From 123d244a5143c3954d2f1c54240a5e683ca74a4e Mon Sep 17 00:00:00 2001
From: Simos Mikelatos <simosmik@gmail.com>
Date: Wed, 8 Jul 2026 09:22:10 +0000
Subject: [PATCH] fix: harden docker cloudcli install

---
 .github/workflows/docker.yml  | 14 +++++++++-----
 docker/claude-code/Dockerfile | 11 ++++++++++-
 docker/codex/Dockerfile       | 11 ++++++++++-
 3 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 92856193..5c070005 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -14,18 +14,22 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        template: [claude-code, codex, gemini]
+        template: [claude-code, codex]
     steps:
       - uses: actions/checkout@v6
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
+        with:
+          platforms: arm64
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
+        with:
+          version: latest
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -40,7 +44,7 @@ jobs:
           echo "tags=$TAGS" >> "$GITHUB_OUTPUT"
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: ./docker
           file: ./docker/${{ matrix.template }}/Dockerfile
diff --git a/docker/claude-code/Dockerfile b/docker/claude-code/Dockerfile
index 8d108a80..11402005 100644
--- a/docker/claude-code/Dockerfile
+++ b/docker/claude-code/Dockerfile
@@ -5,7 +5,16 @@ COPY shared/install-cloudcli.sh /tmp/install-cloudcli.sh
 RUN chmod +x /tmp/install-cloudcli.sh && /tmp/install-cloudcli.sh
 
 USER agent
-RUN npm install -g @cloudcli-ai/cloudcli && cloudcli --version
+RUN --mount=type=cache,target=/tmp/npm-cache,sharing=locked,mode=0777 \
+    npm install -g @cloudcli-ai/cloudcli \
+      --cache=/tmp/npm-cache \
+      --fetch-retries=5 \
+      --fetch-retry-mintimeout=20000 \
+      --fetch-retry-maxtimeout=120000 \
+      --fetch-timeout=600000 \
+      --no-audit \
+      --no-fund && \
+    cloudcli --version
 
 COPY --chown=agent:agent shared/start-cloudcli.sh /home/agent/.cloudcli-start.sh
 RUN echo '. ~/.cloudcli-start.sh' >> /home/agent/.bashrc
diff --git a/docker/codex/Dockerfile b/docker/codex/Dockerfile
index c1bc1807..54e0ee95 100644
--- a/docker/codex/Dockerfile
+++ b/docker/codex/Dockerfile
@@ -5,7 +5,16 @@ COPY shared/install-cloudcli.sh /tmp/install-cloudcli.sh
 RUN chmod +x /tmp/install-cloudcli.sh && /tmp/install-cloudcli.sh
 
 USER agent
-RUN npm install -g @cloudcli-ai/cloudcli && cloudcli --version
+RUN --mount=type=cache,target=/tmp/npm-cache,sharing=locked,mode=0777 \
+    npm install -g @cloudcli-ai/cloudcli \
+      --cache=/tmp/npm-cache \
+      --fetch-retries=5 \
+      --fetch-retry-mintimeout=20000 \
+      --fetch-retry-maxtimeout=120000 \
+      --fetch-timeout=600000 \
+      --no-audit \
+      --no-fund && \
+    cloudcli --version
 
 COPY --chown=agent:agent shared/start-cloudcli.sh /home/agent/.cloudcli-start.sh
 RUN echo '. ~/.cloudcli-start.sh' >> /home/agent/.bashrc