Phase 3: containerize for Linux with cross-platform voice libs#11
Conversation
Phase 3 of agent-cloud deployment alignment.
- Multi-stage Dockerfile (dotnet/sdk build -> dotnet/runtime), publishes
linux-x64, runs as non-root, exposes /health on 8080, points DB/recordings
at /app/data and /app/recordings for volume mounts.
- Voice on Linux: libsodium + SQLite natives ship via NuGet (verified they land
in a linux-x64 publish); opus installed via apt (libopus0) and symlinked to the
unversioned name DllImport("opus") probes for. OpusDotNet.opus.win-x64 is now
scoped to Windows builds in the csproj.
- .dockerignore keeps secrets/bin/obj/docs out of the image.
- docker-build.yml validates the image builds on every PR (build only, no push).
- CLAUDE.md updated (Deployment + voice deps).
Note: image build is validated in CI; final voice *capture* still needs a live
test against Discord on the deployed container.
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📜 Recent review details🧰 Additional context used🧠 Learnings (1)📓 Common learnings🔇 Additional comments (2)
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds Docker containerization for Wisbot: a multi-stage Dockerfile for linux-x64, a .dockerignore, a GitHub Actions workflow to validate Docker builds, an OS-conditioned Opus package reference in ChangesDocker Containerization
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/docker-build.yml:
- Around line 16-33: The workflow uses floating action tags and leaves
credentials/powers too broad; update the "Checkout", "Set up Docker Buildx", and
"Build image (no push)" steps to use pinned action references (replace
actions/checkout@v4, docker/setup-buildx-action@v3, docker/build-push-action@v6
with specific commit SHAs), add a minimal permissions block (e.g., permissions:
contents: read) at the job or workflow level, and disable credential persistence
by adding persist-credentials: false to the Checkout step so the build (Build
image (no push)) runs without writable tokens.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: b6a7d9b7-2325-4aab-9f0f-d631d262f217
📒 Files selected for processing (5)
.dockerignore.github/workflows/docker-build.ymlCLAUDE.mdDockerfileWisbot.csproj
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: build
- GitHub Check: Claude Code Review
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: CR
Repo: uhstray-io/WisBot
Timestamp: 2026-06-01T16:16:44.122Z
Learning: Read `.claude/memory/MEMORY.md` at the start of every session to load project context
Learnt from: CR
Repo: uhstray-io/WisBot
Timestamp: 2026-06-01T16:16:44.122Z
Learning: Use `dotnet build` to validate changes after completing code modifications
Learnt from: CR
Repo: uhstray-io/WisBot
Timestamp: 2026-06-01T16:16:44.122Z
Learning: Ensure code is well-structured, follows best practices, includes appropriate error handling, and document changes in CLAUDE.md or README.md
🪛 zizmor (1.25.2)
.github/workflows/docker-build.yml
[warning] 20-21: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 21-21: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 24-24: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 27-27: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🔇 Additional comments (4)
CLAUDE.md (1)
18-20: LGTM!Also applies to: 81-82
Dockerfile (2)
26-48: LGTM!
17-24: 💤 Low value
libsodium23may be redundant given the NuGet-providedlibsodium.so
Wisbot.csprojpulls thelibsodiumNuGet package (linux-x64 native isruntimes/linux-x64/native/libsodium.so), and the Dockerfile comment says it lands in/app. If Discord.Net loads thatlibsodium.so, installinglibsodium23may be unnecessary; if Discord.Net probes for a versioned/system SONAME (e.g.,libsodium.so.23) or relies on system loader paths, it’s required. Check the running container which library is actually resolved (e.g., list/appvs/usr/lib/x86_64-linux-gnulibsodium*.so*, and optionally useLD_DEBUG=libsduring startup) and then remove or update the Dockerfile comment accordingly..dockerignore (1)
1-28: LGTM!
Address CodeRabbit review on PR #11. - docker-build.yml: add 'permissions: contents: read', set persist-credentials: false on checkout, and pin all three actions to commit SHAs (verified against the live tags). - Dockerfile: remove libsodium23 from apt — libsodium.so ships version-matched via NuGet and resolves from the app dir; the apt copy was redundant. Keep libopus0 (opus is not NuGet-provided for Linux) + curl.
1 participant
Phase 3 of agent-cloud deployment alignment
Produces a Linux Docker image so agent-cloud can pull and run WisBot.
Voice-on-Linux spike result
libsodium+ SQLite natives ship cross-platform via NuGet — verified they land in adotnet publish -r linux-x64output (libsodium.so,libe_sqlite3.so).opuswas the only Windows-locked dependency (OpusDotNet.opus.win-x64ships win-x64 only). Fix: installlibopus0via apt in the image and symlink the unversioned nameDllImport("opus")probes for (libopus.so→libopus.so.0).dotnet publish -c Release -r linux-x64succeeds.Changes
Dockerfile— multi-stage (dotnet/sdk:10.0build →dotnet/runtime:10.0); non-root user;aptinstallslibopus0 libsodium23 curl+ opus symlink; container env defaults (WISBOT_HEALTH_HOST=+, DB/recordings under/app/data+/app/recordings);HEALTHCHECKcurls/health.Wisbot.csproj—OpusDotNet.opus.win-x64scoped to Windows builds (Condition="$([MSBuild]::IsOSPlatform('Windows'))")..dockerignore— keeps secrets/bin/obj/docs out of the image..github/workflows/docker-build.yml— builds the image on every PR (build only, no push) — this PR's run is the Dockerfile's first real build.CLAUDE.md— Deployment + voice-deps sections updated.Verification
dotnet buildgreen locally (with opus package excluded on non-Windows).Docker BuildCI job./health) is unaffected regardless.Depends on: Phase 1 (#9), Phase 2 (#10) — both merged. Next: Phase 4 — publish to GHCR + retire self-hosted deploy workflows.