Sandbox::https://github.com/github/gh-aw/blob/main/Dockerfile

Repository navigation

# Dockerfile for GitHub Agentic Workflows compiler

# Provides gh-aw, gh CLI, and native strict compilation dependencies

# Use Google's Docker Hub mirror to avoid unauthenticated pull limits and auth outages.

# Keep the official Alpine digest so the mirrored image is identical.

FROM mirror.gcr.io/library/alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6

# Install required dependencies

RUN apk add --no-cache \

git \

jq \

bash \

curl \

ca-certificates \

shellcheck \

github-cli

# Fail the image build if strict compilation's native scanner is unavailable.

RUN shellcheck --version

# Accept build argument for binary name (defaults to linux-amd64)

ARG BINARY=gh-aw-linux-amd64

# Create a directory for the binary

WORKDIR /usr/local/bin

# Copy the gh-aw binary from build context

COPY ${BINARY} /usr/local/bin/gh-aw

# Ensure the binary is executable

RUN chmod +x /usr/local/bin/gh-aw

# Configure git to trust all directories to avoid "dubious ownership" errors

# This is necessary when the container runs with mounted volumes owned by different users

RUN git config --global --add safe.directory '*'

# Set working directory for users

WORKDIR /workspace

# Set the entrypoint to gh-aw

ENTRYPOINT ["gh-aw"]

# Default command runs MCP server with actor validation enabled

# The GITHUB_ACTOR environment variable must be set for logs and audit tools to be available

# Binary path detection is automatic via os.Executable()

CMD ["mcp-server", "--validate-actor"]

# Metadata labels

LABEL org.opencontainers.image.source="https://github.com/github/gh-aw"

LABEL org.opencontainers.image.description="GitHub Agentic Workflows - Write agentic workflows in natural language markdown"

LABEL org.opencontainers.image.licenses="MIT"