770d89b430
Adds a Render Blueprint (render.yaml) and supporting pieces so nanobot can
be deployed to Render in one click, with persistent memory across deploys.
- render.yaml: web service + 1GB persistent disk mounted at
/home/nanobot/.nanobot. Prompts for ANTHROPIC_API_KEY and
NANOBOT_WEB_TOKEN at deploy time (sync: false).
- render-config.json: committed gateway config that wires secrets via
${VAR} placeholders (resolved at runtime). Nothing secret is committed.
- entrypoint.sh: adds a branch gated on RENDER=true that copies the config
onto the mounted disk, chowns the root-owned mount, and drops to the
non-root nanobot user via setpriv. Local (non-Render) path is unchanged.
- Dockerfile: COPY render-config.json; USER nanobot -> USER root so the
entrypoint can chown the freshly-mounted disk before dropping privileges;
add PYTHONUNBUFFERED/PYTHONFAULTHANDLER for diagnosable crash output.
- README.md: Deploy to Render button + section.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
39 lines
1.7 KiB
Bash
Executable File
39 lines
1.7 KiB
Bash
Executable File
#!/bin/sh
|
|
dir="$HOME/.nanobot"
|
|
|
|
# Render deploy path (see render.yaml + render-config.json). Gated on Render's
|
|
# automatic RENDER=true env var so local Docker/podman usage is unaffected.
|
|
# Copies the committed config template onto the mounted disk (wiring secrets via
|
|
# ${VAR} env vars and keeping runtime data on the persistent disk), chowns the
|
|
# root-owned mount, then drops to the non-root nanobot user. Logs each decision
|
|
# so a failed start is diagnosable in Render's logs.
|
|
if [ "$RENDER" = "true" ]; then
|
|
echo "[entrypoint] Render deploy — starting as $(id)"
|
|
mkdir -p "$dir" || echo "[entrypoint] warning: mkdir $dir failed"
|
|
config="$dir/config.json"
|
|
cp /app/render-config.json "$config" || echo "[entrypoint] warning: cp config failed"
|
|
if [ "$(id -u)" = "0" ]; then
|
|
chown -R nanobot:nanobot "$dir" || echo "[entrypoint] warning: chown $dir failed"
|
|
if setpriv --reuid=nanobot --regid=nanobot --init-groups true 2>/dev/null; then
|
|
echo "[entrypoint] dropping privileges to nanobot via setpriv"
|
|
exec setpriv --reuid=nanobot --regid=nanobot --init-groups nanobot "$@" --config "$config"
|
|
fi
|
|
echo "[entrypoint] setpriv privilege-drop not permitted — running as root"
|
|
fi
|
|
exec nanobot "$@" --config "$config"
|
|
fi
|
|
|
|
if [ -d "$dir" ] && [ ! -w "$dir" ]; then
|
|
owner_uid=$(stat -c %u "$dir" 2>/dev/null || stat -f %u "$dir" 2>/dev/null)
|
|
cat >&2 <<EOF
|
|
Error: $dir is not writable (owned by UID $owner_uid, running as UID $(id -u)).
|
|
|
|
Fix (pick one):
|
|
Host: sudo chown -R 1000:1000 ~/.nanobot
|
|
Docker: docker run --user \$(id -u):\$(id -g) ...
|
|
Podman: podman run --userns=keep-id ...
|
|
EOF
|
|
exit 1
|
|
fi
|
|
exec nanobot "$@"
|