feat(sandbox): add vi, jq, and dos2unix to base images (#3091) #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # Build and push the sandbox base image to GHCR. | |
| # | |
| # Triggers: | |
| # - Push to main when Dockerfile.base or the blueprint minimum version changes | |
| # - Manual dispatch for ad-hoc rebuilds | |
| # | |
| # The base image contains the expensive, rarely-changing layers (apt, gosu, | |
| # user setup, openclaw CLI). The production Dockerfile layers PR-specific | |
| # code on top via: FROM ghcr.io/nvidia/nemoclaw/sandbox-base:<tag> | |
| name: base-image | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "Dockerfile.base" | |
| - "agents/hermes/Dockerfile.base" | |
| # Dockerfile.base validates min_openclaw_version from this file at build time. | |
| - "nemoclaw-blueprint/blueprint.yaml" | |
| workflow_dispatch: | |
| inputs: | |
| openclaw_version: | |
| description: "OpenClaw version to install (leave blank to use the default in Dockerfile.base)" | |
| required: false | |
| default: "" | |
| permissions: | |
| contents: read | |
| packages: write | |
| concurrency: | |
| group: base-image | |
| cancel-in-progress: true | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: nvidia/nemoclaw/sandbox-base | |
| jobs: | |
| build-and-push: | |
| if: github.repository == 'NVIDIA/NemoClaw' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Set up QEMU (arm64 emulation) | |
| uses: docker/setup-qemu-action@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata | |
| id: meta | |
| uses: docker/metadata-action@v6 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=raw,value=latest | |
| type=sha,prefix=,format=short | |
| - name: Validate OpenClaw version input | |
| if: inputs.openclaw_version != '' | |
| run: echo "${{ inputs.openclaw_version }}" | grep -qxE '[0-9]+(\.[0-9]+)*' | |
| - name: Build and push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: Dockerfile.base | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| build-args: | | |
| ${{ inputs.openclaw_version && format('OPENCLAW_VERSION={0}', inputs.openclaw_version) || '' }} | |
| build-and-push-hermes: | |
| if: github.repository == 'NVIDIA/NemoClaw' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Set up QEMU (arm64 emulation) | |
| uses: docker/setup-qemu-action@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata | |
| id: meta | |
| uses: docker/metadata-action@v6 | |
| with: | |
| images: ${{ env.REGISTRY }}/nvidia/nemoclaw/hermes-sandbox-base | |
| tags: | | |
| type=raw,value=latest | |
| type=sha,prefix=,format=short | |
| - name: Build and push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: agents/hermes/Dockerfile.base | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max |