Skip to content

Commit f5fc969

Browse files
author
Test
committed
feat: add Docker Hub support and blog post
- Add Dockerfile for multi-platform CLI image - Add .github/workflows/docker.yml for Docker Hub publish - Add docs/DOCKER.md with CI/CD examples - Add blog post: Why Your AI Agent Needs E2E Encryption
1 parent 3b27de3 commit f5fc969

File tree

4 files changed

+345
-0
lines changed

4 files changed

+345
-0
lines changed

‎.github/workflows/docker.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
name: Docker Hub Publish
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v*'
7+
workflow_dispatch:
8+
inputs:
9+
tag:
10+
description: 'Docker tag (e.g., latest, v1.0.0)'
11+
required: true
12+
default: 'latest'
13+
14+
env:
15+
REGISTRY: docker.io
16+
IMAGE_NAME: gptcode/cli
17+
18+
jobs:
19+
build-and-push:
20+
runs-on: ubuntu-latest
21+
permissions:
22+
contents: read
23+
packages: write
24+
25+
steps:
26+
- name: Checkout repository
27+
uses: actions/checkout@v4
28+
29+
- name: Set up Docker Buildx
30+
uses: docker/setup-buildx-action@v3
31+
32+
- name: Log in to Docker Hub
33+
uses: docker/login-action@v3
34+
with:
35+
username: ${{ secrets.DOCKERHUB_USERNAME }}
36+
password: ${{ secrets.DOCKERHUB_TOKEN }}
37+
38+
- name: Extract metadata
39+
id: meta
40+
uses: docker/metadata-action@v5
41+
with:
42+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
43+
tags: |
44+
type=semver,pattern={{version}}
45+
type=semver,pattern={{major}}.{{minor}}
46+
type=semver,pattern={{major}}
47+
type=raw,value=latest,enable={{is_default_branch}}
48+
49+
- name: Build and push Docker image
50+
uses: docker/build-push-action@v5
51+
with:
52+
context: .
53+
push: true
54+
tags: ${{ steps.meta.outputs.tags }}
55+
labels: ${{ steps.meta.outputs.labels }}
56+
platforms: linux/amd64,linux/arm64
57+
cache-from: type=gha
58+
cache-to: type=gha,mode=max
59+
60+
- name: Update Docker Hub description
61+
uses: peter-evans/dockerhub-description@v3
62+
with:
63+
username: ${{ secrets.DOCKERHUB_USERNAME }}
64+
password: ${{ secrets.DOCKERHUB_TOKEN }}
65+
repository: ${{ env.IMAGE_NAME }}
66+
short-description: "GPTCode CLI - AI Coding Assistant"
67+
readme-filepath: ./docs/DOCKER.md

‎Dockerfile‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# GPTCode CLI Docker Image
2+
# Multi-stage build for minimal image size
3+
#
4+
# Usage:
5+
# docker build -t gptcode/cli:latest .
6+
# docker run -e GPTCODE_TOKEN=$TOKEN gptcode/cli:latest gptcode run --headless
7+
#
8+
9+
# Stage 1: Build
10+
FROM golang:1.24-alpine AS builder
11+
12+
RUN apk add --no-cache git ca-certificates
13+
14+
WORKDIR /build
15+
16+
# Copy go mod files first for cache
17+
COPY go.mod go.sum ./
18+
RUN go mod download
19+
20+
# Copy source
21+
COPY . .
22+
23+
# Build static binary
24+
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -o gptcode ./cmd/gptcode
25+
26+
# Stage 2: Minimal runtime
27+
FROM alpine:3.19
28+
29+
RUN apk add --no-cache ca-certificates tzdata git
30+
31+
# Create non-root user
32+
RUN adduser -D -u 1000 gptcode
33+
USER gptcode
34+
35+
WORKDIR /home/gptcode
36+
37+
# Copy binary
38+
COPY --from=builder /build/gptcode /usr/local/bin/gptcode
39+
40+
# Default command
41+
ENTRYPOINT ["gptcode"]
42+
CMD ["--help"]

‎docs/DOCKER.md‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
# GPTCode CLI Docker Image
2+
3+
Official Docker image for GPTCode CLI - your AI coding assistant.
4+
5+
## Quick Start
6+
7+
```bash
8+
# Pull the image
9+
docker pull gptcode/cli:latest
10+
11+
# Run with your token
12+
docker run -e GPTCODE_TOKEN=$GPTCODE_TOKEN gptcode/cli:latest gptcode chat "explain Docker"
13+
```
14+
15+
## Usage in CI/CD
16+
17+
### GitHub Actions
18+
19+
```yaml
20+
jobs:
21+
ai-review:
22+
runs-on: ubuntu-latest
23+
container:
24+
image: gptcode/cli:latest
25+
steps:
26+
- uses: actions/checkout@v4
27+
28+
- name: AI Code Review
29+
env:
30+
GPTCODE_TOKEN: ${{ secrets.GPTCODE_TOKEN }}
31+
run: gptcode review --ci
32+
```
33+
34+
### GitLab CI
35+
36+
```yaml
37+
code-review:
38+
image: gptcode/cli:latest
39+
script:
40+
- gptcode review --ci
41+
variables:
42+
GPTCODE_TOKEN: $GPTCODE_TOKEN
43+
```
44+
45+
### Jenkins Pipeline
46+
47+
```groovy
48+
pipeline {
49+
agent {
50+
docker { image 'gptcode/cli:latest' }
51+
}
52+
environment {
53+
GPTCODE_TOKEN = credentials('gptcode-token')
54+
}
55+
stages {
56+
stage('AI Review') {
57+
steps {
58+
sh 'gptcode review --ci'
59+
}
60+
}
61+
}
62+
}
63+
```
64+
65+
## Environment Variables
66+
67+
| Variable | Description | Required |
68+
|----------|-------------|----------|
69+
| `GPTCODE_TOKEN` | Authentication token from gptcode.app | Yes |
70+
| `GPTCODE_BACKEND` | LLM backend (openai, anthropic, etc.) | No |
71+
| `GPTCODE_MODEL` | Model to use | No |
72+
73+
## Volume Mounts
74+
75+
For persistent configuration:
76+
77+
```bash
78+
docker run -v ~/.gptcode:/home/gptcode/.gptcode \
79+
-v $(pwd):/workspace \
80+
-w /workspace \
81+
gptcode/cli:latest gptcode do "fix the tests"
82+
```
83+
84+
## Available Tags
85+
86+
- `latest` - Latest stable release
87+
- `v1.x.x` - Specific version
88+
- `main` - Latest from main branch (unstable)
89+
90+
## Image Details
91+
92+
- **Base**: Alpine Linux 3.19
93+
- **Size**: ~50MB
94+
- **Platforms**: linux/amd64, linux/arm64
95+
- **User**: Non-root (uid 1000)
96+
97+
## Links
98+
99+
- [GitHub Repository](https://github.com/gptcode-cloud/cli)
100+
- [Documentation](https://gptcode.app/docs)
101+
- [Get Your Token](https://gptcode.app/login)

‎docs/_posts/2025-12-14-why-your-ai-agent-needs-e2e-encryption.md‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
---
2+
layout: post
3+
title: "Why Your AI Coding Agent Needs End-to-End Encryption"
4+
date: 2025-12-14
5+
author: GPTCode Team
6+
tags: [security, privacy, encryption, remote-access]
7+
---
8+
9+
# Why Your AI Coding Agent Needs End-to-End Encryption 🔐
10+
11+
You're working on a proprietary codebase. Maybe it's your startup's core product, your company's internal tools, or a client project under NDA. You want to use an AI coding assistant to help you work faster—but there's a catch.
12+
13+
**Where is that context going?**
14+
15+
## The Problem with Remote AI Dashboards
16+
17+
Modern AI coding tools often include remote dashboards for:
18+
- Viewing sessions from your phone
19+
- Team collaboration and pair programming
20+
- Session history and analytics
21+
22+
This is *incredibly useful*. But it also means your code, your prompts, and your AI's responses are passing through a server that you don't control.
23+
24+
Most tools ask you to simply *trust* that:
25+
1. The server isn't logging your sessions
26+
2. No one at the company is viewing your code
27+
3. The infrastructure is secure against breaches
28+
29+
But what if you didn't have to trust anyone?
30+
31+
## Enter: End-to-End Encryption
32+
33+
With GPTCode's new **Private Mode**, the server becomes a *blind relay*. Here's what that means:
34+
35+
```
36+
┌─────────┐ ┌─────────┐ ┌─────────┐
37+
│ CLI │◄──encrypted───►│ Live │◄──encrypted───►│ Browser │
38+
│ Agent │ │ Server │ │ UI │
39+
└─────────┘ └─────────┘ └─────────┘
40+
│
41+
Cannot decrypt!
42+
```
43+
44+
### How It Works
45+
46+
1. **Key Exchange**: When your CLI connects to the dashboard, it generates a unique key pair using **X25519** (the same algorithm used by Signal and WhatsApp).
47+
48+
2. **Shared Secret**: Your browser also generates a key pair. The keys are exchanged through the server, but the server only sees *public keys*—it can never derive the shared secret.
49+
50+
3. **Encrypted Payloads**: All session data—commands, outputs, AI responses—is encrypted with **ChaCha20-Poly1305** before leaving your machine. The server relays encrypted blobs it cannot read.
51+
52+
4. **Zero Knowledge**: Even if the server is compromised, attackers get *nothing* of value—just encrypted gibberish.
53+
54+
## What This Protects
55+
56+
| Threat | Protected? |
57+
|--------|-----------|
58+
| Server logs your code | ✅ Encrypted |
59+
| Malicious insider at GPTCode | ✅ Can't read payloads |
60+
| Man-in-the-middle attack | ✅ Encryption + auth |
61+
| Server injects commands | ✅ Only your browser has the key |
62+
| Data breach on server | ✅ Only encrypted blobs stored |
63+
64+
## The Trade-offs
65+
66+
Let's be honest—E2E encryption isn't free:
67+
68+
- **No server-side history**: We can't store your session transcripts for later (because we can't read them!)
69+
- **Per-session keys**: A new key pair for each session means no persistent encrypted storage
70+
- **Browser compatibility**: Requires modern browsers with Web Crypto support
71+
72+
But for teams handling sensitive code, these trade-offs are worth it.
73+
74+
## How to Enable Private Mode
75+
76+
```bash
77+
# When connecting to Live Dashboard
78+
gptcode context live --private
79+
80+
# Or in your config
81+
echo "live:
82+
encryption: true" >> ~/.gptcode/config.yml
83+
```
84+
85+
Once enabled, you'll see a 🔒 icon in your session, and the CLI will show:
86+
87+
```
88+
✅ E2E encryption enabled
89+
Agent fingerprint: A1B2C3D4E5F6G7H8
90+
Browser fingerprint: Z9Y8X7W6V5U4T3S2
91+
```
92+
93+
**Verify the fingerprints match** on first connection (Trust On First Use).
94+
95+
## The Technical Stack
96+
97+
For the curious, here's what we're using:
98+
99+
| Component | Algorithm |
100+
|-----------|-----------|
101+
| Key Exchange | X25519 (ECDH) |
102+
| Symmetric Encryption | XChaCha20-Poly1305 |
103+
| Browser Fallback | libsodium.js |
104+
| Nonce Generation | Random 24 bytes |
105+
106+
We chose these because:
107+
- **X25519**: Fast, secure, well-audited. Used by WireGuard, Signal, SSH.
108+
- **XChaCha20-Poly1305**: Extended nonce prevents birthday attacks. No IV reuse worries.
109+
- **libsodium**: When native Web Crypto isn't available, we fall back to the gold-standard crypto library.
110+
111+
## Open Source Transparency
112+
113+
Our encryption implementation is **fully open source**:
114+
115+
- CLI: [`internal/crypto/e2e.go`](https://github.com/gptcode-cloud/cli)
116+
- Browser: [`priv/static/js/crypto.js`](https://github.com/gptcode-cloud/live)
117+
118+
We encourage security audits and contributions. If you find a vulnerability, please [report it responsibly](mailto:security@gptcode.app).
119+
120+
## The Bottom Line
121+
122+
AI coding assistants are becoming essential tools. But convenience shouldn't come at the cost of security.
123+
124+
With Private Mode, GPTCode proves you can have **both**:
125+
- Remote access from any device ✅
126+
- Team collaboration features ✅
127+
- **Zero-knowledge privacy** ✅
128+
129+
Your code stays yours. Even we can't read it.
130+
131+
---
132+
133+
*Try Private Mode today: `gptcode context live --private`*
134+
135+
*Questions? [Join our Discord](https://discord.gg/gptcode) or [open an issue](https://github.com/gptcode-cloud/cli/issues).*

0 commit comments

Comments
 (0)