Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| Costs: a statement that keeps usage sold, running g1t, subscriptions and what was given away (comped, free use, trial, pool) apart, and says who was paid; free use carries its own cost; the run button says it is running | 1 | # syntax=docker/dockerfile:1.7 |
| 2 | # | |
| The runner no longer runs g1t's own agents. Cloud and self-hosted runners now do what a forge's runner does: Actions jobs, required checks, merge checks and merge-queue test runs, deployments, dependency bumps and backups. Everything that started Claude Code in a sandbox on an issue or pull request is gone, with its prompts, model access, mentions, delegation, plans, reviews, revisions and the workspace agents' computers. | 3 | # The sandbox workflow jobs, g1t.page builds and g1t's own work (the merge |
| 4 | # queue, merge checks, dependency updates, backups) run in: the base image | |
| 5 | # (services/runner/base/Dockerfile, everything but the runner) and the g1t | |
| 6 | # runner, a static Linux binary built outside Docker by | |
| 7 | # scripts/build-runner.mjs. | |
| Costs: a statement that keeps usage sold, running g1t, subscriptions and what was given away (comped, free use, trial, pool) apart, and says who was paid; free use carries its own cost; the run button says it is running | 8 | # |
| A deploy makes the runner's image in the registry, without Docker: it reads the base's manifest and config from Cloudflare's registry, uploads one gzipped layer holding the runner binary at /usr/local/bin/g1t-runner with mode 0755, and writes a config (the entrypoint g1t-runner, the base's command cleared, as the Dockerfile's ENTRYPOINT does) and a manifest that name the base's layers and that one, under the runner's tag, for linux/amd64 (scripts/deploy/registry.mjs, the registry's own upload calls with the credentials Wrangler gives). Deploy #256 ran out of disk because docker build pulled the 4.5 GB base into the job's own Docker Engine, compressed and unpacked, on a 20 GB sandbox whose own filesystem is that same base; now nothing of the base is downloaded and the job's Docker Engine is never started. Docker is asked for only when it is needed: a dry run (build, or image --no-push) still builds services/runner/Dockerfile with it, and so does a deploy whose registry step fails, logging df -h and docker system df before and after. The image job removes npm's downloads, which it only restores, once its install has read them, and logs the disk before and after the deploy. Tests cover the layer's tar, the config and manifest, the calls against a registry kept in memory (the base's layers are never fetched), the token flow, and that the Dockerfile says the same path, mode and entrypoint; the image was also checked against a local registry, where it runs and has the same config as a docker build of the Dockerfile. | 9 | # Deploys do not build this file: scripts/deploy/registry.mjs makes the |
| 10 | # same image in the registry, adding one layer with the binary to the | |
| 11 | # base's layers (the same path, mode and entrypoint; a test in | |
| 12 | # scripts/deploy holds the two together), so a deploy job never pulls the | |
| 13 | # base. scripts/deploy.mjs builds it with Docker for a dry run, or when | |
| 14 | # that fails, passing BASE (the image recorded in services/runner/base.json) | |
| 15 | # and a build context holding only the binary. | |
| Costs: a statement that keeps usage sold, running g1t, subscriptions and what was given away (comped, free use, trial, pool) apart, and says who was paid; free use carries its own cost; the run button says it is running | 16 | |
| 17 | ARG BASE | |
| 18 | FROM ${BASE} | |
| 19 | COPY --chmod=0755 g1t-runner /usr/local/bin/g1t-runner | |
| 20 | ENTRYPOINT ["g1t-runner"] |
This file's history is long; its oldest lines are credited to the oldest commit read.