Support custom base container image in openhands-app container

[li-boxuan]

End-user friendly description of the problem this fixes or functionality that this introduces

Support custom base container image in openhands-app container, e.g.

docker run -it --pull=always \
    -e SANDBOX_BASE_CONTAINER_IMAGE=python:3.12 \
    -e LOG_ALL_EVENTS=true \
    -e RUN_AS_OPENHANDS=false \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -v ~/.openhands:/home/openhands/.openhands \
    -p 3000:3000 \
    --add-host host.docker.internal:host-gateway \
    --name openhands-app \
    docker.all-hands.dev/all-hands-ai/openhands:e27a522

• [x] Include this change in the Release Notes. If checked, you must provide an end-user friendly description for your change below

Support custom base container image when running OpenHands in Docker

---

Give a summary of what the PR does, explaining any non-trivial design decisions

I do understand that it was reported by some Linux users that

We added docker inside the app container and it broke a bunch of other stuff. Especially for linux users so we reverted.

thus the current PR, which downloads docker on the fly and thus cannot be worse than the status quo (not able to use custom runtime at all). At least it works for my Mac.

I understand we need doc for this feature, but I'd like to hand over doc work to OpenHands.

---

Link of any specific issues this addresses

Fixes #6001

---

To run this PR locally, use the following command:

docker run -it --rm   -p 3000:3000   -v /var/run/docker.sock:/var/run/docker.sock   --add-host host.docker.internal:host-gateway   -e SANDBOX_RUNTIME_CONTAINER_IMAGE=docker.all-hands.dev/all-hands-ai/runtime:e27a522-nikolaik   --name openhands-app-e27a522   docker.all-hands.dev/all-hands-ai/openhands:e27a522

[li-boxuan]

The image build part now works for me (to build a runtime image on top of ghcr.io/theagentcompany/pm-ask-for-issue-and-create-in-gitlab-image:1.0.0), but somehow I have some trouble with the built image with some chromium dependency problems. The latest main branch doesn't work for me either.

Now trying to time travel to an old version and see if it works...

UPDATE: 0.14 version, which I am pretty sure used to work, no longer works either. I am not sure if it's my own laptop's environment issue, OR anything else (e.g. something in my custom image has a conflict with openhands):

UPDATE2: Tested this PR with custom runtime python:3.12 and it worked as expected (no nodejs environment) with the following command:

docker run -it --pull=always \
    -e SANDBOX_BASE_CONTAINER_IMAGE=python:3.12 \
    -e LOG_ALL_EVENTS=true \
    -e RUN_AS_OPENHANDS=false \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -v ~/.openhands:/home/openhands/.openhands \
    -p 3000:3000 \
    --add-host host.docker.internal:host-gateway \
    --name openhands-app \
    docker.all-hands.dev/all-hands-ai/openhands:e27a522

As a comparison, the default runtime image DOES have nodejs environment:

[amirshawn]

Hi @li-boxuan I see 0.20.0 includes your fixes for the custom sandbox image. How do you recommend starting Open Hands with a custom sandbox image?

[li-boxuan]

Hi @li-boxuan I see 0.20.0 includes your fixes for the custom sandbox image. How do you recommend starting Open Hands with a custom sandbox image?

docker run -it --pull=always \
    -e SANDBOX_BASE_CONTAINER_IMAGE=<your-custom-image-name> \
    -e LOG_ALL_EVENTS=true \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -v ~/.openhands-state:/.openhands-state \
    -p 3000:3000 \
    --add-host host.docker.internal:host-gateway \
    --name openhands-app \
    docker.all-hands.dev/all-hands-ai/openhands:0.20

[amirshawn]

thank you. I am going to give it a try right now!

[amirshawn]

@li-boxuan This is the closest I've gotten!! The container built correctly and had access to PHP. The workspace was empty though. I added -e WORKSPACE_BASE= \ I am waiting for it to build. Is that the correct way? Does config.toml get completely ignored using this method?

[amirshawn]

same issue. I don't see anything in the file browser and when I ask the agent this is the response: It appears that the /workspace directory is currently empty (no visible files or directories up to 2 levels deep, excluding hidden items). Would you like me to check for any hidden files or perform any other operations in this directory?

[li-boxuan]

Does config.toml get completely ignored using this method?

Correct. If you'd like to use config.toml, to my best knowledge (which might be outdated already), you'd need to launch OpenHands from source code.

[li-boxuan]

It appears that the /workspace directory is currently empty

Do you see the same problem when you don't use -e SANDBOX_BASE_CONTAINER_IMAGE=<your-custom-image-name>? If so, then it's a different issue worth discussing somewhere else (maybe you are doing something wrong, I am not sure).

[amirshawn]

Should this be working to connect my sandbox? docker run -it --pull=always
-e SANDBOX_BASE_CONTAINER_IMAGE=laravel-test-02
-e WORKSPACE_BASE=/Users/amirshawn/code/marketplace
-e LOG_ALL_EVENTS=true
-v /var/run/docker.sock:/var/run/docker.sock
-v ~/.openhands-state:/.openhands-state
-p 3000:3000
--add-host host.docker.internal:host-gateway
--name openhands-app
docker.all-hands.dev/all-hands-ai/openhands:0.20

[amirshawn]

It appears that the /workspace directory is currently empty

Do you see the same problem when you don't use -e SANDBOX_BASE_CONTAINER_IMAGE=<your-custom-image-name>? If so, then it's a different issue worth discussing somewhere else (maybe you are doing something wrong, I am not sure).

I am trying this right now to see.

[amirshawn]

@li-boxuan I tried this: docker run -it --pull=always
-e LOG_ALL_EVENTS=true
-v /var/run/docker.sock:/var/run/docker.sock
-v ~/.openhands-state:/.openhands-state
-p 3000:3000
--add-host host.docker.internal:host-gateway
--name openhands-app
docker.all-hands.dev/all-hands-ai/openhands:0.20

same issue, empty sandbox.  I am trying this next:
docker run -it --pull=always \
-e WORKSPACE_BASE=/Users/amirshawn/code/marketplace \
-e LOG_ALL_EVENTS=true \
-v /var/run/docker.sock:/var/run/docker.sock \
-v ~/.openhands-state:/.openhands-state \
-p 3000:3000 \
--add-host host.docker.internal:host-gateway \
--name openhands-app \
docker.all-hands.dev/all-hands-ai/openhands:0.20

I am removing the images each time to be sure everything is fresh.

[amirshawn]

I think I see the issue. I should be adding this: -e SANDBOX_USER_ID=$(id -u)
-e WORKSPACE_MOUNT_PATH=$WORKSPACE_BASE
-v $WORKSPACE_BASE:/opt/workspace_base \

and then using the environmental variable.  I'm going to try this next.

[amirshawn]

@li-boxuan I can't thank you enough!! I finally have it working. For anyone else who encounters this:

First set the workspace base path

export WORKSPACE_BASE=

Then run the Docker command

docker run -it --pull=always
-e SANDBOX_BASE_CONTAINER_IMAGE=
-e SANDBOX_USER_ID=$(id -u)
-e WORKSPACE_MOUNT_PATH=$WORKSPACE_BASE
-v $WORKSPACE_BASE:/opt/workspace_base
-e LOG_ALL_EVENTS=true
-v /var/run/docker.sock:/var/run/docker.sock
-v ~/.openhands-state:/.openhands-state
-p 3000:3000
--add-host host.docker.internal:host-gateway
--name openhands-app
docker.all-hands.dev/all-hands-ai/openhands:0.20

[amirshawn]

not sure why anything I put in < was deleted but after export WORKSPACE_BASE= put your absolute path work your workspace and after SANDBOX_BASE_CONTAINER_IMAGE= put the name of your custom image.