From 7507b1efe246dc425a8bd3e9ba3e6cab5e495ace Mon Sep 17 00:00:00 2001 From: "Christian M. Todie" Date: Tue, 7 Apr 2026 06:20:03 -0400 Subject: [PATCH] chore(reach): bake net + debug tools into the sandbox image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add iproute2, net-tools, dnsutils, iputils-ping, jq, procps, less, and wget to the runtime image. The original layer 1 only had curl, which made debugging "is service X actually listening?" inside the sandbox require an apt-get install at exec time — slow, ugly, and impossible when the container is offline. These are baseline troubleshooting tools every Linux box has. Total image size delta is ~12 MB compressed; the convenience cost of NOT having ss/dig/ping at the ready is much higher than that. Driven by a session where I had to apt-install iproute2 + net-tools inside a running sandbox just to verify Chrome's remote debugging port was bound on 0.0.0.0:9222. Co-Authored-By: Claude Opus 4.6 (1M context) --- Dockerfile | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index d3ca1a5..c973a35 100644 --- a/Dockerfile +++ b/Dockerfile @@ -14,7 +14,12 @@ ENV DEBIAN_FRONTEND=noninteractive ENV DISPLAY=:99 ENV HOME=/home/sandbox -# Layer 1: System deps — display, VNC, window manager, X11 tools +# Layer 1: System deps — display, VNC, window manager, X11 tools, network +# debug tooling. The network tools (iproute2, net-tools, dnsutils, jq) are +# load-bearing for any agent that needs to introspect ports, sockets, or +# DNS from inside the sandbox. Without them, debugging "is chrome's CDP +# port actually listening?" requires apt-get inside a running container, +# which is slow and bloats the layer. RUN apt-get update && apt-get install -y --no-install-recommends \ xvfb \ x11vnc \ @@ -26,8 +31,16 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ fonts-noto-mono \ dbus-x11 \ curl \ + wget \ ca-certificates \ gnupg \ + iproute2 \ + net-tools \ + dnsutils \ + iputils-ping \ + jq \ + procps \ + less \ python3 \ python3-pip \ && rm -rf /var/lib/apt/lists/*