refac

Dockerfile.openshift

@@ -0,0 +1,54 @@
+FROM python:3.12.13-slim AS builder
+
+WORKDIR /src
+
+COPY pyproject.toml README.md uv.lock* ./
+COPY open_terminal/ open_terminal/
+
+RUN pip install --no-cache-dir --prefix=/install .
+
+
+FROM python:3.12.13-slim
+
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV PYTHONUNBUFFERED=1
+ENV HOME=/home/user
+ENV SHELL=/bin/bash
+ENV USER=user
+ENV XDG_CONFIG_HOME=/home/user/.config
+ENV XDG_STATE_HOME=/home/user/.local/state
+ENV XDG_CACHE_HOME=/home/user/.cache
+ENV PATH="/home/user/.local/bin:${PATH}"
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        bash \
+        ca-certificates \
+        curl \
+        git \
+        jq \
+        less \
+        procps \
+        tini \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /install /usr/local
+
+WORKDIR /app
+COPY pyproject.toml README.md ./
+COPY open_terminal/ open_terminal/
+COPY entrypoint-openshift.sh /app/entrypoint-openshift.sh
+
+RUN pip install --no-cache-dir --no-deps . \
+    && mkdir -p /home/user/.local/bin /home/user/.config /home/user/.local/state /home/user/.cache \
+    && chgrp -R 0 /home/user /app \
+    && chmod -R g=u /home/user /app \
+    && chmod +x /app/entrypoint-openshift.sh
+
+WORKDIR /home/user
+
+EXPOSE 8000
+
+USER 1001
+
+ENTRYPOINT ["/usr/bin/tini", "--", "/app/entrypoint-openshift.sh"]
+CMD ["run"]

README.md

@@ -26,25 +26,29 @@ That's it — you're up and running at `http://localhost:8000`.
 
 #### Image Variants
 
-| | `latest` | `slim` | `alpine` |
-|---|---|---|---|
-| **Best for** | AI agent sandboxes | Production / hardened | Edge / CI / minimal footprint |
-| **Size** | ~4 GB | ~430 MB | ~230 MB |
-| **Bundled tooling** | Node.js, gcc, ffmpeg, LaTeX, Docker CLI, data science libs | git, curl, jq | git, curl, jq |
-| **Install packages at runtime** | ✔ (has `sudo`) | ✘ | ✘ |
-| **Multi-user mode** | ✔ | ✘ | ✘ |
-| **Egress firewall** | ✔ | ✔ | ✔ |
+| | `latest` | `slim` | `alpine` | `openshift` |
+|---|---|---|---|---|
+| **Best for** | AI agent sandboxes | Production / hardened | Edge / CI / minimal footprint | OpenShift restricted SCC |
+| **Size** | ~4 GB | ~430 MB | ~230 MB | ~430 MB |
+| **Bundled tooling** | Node.js, gcc, ffmpeg, LaTeX, Docker CLI, data science libs | git, curl, jq | git, curl, jq | git, curl, jq |
+| **Install packages at runtime** | ✔ (has `sudo`) | ✘ | ✘ | ✘ |
+| **Multi-user mode** | ✔ | ✘ | ✘ | ✘ |
+| **Egress firewall** | ✔ | ✔ | ✔ | ✘ |
 
 **`slim`** and **`alpine`** have the same feature set. Slim uses Debian (glibc) for broader binary compatibility; Alpine uses musl libc and is smaller, but some C-extension pip packages may need to compile from source.
 
 ```bash
 docker run -d -p 8000:8000 -e OPEN_TERMINAL_API_KEY=secret ghcr.io/open-webui/open-terminal:slim
 docker run -d -p 8000:8000 -e OPEN_TERMINAL_API_KEY=secret ghcr.io/open-webui/open-terminal:alpine
+docker run -d -p 8000:8000 -e OPEN_TERMINAL_API_KEY=secret ghcr.io/open-webui/open-terminal:openshift
 ```
 
 > [!NOTE]
 > Slim and Alpine don't support `OPEN_TERMINAL_PACKAGES` / `OPEN_TERMINAL_PIP_PACKAGES` / `OPEN_TERMINAL_NPM_PACKAGES`. To add packages, extend [Dockerfile.slim](Dockerfile.slim) or [Dockerfile.alpine](Dockerfile.alpine).
 
+> [!NOTE]
+> The OpenShift image is for restricted non-root pod policies. It does not support runtime package installs, Docker socket access, the iptables egress firewall, or `OPEN_TERMINAL_MULTI_USER=true`. Build a custom image ahead of time when OpenShift users need extra tools.
+
 #### Updating
 
 ```bash

entrypoint-openshift.sh

@@ -0,0 +1,61 @@
+#!/bin/sh
+set -e
+
+file_env() {
+    var="$1"
+    file_var="${var}_FILE"
+    default="${2:-}"
+
+    eval current_value="\${$var:-}"
+    eval file_value="\${$file_var:-}"
+    eval var_is_set="\${$var+set}"
+    eval file_is_set="\${$file_var+set}"
+
+    if [ "$var_is_set" = "set" ] && [ "$file_is_set" = "set" ]; then
+        printf >&2 'error: both %s and %s are set, but they are mutually exclusive\n' "$var" "$file_var"
+        exit 1
+    fi
+
+    value="$default"
+    if [ -n "$current_value" ]; then
+        value="$current_value"
+    elif [ -n "$file_value" ]; then
+        value="$(cat "$file_value")"
+    fi
+
+    export "$var=$value"
+    unset "$file_var"
+}
+
+warn_unsupported() {
+    var="$1"
+    eval value="\${$var:-}"
+    if [ -n "$value" ]; then
+        printf >&2 'warning: %s is not supported by the OpenShift image and will be ignored\n' "$var"
+        unset "$var"
+    fi
+}
+
+file_env OPEN_TERMINAL_API_KEY
+
+if [ "${OPEN_TERMINAL_MULTI_USER:-}" = "true" ] || [ "${OPEN_TERMINAL_MULTI_USER:-}" = "1" ]; then
+    printf >&2 'error: OPEN_TERMINAL_MULTI_USER is not supported by the OpenShift image\n'
+    exit 1
+fi
+
+warn_unsupported OPEN_TERMINAL_ALLOWED_DOMAINS
+warn_unsupported OPEN_TERMINAL_PACKAGES
+warn_unsupported OPEN_TERMINAL_PIP_PACKAGES
+warn_unsupported OPEN_TERMINAL_NPM_PACKAGES
+
+export HOME="${HOME:-/home/user}"
+export SHELL="${SHELL:-/bin/bash}"
+export USER="${USER:-user}"
+export XDG_CONFIG_HOME="${XDG_CONFIG_HOME:-$HOME/.config}"
+export XDG_STATE_HOME="${XDG_STATE_HOME:-$HOME/.local/state}"
+export XDG_CACHE_HOME="${XDG_CACHE_HOME:-$HOME/.cache}"
+export PATH="$HOME/.local/bin:$PATH"
+
+mkdir -p "$HOME" "$HOME/.local/bin" "$XDG_CONFIG_HOME" "$XDG_STATE_HOME" "$XDG_CACHE_HOME" 2>/dev/null || true
+
+exec open-terminal "$@"