feat: add the StackRox CI sandbox profile by robbycochran · Pull Request #183 · stackrox/harness-openshell

robbycochran · 2026-09-12T22:13:52Z

Summary

Adds the second StackRox image profile on top of the NVIDIA image PR.

Adds sandbox-stackrox-ci based on the pinned StackRox Apollo/rox-ci-image builder image.
Vendors only the OpenShell assets needed by this profile.
Includes the ACS triage toolchain, coding agents, GitHub skill, Atlassian MCP, Google Workspace CLI, and gopls.
Publishes the profile for linux/amd64 because the current bundled downloads are amd64-only.

Dependent on the root NVIDIA/default image PR so the profile and matrix changes can be reviewed in order.

coderabbitai · 2026-09-12T22:14:18Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: fb5175ad-b3e4-416e-9401-3a8d3d20742c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

stackrox-openshell-workflow · 2026-09-12T22:21:04Z

+    && tar -xzf /tmp/gh.tgz --strip-components=2 -C /tmp/gh-extract "gh_${GH_VERSION}_linux_amd64/bin/gh" \
+    && test -f /tmp/gh-extract/gh \
+    && install -m 0755 /tmp/gh-extract/gh /usr/bin/gh \
+    && rm -rf /tmp/gh-extract /tmp/gh.tgz


The specified GitHub CLI version 2.100.0 does not exist, which will cause the build to fail when it tries to download it. The latest version is significantly lower. Please correct the GH_VERSION to a valid, existing version number.

Skipped: this finding is incorrect. GitHub CLI v2.100.0 exists, and the image build fetched it successfully with the pinned checksum. No version change is needed.

stackrox-openshell-workflow · 2026-09-12T22:21:04Z

+ARG CLAUDE_SHA256_AMD64=25e44883f54419569a3d739f38cbbdaebe83b09895da0f343e1b003710a4775b
+RUN curl -fsSL "https://downloads.claude.ai/claude-code-releases/${CLAUDE_VERSION}/linux-x64/claude" -o /tmp/claude \
+    && echo "${CLAUDE_SHA256_AMD64}  /tmp/claude" | sha256sum -c - \
+    && install -m 0755 /tmp/claude /usr/local/bin/claude \


The symlink from /usr/bin/opencode to /usr/local/bin/opencode seems overly complex. To "keep the profile's command path stable," the opencode binary could be installed directly into /usr/local/bin instead of being copied to /usr/bin and then symlinked. This would simplify the Dockerfile.

Resolved in dacc7ff: the npm-installed executables are copied directly to /usr/local/bin, so the extra opencode symlink is gone.

stackrox-openshell-workflow · 2026-09-12T22:22:22Z

+        "@openai/codex@${NPM_CODEX_VERSION}" \
+        "@github/copilot@${NPM_COPILOT_VERSION}" \
+        "ajv-cli@${NPM_AJV_VERSION}" \
+    && npm cache clean --force


The tar npm package is installed globally but it does not seem to be used. The Dockerfile includes special logic to avoid overwriting the system's tar binary with the one from the npm package. If this package is a dependency for another package, npm will handle it automatically when that package is installed. If it is not needed, it should be removed to reduce image size and complexity.

Resolved in dacc7ff: the explicit tar npm package was removed. The image keeps the system GNU tar from the base package set for archive extraction.

stackrox-openshell-workflow · 2026-09-12T22:22:22Z

+    && tar -xzf /tmp/gh.tgz --strip-components=2 -C /tmp/gh-extract "gh_${GH_VERSION}_linux_amd64/bin/gh" \
+    && test -f /tmp/gh-extract/gh \
+    && install -m 0755 /tmp/gh-extract/gh /usr/bin/gh \
+    && rm -rf /tmp/gh-extract /tmp/gh.tgz


The specified GitHub CLI version 2.100.0 does not exist, which will cause the build to fail when it tries to download it. The latest version is significantly lower. Please correct the GH_VERSION to a valid, existing version number.

Skipped: this is the same incorrect GitHub CLI version finding. v2.100.0 exists and the pinned download/checksum passed in CI.

stackrox-openshell-workflow · 2026-09-12T22:22:22Z

+ARG CLAUDE_SHA256_AMD64=25e44883f54419569a3d739f38cbbdaebe83b09895da0f343e1b003710a4775b
+RUN curl -fsSL "https://downloads.claude.ai/claude-code-releases/${CLAUDE_VERSION}/linux-x64/claude" -o /tmp/claude \
+    && echo "${CLAUDE_SHA256_AMD64}  /tmp/claude" | sha256sum -c - \
+    && install -m 0755 /tmp/claude /usr/local/bin/claude \


The symlink from /usr/bin/opencode to /usr/local/bin/opencode seems overly complex. To "keep the profile's command path stable," the opencode binary could be installed directly into /usr/local/bin instead of being copied to /usr/bin and then symlinked. This would simplify the Dockerfile.

Resolved in dacc7ff: the npm-installed executables are copied directly to /usr/local/bin, so the extra opencode symlink is gone.

stackrox-openshell-workflow · 2026-09-12T22:23:08Z

+    && tar -xzf /tmp/gh.tgz --strip-components=2 -C /tmp/gh-extract "gh_${GH_VERSION}_linux_amd64/bin/gh" \
+    && test -f /tmp/gh-extract/gh \
+    && install -m 0755 /tmp/gh-extract/gh /usr/bin/gh \
+    && rm -rf /tmp/gh-extract /tmp/gh.tgz


The specified GitHub CLI version 2.100.0 does not exist, which will cause the build to fail when it tries to download it. The latest version is significantly lower. Please correct the GH_VERSION to a valid, existing version number.

Skipped: this is the duplicate GitHub CLI version finding. v2.100.0 exists and the pinned download/checksum passed in CI.

stackrox-openshell-workflow · 2026-09-12T22:29:14Z

+    && rm -rf /tmp/npm-global
+
+# Claude Code's native binary. Pin both the release URL and its release
+# manifest checksum instead of executing a downloaded installer as root.


This tar --version check seems out of place and unnecessary. It is executed in a sequence of commands for cleaning up temporary npm installation files and has no apparent connection to them. Consider removing it for clarity.

Resolved in the current head: the redundant tar --version assertion was removed now that npm installs run in the sandbox prefix and only the expected CLI binaries are copied.

stackrox-openshell-workflow · 2026-09-12T22:29:41Z

+    && rm -rf /tmp/npm-global
+
+# Claude Code's native binary. Pin both the release URL and its release
+# manifest checksum instead of executing a downloaded installer as root.


This tar --version check seems out of place and unnecessary. It is executed in a sequence of commands for cleaning up temporary npm installation files and has no apparent connection to them. Consider removing it for clarity.

Resolved in the current head: the redundant tar --version assertion was removed now that npm installs run in the sandbox prefix and only the expected CLI binaries are copied.

stackrox-openshell-workflow · 2026-09-12T22:45:03Z

+RUN cp -a /tmp/npm-global/lib/node_modules/. /usr/lib/node_modules/ \
+    && for name in opencode codex copilot ajv; do \
+         test -e "/tmp/npm-global/bin/${name}"; \
+         cp -a "/tmp/npm-global/bin/${name}" "/usr/local/bin/${name}"; \


The cp -a command on line 103 copies the npm-created binaries as relative symlinks. When placed in /usr/local/bin, these symlinks will be broken because they expect to find the node_modules directory at a relative path (e.g., ../lib/node_modules) which is not correct for the final /usr/lib/node_modules destination. The executables will fail to run.

Consider either adjusting the destination paths to preserve the relative layout or recreating the symlinks to use absolute paths.

Resolved in the current head: the npm-created symlinks are copied to /usr/bin, where their ../lib/node_modules targets resolve to /usr/lib/node_modules. This preserves the installed CLI paths without a second opencode symlink.

stackrox-openshell-workflow · 2026-09-12T22:46:13Z

+RUN GOBIN=/usr/local/bin /usr/local/go/bin/go install "golang.org/x/tools/gopls@v${GOPLS_VERSION}" \
+    && rm -rf /root/go /root/.cache/go-build
+
+# Atlassian MCP is part of the StackRox workflow image contract. The gateway


The go install command on line 124 uses the default GOPATH and GOCACHE for the root user. While the rm command on the next line attempts to clean this up, it is brittle because it assumes the default locations. The rest of the Dockerfile sets GOPATH and other Go environment variables for the sandbox user.\n\nIt would be more robust to explicitly set GOPATH and GOCACHE to temporary locations for this go install command, ensuring that no build artifacts are left in the home directory of the root user. For example:\n\ndockerfile\nRUN GOPATH=\$(mktemp -d) GOCACHE=\$(mktemp -d) GOBIN=/usr/local/bin /usr/local/go/bin/go install "golang.org/x/tools/gopls@v${GOPLS_VERSION}"\n\n\nThis ensures the build is self-contained and does not rely on implicit user-specific Go environment defaults.

Resolved in the current head: the gopls install now uses isolated /tmp/gopath and /tmp/gocache directories and removes both after installation.

stackrox-openshell-workflow · 2026-09-12T22:46:43Z

@@ -27,7 +39,7 @@ jobs:
        run: |
          if [[ "$GITHUB_REF_TYPE" == tag || -z "$BASE_SHA" || "$BASE_SHA" =~ ^0+$ ]]; then
            changed=true


The ${IMAGE_PROFILE} variable is not quoted. If the profile name contained spaces or shell metacharacters, this command would be vulnerable to word splitting and globbing, which could lead to unexpected behavior or command injection. It should be double-quoted: ... "profiles/stackrox/image/${IMAGE_PROFILE}" ...

Skipped: the expression is already quoted in the workflow as "profiles/stackrox/image/${IMAGE_PROFILE}"; this finding targets a stale/unquoted view of the file.

stackrox-openshell-workflow · 2026-09-12T22:50:53Z

+
+# Use the same uv-managed Python contract as the community base image. The
+# rox-ci-image system Python is 3.9, while current MCP integrations require
+# 3.10+.


The specified Python version 3.14.3 is not a valid Python release. This will cause the build to fail at the uv python install step. Please use a valid and existing Python version.

Skipped: this is another incorrect version finding. uv python install 3.14.3 completed successfully in the image build; the pinned version is intentional.

stackrox-openshell-workflow · 2026-09-12T22:50:54Z

+# GitHub CLI (rox-ci-image does not include it). Pin the release and verify it
+# before installing so the image remains reproducible.
+ARG GH_VERSION=2.100.0
+ARG GH_SHA256_AMD64=e4d4bb4498e8d007abe545b6568926793ace1b6447da598294a610018cb164be


The specified gh CLI version 2.100.0 appears to be invalid. GitHub CLI versions follow a X.Y.Z format (e.g., 2.50.0). This will likely cause the curl command to fail with a 404 error. Please verify the version number.

Skipped: this repeats the incorrect GitHub CLI finding. v2.100.0 exists and the pinned download/checksum completed successfully in CI.

stackrox-openshell-workflow · 2026-09-12T22:50:54Z

+         cp -a "/tmp/npm-global/bin/${name}" "/usr/bin/${name}"; \
+         chown -h root:root "/usr/bin/${name}"; \
+       done \
+    && chown -R root:root /usr/lib/node_modules \


The @hono/node-server package is installed, but its binary (hono) is not copied from /tmp/npm-global/bin to /usr/bin in the subsequent loop. This will make the hono command unavailable in the final image. The hono binary should be added to the loop.

Skipped: @hono/node-server version 1.19.11 has no bin entry (npm view @hono/node-server@1.19.11 bin returns no executable). It is installed as a Node module dependency, not a hono CLI.

robbycochran added the ai-review Opt in to artifact-only AI review on each PR head update label Sep 12, 2026

stackrox-openshell-workflow Bot reviewed Sep 12, 2026

View reviewed changes

robbycochran added 2 commits September 12, 2026 15:25

feat: add StackRox CI sandbox image

e63f0dc

simplify StackRox CI npm tool installation

c9fc1a4

robbycochran force-pushed the reopen/stackrox-ci-image branch from dacc7ff to c9fc1a4 Compare September 12, 2026 22:25

stackrox-openshell-workflow Bot reviewed Sep 12, 2026

View reviewed changes

simplify StackRox CI npm cleanup

9725834

stackrox-openshell-workflow Bot reviewed Sep 12, 2026

View reviewed changes

fix: preserve npm CLI symlink targets

da6eaa0

stackrox-openshell-workflow Bot reviewed Sep 12, 2026

View reviewed changes

Uh oh!

Conversation

robbycochran commented Sep 12, 2026

Summary

Uh oh!

coderabbitai Bot commented Sep 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

coderabbitai Bot commented Sep 12, 2026 •

edited

Loading