Claude
7a5823cb2b
Build App / compute-version (pull_request) Successful in 6s
Build App / build-macos (pull_request) Successful in 2m30s
Build App / build-windows (pull_request) Successful in 5m16s
Build Container / build-container (pull_request) Successful in 10m15s
Build App / build-linux (pull_request) Successful in 6m35s
Build App / create-tag (pull_request) Skipped
Build App / sync-to-github (pull_request) Skipped
Behind a TLS-terminating corporate proxy every HTTPS call inside a container fails — npm, pip, git, curl, the browser-view pane, and Claude Code's own API requests. There was no mechanism at all: installing the certificate by hand inside a container is lost on Reset and had to be repeated per project. A global CA path in AppSettings with a per-project override on Project, taking either a single certificate file or a directory. It is bind-mounted read-only at /tmp/.host-ca (mirroring /tmp/.host-ssh and /tmp/.host-aws) and applied by entrypoint.sh on every start, so it survives recreation, migration and Reset. Four things this gets right that are easy to get wrong: * update-ca-certificates globs *.crt case-sensitively, so a .pem that is merely copied in is ignored in silence. Certificates are renamed, by container_cert_name() in Rust and a mirrored few lines of shell. * The system store only serves curl/git/apt. Node — and so Claude Code itself — needs NODE_EXTRA_CA_CERTS, Python needs REQUESTS_CA_BUNDLE/SSL_CERT_FILE, and Chromium reads neither: it wants ~/.pki/nssdb, seeded with certutil (libnss3-tools, added to the image). * Those vars are set from Rust at creation, never exported by the entrypoint — a terminal is a docker exec and sees nothing the entrypoint exported. They are emitted empty when no CA is configured, since docker commit bakes env into the snapshot image. * triple-c.ca-fingerprint hashes the certificate bytes as well as the path, so a CA rotated in at the same location still forces a recreation. Verified end to end against a real container and a self-signed CA: curl, node, python and git all complete a TLS handshake against a server signed by it and all three fail in the same container without it; the env vars are visible from a docker exec session; the store is cleaned when the setting is cleared. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KSP2KNPhuWKQ4DL5TZEn3k
30 lines
707 B
Rust
30 lines
707 B
Rust
pub mod ca_certs;
|
|
pub mod client;
|
|
pub mod container;
|
|
pub mod image;
|
|
pub mod exec;
|
|
pub mod gateway;
|
|
pub mod legacy_cleanup;
|
|
pub mod migration;
|
|
pub mod stt;
|
|
|
|
#[allow(unused_imports)]
|
|
pub use gateway::*;
|
|
#[allow(unused_imports)]
|
|
pub use stt::*;
|
|
#[allow(unused_imports)]
|
|
pub use client::*;
|
|
#[allow(unused_imports)]
|
|
pub use container::*;
|
|
#[allow(unused_imports)]
|
|
pub use image::*;
|
|
#[allow(unused_imports)]
|
|
pub use exec::*;
|
|
#[allow(unused_imports)]
|
|
pub use legacy_cleanup::*;
|
|
#[allow(unused_imports)]
|
|
pub use migration::*;
|
|
// Deliberately *not* re-exported flat: `ca_certs::resolve` and
|
|
// `ca_certs::CA_MOUNT_DIR` are far clearer than bare `resolve` in a module that
|
|
// already re-exports five other namespaces.
|