feat: add the Collector builder sandbox profile by robbycochran · Pull Request #184 · stackrox/harness-openshell

robbycochran · 2026-09-12T22:13:56Z

Summary

Adds a Collector-specific image profile on top of the StackRox CI image PR.

Uses the latest quay.io/stackrox-io/collector-builder:master manifest, pinned to digest sha256:52a3cca5253abb0cd5c3606769d5fd5b8be4cdb4671396f38a792695f07d7696.
Retains the OpenShell sandbox contract and StackRox agent/tooling setup.
Publishes sandbox-collector-builder for linux/amd64 while third-party binary downloads remain amd64-only.
Documents the three selectable StackRox profiles.

Dependent on the NVIDIA/default and Apollo/rox-ci-image PRs.

coderabbitai · 2026-09-12T22:14:01Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e9ec228c-a092-42c3-a344-676b9732b0bc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

stackrox-openshell-workflow · 2026-09-12T22:22:52Z

+        cloudpickle==3.1.2 \
+        mcp-atlassian==0.21.1 \
+    && uv cache clean
+


The go install command populates a build cache (typically in /root/.cache/go-build when run as root). This cache is not being cleaned in this step. Consider adding go clean -cache -modcache after installing gopls to reduce the final image size.

Resolved in the current head: the gopls install now removes /root/go and /root/.cache/go-build in the same layer.

stackrox-openshell-workflow · 2026-09-12T22:22:52Z

+# tar is a Node library dependency; npm leaves the system GNU tar in /usr/bin
+# unchanged.
+ARG NPM_TAR_VERSION=7.5.11
+ARG NPM_HONO_VERSION=1.19.11


Python version 3.14.3 does not appear to be a valid or available Python version. This will cause the uv python install command to fail. Please correct this to a valid Python version, for example a recent 3.12.x release.

Skipped: this finding is incorrect. uv python install 3.14.3 completed successfully in the StackRox image build; the version is available from uv and is intentional for the MCP runtime.

stackrox-openshell-workflow · 2026-09-12T22:22:52Z

+ARG GOPLS_VERSION=0.20.0
+RUN GOBIN=/usr/local/bin /usr/local/go/bin/go install "golang.org/x/tools/gopls@v${GOPLS_VERSION}" \
+    && rm -rf /root/go /root/.cache/go-build
+


The base collector-builder image and surrounding documentation state that a Go toolchain is already included. This redundant go installation adds to the image size and may introduce version conflicts. Consider removing this installation and using the go provided by the base image.

Resolved in the current head: the Collector builder image does not include Go, so this profile now installs the pinned Go 1.24.2 toolchain before building gopls.

stackrox-openshell-workflow · 2026-09-12T22:28:54Z

+    && chown sandbox:sandbox /tmp/npm-global
+USER sandbox
+RUN NPM_CONFIG_PREFIX=/tmp/npm-global npm install -g \
+        "@hono/node-server@${NPM_HONO_VERSION}" \


Python version 3.14.3 does not exist. This will cause the build to fail. This is likely a typo and should be a valid Python version, for example 3.12.3.

Skipped: this repeated finding is incorrect. uv python install 3.14.3 completed successfully in the image build, so the pinned Python version is valid.

stackrox-openshell-workflow · 2026-09-12T22:28:54Z

+         cp -a "/tmp/npm-global/bin/${name}" "/usr/local/bin/${name}"; \
+         chown -h root:root "/usr/local/bin/${name}"; \
+       done \
+    && chown -R root:root /usr/lib/node_modules \


The build argument NPM_HONO_VERSION is defined on line 102, but the corresponding package, @hono/node-server, is not included in this npm install command. This appears to be an omission.

Skipped: @hono/node-server is included in the current npm install command. The finding targets a stale view of the file.

stackrox-openshell-workflow · 2026-09-12T22:28:54Z

+    && rm -f /tmp/go.tgz
+
+ARG GOPLS_VERSION=0.20.0
+RUN GOBIN=/usr/local/bin /usr/local/go/bin/go install "golang.org/x/tools/gopls@v${GOPLS_VERSION}" \


This comment states that the base collector-builder image does not contain Go. This contradicts line 32 of this same Dockerfile and the associated README, both of which state that Go is already supplied by the base image. Re-installing the Go toolchain is unnecessary and could lead to version conflicts.

Resolved in the current head: the Collector builder image does not include Go, so this profile intentionally installs the pinned Go 1.24.2 toolchain before building gopls.

stackrox-openshell-workflow · 2026-09-12T22:51:10Z

+USER sandbox
+RUN NPM_CONFIG_PREFIX=/tmp/npm-global npm install -g \
+        "@hono/node-server@${NPM_HONO_VERSION}" \
+        "opencode-ai@${NPM_OPENCODE_VERSION}" \


The uv version 0.10.8 is significantly outdated. As a fast-developing tool, using a more recent version is recommended to benefit from performance improvements, security updates, and bug fixes. Please consider updating to a newer release.

Skipped: this profile pins uv 0.10.8 for reproducible image builds and uses the same tested version as the StackRox CI profile. Updating it is a separate dependency-refresh change, not a correctness issue for this PR.

stackrox-openshell-workflow · 2026-09-12T22:51:10Z

+
+# Atlassian MCP is part of the StackRox workflow image contract. The gateway
+# still owns credentials; no credential values are baked into this image.
+RUN uv venv --python "${PYTHON_VERSION}" --seed /sandbox/.venv \


The pinned Go version 1.24.2 is several major versions behind current stable releases and is likely unsupported. Please update to a recent, supported Go version to ensure security patches and bug fixes are included.

Skipped: Go 1.24.2 is intentionally pinned with its checksum and is the tested version shared with the default StackRox profile. Updating the toolchain is a separate dependency-refresh change.

stackrox-openshell-workflow · 2026-09-12T22:51:11Z

+
+- Working directory: `/sandbox`
+- Writable paths: `/sandbox`, `/tmp`
+- Inference routes through the gateway proxy at `inference.local`


The Dockerfile for this image (line 136) states that the collector-builder base image does not include Go, and then proceeds to install it. This documentation contradicts the Dockerfile by stating that Go is available from the base image. Please clarify whether the base image includes Go and update the documentation to be consistent.

Resolved in the current head: the image instructions now say that the Collector builder supplies the C/C++ build tools and this profile adds the pinned Go toolchain and gopls.

stackrox-openshell-workflow · 2026-09-12T23:00:57Z

+ARG NPM_OPENCODE_VERSION=1.18.30
+ARG NPM_CODEX_VERSION=0.117.0
+ARG NPM_COPILOT_VERSION=1.0.16
+ARG NPM_AJV_VERSION=5.0.0


Python version 3.14.3 is not a valid or available Python version. This will cause the Docker build to fail. You should use a valid version, for example, the latest stable version from the 3.12 series.

Skipped: this repeats the incorrect Python finding. uv python install 3.14.3 completed successfully in the final image build, so the pinned version is valid.

stackrox-openshell-workflow · 2026-09-12T23:01:33Z

+# OpenShell provider is attached. Use the static musl build so it runs on the
+# CentOS glibc version supplied by collector-builder.
+ARG GWS_VERSION=0.22.5
+ARG GWS_SHA256_AMD64=4db473dde4b1ab872e4ff35d769b0d4af1f1a6441a605e79d5cf8ada9c87e920


The go install command for gopls does not pin the version, which can lead to non-reproducible builds. It is recommended to use a specific version tag to ensure build consistency.

Skipped: the version is pinned through ARG GOPLS_VERSION=0.20.0 and the install uses golang.org/x/tools/gopls@v${GOPLS_VERSION}. The finding targets a stale view of the file.

robbycochran added the ai-review Opt in to artifact-only AI review on each PR head update label Sep 12, 2026

stackrox-openshell-workflow Bot reviewed Sep 12, 2026

View reviewed changes

robbycochran force-pushed the feat/collector-builder-image branch from b57dce5 to 021eb99 Compare September 12, 2026 22:24

robbycochran force-pushed the reopen/stackrox-ci-image branch from dacc7ff to c9fc1a4 Compare September 12, 2026 22:25

robbycochran force-pushed the feat/collector-builder-image branch from 021eb99 to 091e3cf Compare September 12, 2026 22:25

stackrox-openshell-workflow Bot reviewed Sep 12, 2026

View reviewed changes

robbycochran force-pushed the feat/collector-builder-image branch from 091e3cf to 710e9ce Compare September 12, 2026 22:39

robbycochran added 8 commits September 12, 2026 15:48

feat: add collector-builder StackRox sandbox profile

c0b60c8

ci: publish collector-builder sandbox profile

fb6b747

style: normalize vendored GitHub skill

43db256

fix: install Node tooling in collector-builder image

e7219b8

fix: add Go toolchain to collector-builder image

a79329c

simplify collector-builder npm tool installation

3f5c31e

simplify collector-builder npm cleanup

c672fbd

fix: isolate collector-builder Go install cache

78b90a6

robbycochran force-pushed the feat/collector-builder-image branch from 710e9ce to 78b90a6 Compare September 12, 2026 22:48

stackrox-openshell-workflow Bot reviewed Sep 12, 2026

View reviewed changes

docs: clarify collector-builder Go tooling

82fa6e5

stackrox-openshell-workflow Bot reviewed Sep 12, 2026

View reviewed changes

Uh oh!

Conversation

robbycochran commented Sep 12, 2026

Summary

Uh oh!

coderabbitai Bot commented Sep 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stackrox-openshell-workflow Bot Sep 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Sep 12, 2026 •

edited

Loading