OPTS: -r 30s -s 1s --format documentation
         run: |
-          ssh-keygen -t ed25519 -f "$RUNNER_TEMP/sandbox" -N '' -q
-          openssl req -x509 -newkey rsa:2048 -keyout "$RUNNER_TEMP/ca.key" \
-            -out "$RUNNER_TEMP/ca.crt" -days 1 -nodes -subj "/CN=drukbox-pr-ca"
-          SECRETS_PROXY_CA="$(base64 -w0 "$RUNNER_TEMP/ca.crt")"
-          docker run -d --name sandbox-boot \
-            -e "DRUKBOX_AUTHORIZED_KEY=$(cat "$RUNNER_TEMP/sandbox.pub")" \
-            -e "SECRETS_PROXY_CA=$SECRETS_PROXY_CA" \
-            -e GH_TOKEN=placeholder \
+          curl -fsSL "https://github.com/goss-org/goss/releases/download/v$GOSS_VERSION/goss_${GOSS_VERSION}_linux_x86_64.tar.gz" \
+            | tar -xz -C "$RUNNER_TEMP" goss
+          curl -fsSL -o "$RUNNER_TEMP/dgoss" "https://github.com/goss-org/goss/releases/download/v$GOSS_VERSION/dgoss"
+          chmod +x "$RUNNER_TEMP/dgoss"
+          GOSS_PATH="$RUNNER_TEMP/goss" "$RUNNER_TEMP/dgoss" run \
+            -e DRUKBOX_SSH_USER=druks -e 'DRUKBOX_AUTHORIZED_KEY=ssh-ed25519 AAAA goss' \
             druks-sandbox:pr
-          sleep 5
-          docker inspect -f '{{.State.Running}}' sandbox-boot | grep -x true
-          docker exec -e "SECRETS_PROXY_CA=$SECRETS_PROXY_CA" sandbox-boot sh -ec '
-            printf %s "$SECRETS_PROXY_CA" | base64 -d > /tmp/expected.crt
-            openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt /tmp/expected.crt
-          '
-          docker exec sandbox-boot git config --system --get-all credential.https://github.com.helper \
-            | grep -Fx '!gh auth git-credential'
-          docker exec sandbox-boot cat /home/druks/.ssh/authorized_keys \
-            | grep -Fx "$(cat "$RUNNER_TEMP/sandbox.pub")"
 
   # The Docker Sandboxes template must keep its base's boot contract after
   # the toolchain layers: `sbx create` sends no environment variables, drukbox

deploy/sandbox/Dockerfile

@@ -5,10 +5,11 @@
 # the same tool layers to whichever base ``BASE`` selects:
 #
 #   - ``sandbox`` (the default target, on ``docker-base``) serves the drukbox
-#     docker provider, published as ghcr.io/czpython/druks/sandbox. It swaps
-#     the base entrypoint to seed the non-root ``druks`` user because Claude
-#     Code refuses ``--permission-mode bypassPermissions`` as root. Point
-#     DRUKS_SANDBOX_IMAGE at it and run drukbox with DOCKER_SSH_USERNAME=druks.
+#     docker provider, published as ghcr.io/czpython/druks/sandbox. It adds
+#     the non-root ``druks`` user because Claude Code refuses
+#     ``--permission-mode bypassPermissions`` as root; the base entrypoint
+#     seeds that user's key when drukbox runs with DOCKER_SSH_USERNAME=druks.
+#     Point DRUKS_SANDBOX_IMAGE at it.
 #   - ``sbx`` (build with ``--build-arg BASE=sbx-base``) serves the drukbox
 #     docker-sbx provider as a Docker Sandboxes template, published as
 #     ghcr.io/czpython/druks/sandbox-sbx. The base's env-free entrypoint and
@@ -20,7 +21,7 @@
 # Both targets are published by .github/workflows/publish-sandbox-image.yml.
 ARG BASE=docker-base
 
-FROM ghcr.io/czpython/drukbox/sandbox:latest@sha256:72c6ab246c53481051d8d4ec9ed34e9aff47f539f989f625cf20ba82e9b3f311 AS docker-base
+FROM ghcr.io/czpython/drukbox/sandbox:latest@sha256:cccf324cada9c1b0df409858dac8188e0ed2591ed88ee3d5fb59db9055a75244 AS docker-base
 FROM ghcr.io/czpython/drukbox/sbx-sandbox:latest@sha256:ab08421818ad21ed7a8a9db6f5c184a754c4ab6c85c26877983c245dbcd34bcf AS sbx-base
 
 FROM ${BASE} AS toolchain
@@ -64,10 +65,5 @@ RUN useradd --create-home --shell /bin/bash druks
 FROM toolchain AS sbx
 
 # Docker provider image, the default target: ``docker build deploy/sandbox``
-# builds this one.
+# builds this one. The toolchain as is: the base entrypoint boots it.
 FROM toolchain AS sandbox
-
-COPY entrypoint.sh /usr/local/bin/druks-sandbox-entrypoint
-RUN chmod +x /usr/local/bin/druks-sandbox-entrypoint
-
-ENTRYPOINT ["/usr/local/bin/druks-sandbox-entrypoint"]

deploy/sandbox/goss.yaml

@@ -0,0 +1,17 @@
+# The boot contract of the sandbox image: the drukbox base entrypoint seeds
+# the ``druks`` user this image adds. dgoss checks it in CI with
+# DRUKBOX_SSH_USER=druks and DRUKBOX_AUTHORIZED_KEY="ssh-ed25519 AAAA goss".
+file:
+  /home/druks/.ssh/authorized_keys:
+    exists: true
+    mode: "0600"
+    owner: druks
+    group: druks
+    contents:
+      - ssh-ed25519 AAAA goss
+process:
+  sshd:
+    running: true
+port:
+  tcp:22:
+    listening: true