Add Node.js 22 to claude and devstral Docker images#8
Add Node.js 22 to claude and devstral Docker images#8bobnautic wants to merge 1 commit intoVibePod:mainfrom
Conversation
📝 WalkthroughWalkthroughTwo Docker images now provision Node.js 22.x through NodeSource setup during their initial package installation steps. No other build processes, environment variables, or runtime behavior were modified. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~5 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
docker/devstral/Dockerfile (2)
4-11: Optional: use--no-install-recommendsfor consistency with the claude image and smaller layer size.
docker/claude/Dockerfileuses--no-install-recommendson its package install (line 7) but this file does not. Adding it here (both for the base deps and thenodejsinstall) trims recommended-but-not-required packages and keeps the two agent images aligned.♻️ Proposed change
-RUN apt-get update && apt-get install -y \ +RUN apt-get update && apt-get install -y --no-install-recommends \ curl \ ca-certificates \ git \ bash \ && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \ - && apt-get install -y nodejs \ + && apt-get install -y --no-install-recommends nodejs \ && rm -rf /var/lib/apt/lists/*🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docker/devstral/Dockerfile` around lines 4 - 11, The Dockerfile RUN step installs packages without --no-install-recommends; update the apt-get install invocations in the RUN command so both the initial apt-get install -y (installing curl, ca-certificates, git, bash) and the subsequent apt-get install -y nodejs use --no-install-recommends (e.g., replace apt-get install -y with apt-get install -y --no-install-recommends) to reduce image size and match the claude image behavior while preserving the existing curl setup and cleanup (rm -rf /var/lib/apt/lists/*).
9-10: Same NodeSource hardening concern asdocker/claude/Dockerfile.The
curl ... | bash -approach to NodeSource setup has the same supply-chain considerations flagged indocker/claude/Dockerfile(lines 20-21). The newer manual GPG-key + apt-source method is preferred. Not repeating the full diff here.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docker/devstral/Dockerfile` around lines 9 - 10, The Dockerfile currently uses a piped curl installer for NodeSource (the line with "curl -fsSL https://deb.nodesource.com/setup_22.x | bash -") which is a supply-chain risk; replace that step with the manual GPG-key + apt-source flow: fetch and add the NodeSource GPG public key, add the NodeSource apt repository for node_22.x to /etc/apt/sources.list.d (using the distro codename), run apt-get update, then apt-get install -y nodejs; remove the piped curl invocation and ensure the subsequent apt-get install -y nodejs continues to install from the newly added NodeSource repository.docker/claude/Dockerfile (1)
20-21: The setup script approach is NodeSource's current recommendation; consider the manual method for enhanced auditability (optional).NodeSource explicitly recommends the
setup_22.xscript approach for Node.js 22 on Debian as of 2026, so the current method is aligned with their guidance. However, if you prefer explicit control and auditability over supply-chain steps, you can replicate what the script does internally by manually importing the GPG key and adding the apt source. This makes provisioning decisions transparent without executing a remote script.♻️ Manual approach alternative (optional)
RUN apt-get update && apt-get install -y --no-install-recommends \ bash \ ca-certificates \ curl \ git \ gosu \ jq \ libgcc-s1 \ libstdc++6 \ passwd \ python3 \ ripgrep \ xclip \ + gnupg \ - && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \ - && apt-get install -y --no-install-recommends nodejs \ + && mkdir -p /etc/apt/keyrings \ + && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \ + | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \ + && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" \ + > /etc/apt/sources.list.d/nodesource.list \ + && apt-get update \ + && apt-get install -y --no-install-recommends nodejs \ && rm -rf /var/lib/apt/lists/*🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docker/claude/Dockerfile` around lines 20 - 21, The Dockerfile currently uses the remote NodeSource setup script (curl -fsSL https://deb.nodesource.com/setup_22.x | bash -) before installing nodejs; to improve auditability replace that pipeline with an explicit sequence: fetch and verify the NodeSource GPG key, add the NodeSource apt repository entry for "setup_22.x" to sources.list.d, run apt-get update, then install nodejs with apt-get install -y --no-install-recommends nodejs; locate the lines containing "curl -fsSL https://deb.nodesource.com/setup_22.x | bash -", "setup_22.x", and "nodejs" and implement the manual GPG import + apt source add and update steps instead of executing the remote script.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@docker/devstral/Dockerfile`:
- Around line 9-10: Remove the unnecessary Node.js install steps: delete the
curl NodeSource setup command ("curl -fsSL https://deb.nodesource.com/setup_22.x
| bash -") and the subsequent "apt-get install -y nodejs" invocation from the
Dockerfile so the image no longer installs nodejs at build time; the devstral
agent uses the precompiled 'vibe' binary and does not require Node runtime.
---
Nitpick comments:
In `@docker/claude/Dockerfile`:
- Around line 20-21: The Dockerfile currently uses the remote NodeSource setup
script (curl -fsSL https://deb.nodesource.com/setup_22.x | bash -) before
installing nodejs; to improve auditability replace that pipeline with an
explicit sequence: fetch and verify the NodeSource GPG key, add the NodeSource
apt repository entry for "setup_22.x" to sources.list.d, run apt-get update,
then install nodejs with apt-get install -y --no-install-recommends nodejs;
locate the lines containing "curl -fsSL https://deb.nodesource.com/setup_22.x |
bash -", "setup_22.x", and "nodejs" and implement the manual GPG import + apt
source add and update steps instead of executing the remote script.
In `@docker/devstral/Dockerfile`:
- Around line 4-11: The Dockerfile RUN step installs packages without
--no-install-recommends; update the apt-get install invocations in the RUN
command so both the initial apt-get install -y (installing curl,
ca-certificates, git, bash) and the subsequent apt-get install -y nodejs use
--no-install-recommends (e.g., replace apt-get install -y with apt-get install
-y --no-install-recommends) to reduce image size and match the claude image
behavior while preserving the existing curl setup and cleanup (rm -rf
/var/lib/apt/lists/*).
- Around line 9-10: The Dockerfile currently uses a piped curl installer for
NodeSource (the line with "curl -fsSL https://deb.nodesource.com/setup_22.x |
bash -") which is a supply-chain risk; replace that step with the manual GPG-key
+ apt-source flow: fetch and add the NodeSource GPG public key, add the
NodeSource apt repository for node_22.x to /etc/apt/sources.list.d (using the
distro codename), run apt-get update, then apt-get install -y nodejs; remove the
piped curl invocation and ensure the subsequent apt-get install -y nodejs
continues to install from the newly added NodeSource repository.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e6f9d411-6a62-4cd0-9ff9-b1061594d37b
📒 Files selected for processing (2)
docker/claude/Dockerfiledocker/devstral/Dockerfile
| && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \ | ||
| && apt-get install -y nodejs \ |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Look for any Node.js / npm / npx invocations in devstral-related scripts or configs
rg -nP --hidden -g '!**/node_modules/**' '\b(node|npm|npx)\b' docker/devstral/ 2>/dev/null
fd -t f . docker/devstral/
cat agents.json 2>/dev/null | head -100Repository: VibePod/vibepod-agents
Length of output: 2910
🏁 Script executed:
cat docker/devstral/DockerfileRepository: VibePod/vibepod-agents
Length of output: 1076
🏁 Script executed:
# Search for any MCP server or plugin configuration that might require Node
rg -i 'mcp|plugin|server' docker/devstral/ --hiddenRepository: VibePod/vibepod-agents
Length of output: 48
🏁 Script executed:
# Check the vibe install script to understand what's being installed
curl -s https://mistral.ai/vibe/install.sh 2>/dev/null | head -50Repository: VibePod/vibepod-agents
Length of output: 48
🏁 Script executed:
# Search entire repo for vibe or node references
rg -i 'vibe|node.*version|nodejs' --type json --type yaml --type md | head -30Repository: VibePod/vibepod-agents
Length of output: 2300
🏁 Script executed:
# Check if there's any documentation about vibe or its requirements
fd -e md -e txt . | xargs grep -l -i 'vibe\|node.*requirement' 2>/dev/null | head -10Repository: VibePod/vibepod-agents
Length of output: 76
🏁 Script executed:
# Look for any build scripts or configuration that might indicate node usage
fd -e package.json -e package-lock.json . | head -5Repository: VibePod/vibepod-agents
Length of output: 48
Remove Node.js installation—vibe does not require it at runtime.
The devstral agent sources vibe from mistralai/mistral-vibe (GitHub release), a compiled binary similar to claude. Unlike npm-based agents (gemini, opencode, auggie, copilot, codex), vibe is not invoked through Node.js: the version command is simply vibe --version, and no node|npm|npx usage appears in the Dockerfile or devstral config. The Node.js installation adds ~50–100 MB to the image and widens the attack surface unnecessarily. Remove lines 9–10 to match the actual functional requirements of the agent.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@docker/devstral/Dockerfile` around lines 9 - 10, Remove the unnecessary
Node.js install steps: delete the curl NodeSource setup command ("curl -fsSL
https://deb.nodesource.com/setup_22.x | bash -") and the subsequent "apt-get
install -y nodejs" invocation from the Dockerfile so the image no longer
installs nodejs at build time; the devstral agent uses the precompiled 'vibe'
binary and does not require Node runtime.
1 participant
Summary
docker/claude/Dockerfileanddocker/devstral/Dockerfilewere missing Node.js, making tools and plugins that depend on it non-functionalauggie,codex,copilot,gemini,opencode) which all usenode:22base imagesapt-getlayer to avoid adding extra image layersWhy NodeSource instead of plain apt
debian:bookworm-slim's default apt repo ships Node.js 18. NodeSource pins the install to Node.js 22, keeping all agent images on the same major version.Summary by CodeRabbit