gdkbox 0.1.5 → 0.1.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 851b8b309a5e04c8e48d1090e45453b0f8464779a0d1cb30aaa69e5edf0829fe
-  data.tar.gz: 01af5d8bd6d09cca936bf801f22a82ff143e4357b86ce47dc6478659d19d3f9e
+  metadata.gz: 75c5c8ed1f89cb877856f68e45c39f4b5460131ea5a312e5af10e7cb7de2688b
+  data.tar.gz: a0eb3697bb1b630665be5799d33ffb8bb4aec0999858e075861e3469bd312431
 SHA512:
-  metadata.gz: 9a5201a873d0f54c7864f2e746e7077ea406f12f6ffce032280579ab1241d74fd743e6a4376204d89aa73bb75f30cdb697cc9bb99e3253e5f819d9e03d0adf17
-  data.tar.gz: 569e92b7c9d527932912790e6a0e2b48be01920d5bd29cd80788673827adc17a2230fcd66f212f006b704f5e8b8b7fcee4154d0d7d502ff87e470d7b10afca31
+  metadata.gz: 344bba38a105dcf4bf899893d18eb7ef9f82ef03ef6d2229af810346e27f18b24c46e09c02c7f83e406255f79e8d033ff37c159ced868aad284e540c6cf7948c
+  data.tar.gz: ce33e8b7bd1aa403ea5fe77127b7c46fd1c4eb7079736689cc6447b6b0649bd270b880db82d31a33bb0d090f818366b1e2de847e6b3d70f918dbae257200014a

data/README.md

@@ -26,7 +26,7 @@ gdkbox ls               # list your boxes and their status
    ┌──────────────┼─────────────────────────────────────────────┐
    │              ▼                                               │
    │   1. docker pull  <official GDK image>                       │
-   │   2. docker run   -p 127.0.0.1:2222:22  -p 127.0.0.1:3000:3000
+   │   2. docker run   --hostname gdk.local  -p 127.0.0.1:2222:22  -p 127.0.0.1:3000:3000
    │   3. provision    install + start sshd, authorize gdkbox key │
    │   4. provision    npm install -g @anthropic-ai/claude-code   │
    │   5. register     Host gdkbox-demo  ->  ~/.gdkbox/ssh_config  │
@@ -89,6 +89,9 @@ Or run it straight from the checkout without installing:
 | `gdkbox ssh NAME` | Open an interactive SSH session into the box. |
 | `gdkbox claude NAME` | Install Claude Code inside the box. |
 | `gdkbox set-key NAME` | Seed/rotate the Anthropic API key in the box for unattended dispatch. |
+| `gdkbox set-host` | Add the `gdk.local` entry to your `/etc/hosts` so box web UIs resolve (`--remove` to undo). Also runs during `up`. |
+| `gdkbox set-git NAME` | Seed your git identity (`user.name`/`user.email`) into the box so `git commit` works. Also runs during `up`. |
+| `gdkbox set-remote NAME [REMOTE]` | Point the box's GitLab checkout at a different remote (URL or `namespace/project`, e.g. `gitlab-org/gitlab`); default from config.yml. |
 | `gdkbox start NAME` | Start a stopped box (and re-enable SSH). |
 | `gdkbox stop NAME` | Stop a running box. |
 | `gdkbox rm NAME` | Remove a box: container, metadata, and SSH entry. |
@@ -104,11 +107,12 @@ Or run it straight from the checkout without installing:
 | Option | Default | Description |
 | --- | --- | --- |
 | `--image` | official GDK image | Override the container image. |
-| `--ssh-port` | next free from 2222 | Host port to publish SSH on. |
-| `--web-port` | next free from 3000 | Host port to publish the GDK web UI on. |
+| `--ssh-port` | next free from 2222 | Host port to publish SSH on. Auto-allocation skips ports in use on the host (e.g. a local GDK). |
+| `--web-port` | next free from 3000 | Host port to publish the GDK web UI on. Auto-allocation skips ports in use on the host. |
 | `--harness ID` | `claude` (or config.yml) | Agent harness to install: claude, codex, opencode, pi. |
 | `--no-agent` | (agent installed) | Skip installing the agent harness. |
 | `--skill NAME [NAME...]` | (none) | Seed skill(s) into the box at creation for dispatched agents. |
+| `--gitlab-remote REMOTE` | config.yml, else image default | Point the GitLab checkout at this remote (URL or `namespace/project`); the image ships pointing at the community mirror. |
 
 ## Typical workflow
 

data/lib/gdkbox/box.rb

@@ -104,6 +104,10 @@ module GDKBox
         @docker.run_container(
           name: cname,
           image: image,
+          # GDK's services resolve and redirect to this hostname; without it
+          # set inside the container, workhorse and the http-router crash-loop
+          # on DNS timeouts.
+          hostname: Config::GDK_HOSTNAME,
           publish: [
             "127.0.0.1:#{ssh_port}:#{Config::SSH_CONTAINER_PORT}",
             "127.0.0.1:#{web_port}:#{Config::GDK_WEB_CONTAINER_PORT}"
@@ -133,6 +137,15 @@ module GDKBox
       )
       @store.save(@data)
 
+      # Best-effort: a host without a git identity (or a transient exec
+      # failure) should not abort the box; `gdkbox set-git` can seed it later.
+      begin
+        git_name, git_email = host_git_identity
+        provisioner.setup_git_identity(cname, name: git_name, email: git_email) if git_name || git_email
+      rescue StandardError
+        nil
+      end
+
       provisioner.setup_agent(cname, harness) if install_agent
       @data["agent_installed"] = install_agent
 
@@ -162,6 +175,41 @@ module GDKBox
       @store.delete(name)
     end
 
+    # The full git URL for a remote given as a URL or a "namespace/project"
+    # shorthand (expanded against gitlab.com over SSH, so pushes ride the
+    # forwarded agent).
+    def self.expand_remote(token)
+      return token if token.include?("://") || token.include?(":")
+
+      "git@gitlab.com:#{token}.git"
+    end
+
+    # Point the box's GitLab checkout at a different remote (URL or
+    # "namespace/project"). Returns the URL that origin now uses.
+    def set_gitlab_remote!(remote)
+      url = self.class.expand_remote(remote)
+      Provisioner.new(docker: @docker, config: @config)
+        .setup_gitlab_remote(container_name, url)
+      url
+    end
+
+    # Seed a git identity into the box so `git commit` works there. Falls back
+    # to the host's `git config` when name/email are not given; raises when
+    # neither source has anything to seed. Returns the [name, email] seeded.
+    def set_git_identity!(git_name: nil, git_email: nil)
+      host_name, host_email = host_git_identity
+      git_name ||= host_name
+      git_email ||= host_email
+      if git_name.nil? && git_email.nil?
+        raise Error, "No git identity found. Pass --name/--email or set " \
+          "`git config --global user.name/user.email` on the host."
+      end
+
+      Provisioner.new(docker: @docker, config: @config)
+        .setup_git_identity(container_name, name: git_name, email: git_email)
+      [git_name, git_email]
+    end
+
     # (Re)install this box's agent harness inside the container.
     def install_agent!
       Provisioner.new(docker: @docker, config: @config).setup_agent(container_name, harness)
@@ -263,11 +311,28 @@ module GDKBox
 
     private
 
+    # The host's git identity as [name, email], each nil when unset.
+    def host_git_identity
+      read = lambda do |key|
+        value = @shell.run("git", "config", "--get", key).stdout.strip
+        value.empty? ? nil : value
+      end
+      [read.call("user.name"), read.call("user.email")]
+    end
+
     # Choose free host ports and persist a preliminary record claiming them,
     # all while holding an exclusive lock so concurrent `create!` calls in
     # separate processes serialize and cannot pick the same ports. Returns the
-    # chosen [ssh_port, web_port]. Caller-supplied ports are honored as-is.
+    # chosen [ssh_port, web_port]. Caller-supplied ports are honored, but fail
+    # fast with a clear message when something already holds them — better
+    # than the cryptic bind error `docker run` would produce later.
     def reserve_ports!(cname, ssh_port, web_port)
+      { "--ssh-port" => ssh_port, "--web-port" => web_port }.each do |flag, port|
+        if port && Ports.bound?(port)
+          raise Error, "Port #{port} (#{flag}) is already in use on 127.0.0.1."
+        end
+      end
+
       @config.ensure_dirs!
       File.open(@config.lock_path, File::RDWR | File::CREAT, 0o644) do |lock|
         lock.flock(File::LOCK_EX)
@@ -286,10 +351,14 @@ module GDKBox
       end
     end
 
+    # The next port at or above base that is neither recorded by gdkbox nor
+    # actually bound on the host. The store only covers gdkbox's own boxes;
+    # a locally running GDK (typically on 2222/3000) is invisible to it, so
+    # each candidate is also probed with a real bind.
     def next_port(base, exclude: [])
       used = @store.used_ports + exclude
       port = base
-      port += 1 while used.include?(port)
+      port += 1 while used.include?(port) || Ports.bound?(port)
       port
     end
   end

data/lib/gdkbox/cli.rb

@@ -37,6 +37,9 @@ module GDKBox
       desc: "Skill name(s) or path(s) to install into the box for dispatched agents"
     option :default_skills, type: :boolean, default: true,
       desc: "Also install the default skills from ~/.gdkbox/config.yml"
+    option :gitlab_remote, type: :string,
+      desc: "Point the GitLab checkout at this remote (URL or namespace/project; " \
+        "default from config.yml, else the image's community mirror)"
     def up(name)
       ensure_docker!
       box = build_box(name)
@@ -55,12 +58,15 @@ module GDKBox
       )
       rewrite_ssh_config
       seed_skills(box)
+      repoint_gitlab_remote(box)
 
       if options[:json]
         puts JSON.generate(box.summary)
         return
       end
 
+      setup_host
+
       say "\nBox '#{name}' is up.", :green
       print_connection_details(box)
       unless api_key
@@ -234,6 +240,94 @@ module GDKBox
     end
     map "set-key" => :set_key
 
+    desc "set-git NAME", "Seed your git identity (user.name/email) into the box"
+    long_desc <<~DESC
+      Copies your git identity into the box's global git config so `git
+      commit` works there. Defaults to the host's `git config user.name` and
+      `user.email`; override either with --name/--email. Runs automatically
+      during `gdkbox up`, so this is mainly for boxes created before that or
+      for changing the identity later.
+
+      Pushing uses your host's ssh-agent, forwarded into interactive sessions
+      (`gdkbox ssh` / VS Code) by the generated SSH config — no keys or tokens
+      are stored in the box.
+    DESC
+    option :name, type: :string, desc: "git user.name to seed (defaults to the host's)"
+    option :email, type: :string, desc: "git user.email to seed (defaults to the host's)"
+    def set_git(name)
+      box = load_box!(name)
+      git_name, git_email = box.set_git_identity!(
+        git_name: options[:name], git_email: options[:email]
+      )
+      say "Seeded git identity into '#{name}': #{[git_name, git_email].compact.join(' <')}#{'>' if git_email}", :green
+    end
+    map "set-git" => :set_git
+
+    desc "set-remote NAME [REMOTE]", "Point the box's GitLab checkout at a different remote"
+    long_desc <<~DESC
+      The GDK-in-a-box image clones GitLab from the community mirror
+      (gitlab-community/gitlab-org/gitlab). This repoints the checkout's
+      origin — pass a full git URL or a namespace/project shorthand (expanded
+      to git@gitlab.com:namespace/project.git), or set `gitlab_remote:` in
+      ~/.gdkbox/config.yml and omit REMOTE. Runs `git remote set-url` plus a
+      fetch inside the box; `gdkbox up` does the same automatically when a
+      remote is configured. Pushing uses your forwarded ssh-agent and your own
+      permissions — no credentials are stored in the box.
+    DESC
+    def set_remote(name, remote = nil)
+      box = load_box!(name)
+      remote ||= config.default_gitlab_remote
+      unless remote
+        raise Error, "No remote. Pass REMOTE (URL or namespace/project) " \
+          "or set `gitlab_remote:` in ~/.gdkbox/config.yml."
+      end
+
+      say "Pointing '#{name}' GitLab checkout at #{Box.expand_remote(remote)} (fetching)...", :green
+      url = box.set_gitlab_remote!(remote)
+      say "origin now #{url}.", :green
+    end
+    map "set-remote" => :set_remote
+
+    desc "set-host", "Add (default) or remove the gdk.local entry in /etc/hosts"
+    long_desc <<~DESC
+      GDK generates URLs and redirects that use the `gdk.local` hostname, so
+      your browser needs it mapped to loopback to reach a box's web UI. This
+      adds `#{HostsFile::ENTRY}` to /etc/hosts when no gdk.local entry exists
+      yet (writing needs sudo, so you may be prompted). `gdkbox up` runs the
+      same check automatically.
+
+      With --remove, the gdkbox-managed entry is removed again; lines you
+      added yourself are never touched.
+    DESC
+    option :add, type: :boolean, default: true, desc: "Add the entry (the default action)"
+    option :remove, type: :boolean, default: false,
+      desc: "Remove the gdkbox-managed entry instead"
+    def set_host
+      hosts = HostsFile.new
+      if options[:remove]
+        case hosts.remove
+        when :absent
+          say "No gdkbox-managed '#{HostsFile::HOSTNAME}' entry in #{hosts.path}. Nothing to do."
+        when :removed
+          say "Removed the '#{HostsFile::HOSTNAME}' entry from #{hosts.path}.", :green
+        when :manual
+          say "Could not write #{hosts.path}. Remove the line tagged " \
+            "'#{HostsFile::MARKER}' manually (e.g. with `sudoedit #{hosts.path}`).", :yellow
+        end
+      else
+        case hosts.add
+        when :present
+          say "'#{HostsFile::HOSTNAME}' already resolves via #{hosts.path}. Nothing to do."
+        when :added
+          say "Added '#{HostsFile::ENTRY}' to #{hosts.path}.", :green
+        when :manual
+          say "Could not write #{hosts.path}. Add the entry manually:", :yellow
+          say "  echo '#{HostsFile::ENTRY}' | sudo tee -a #{hosts.path}", :yellow
+        end
+      end
+    end
+    map "set-host" => :set_host
+
     desc "start NAME", "Start a stopped box (and re-enable SSH)"
     def start(name)
       box = load_box!(name)
@@ -370,6 +464,45 @@ module GDKBox
       end
     end
 
+    # Point the new box's GitLab checkout at the configured remote, when one
+    # is set (--gitlab-remote wins over config.yml; no setting keeps the
+    # image's community mirror). Best-effort like seed_skills: the box is
+    # already up, so a bad remote should warn, not abort. Muted in JSON mode.
+    def repoint_gitlab_remote(box)
+      remote = options[:gitlab_remote] || config.default_gitlab_remote
+      return unless remote
+
+      url = box.set_gitlab_remote!(remote)
+      say "Pointed the GitLab checkout at #{url}.", :green unless options[:json]
+    rescue StandardError => e
+      unless options[:json]
+        say "Could not repoint the GitLab checkout: #{e.message}", :yellow
+        say "  Retry later with: gdkbox set-remote #{box.name} #{remote}", :yellow
+      end
+    end
+
+    # Ensure gdk.local resolves on the host so the box's web UI is reachable
+    # (GDK redirects to that hostname). Adding the entry needs sudo, so warn
+    # before any password prompt appears. Failures are non-fatal: the box is
+    # already up, and the user can run `gdkbox set-host` later. Skipped in
+    # --json mode, where prompting would break unattended orchestrators.
+    def setup_host
+      hosts = HostsFile.new
+      return if hosts.entry?
+
+      say "\nAdding '#{HostsFile::HOSTNAME}' to #{hosts.path} so the web UI resolves " \
+        "(may prompt for sudo)...", :green
+      case hosts.add
+      when :added
+        say "Added '#{HostsFile::ENTRY}' to #{hosts.path}.", :green
+      when :manual
+        say "Could not write #{hosts.path}. Run `gdkbox set-host`, or add it manually:", :yellow
+        say "  echo '#{HostsFile::ENTRY}' | sudo tee -a #{hosts.path}", :yellow
+      end
+    rescue StandardError => e
+      say "Skipped #{hosts.path} setup: #{e.message}", :yellow
+    end
+
     # Show the discovered skills and let the user pick by number (or "all").
     def prompt_for_skills
       found = Skills.discover
@@ -432,7 +565,7 @@ module GDKBox
       say ""
       say "  SSH:       ssh #{box.ssh_host_alias}", :cyan
       say "  VS Code:   gdkbox code #{box.name}", :cyan
-      say "  Web UI:    #{box.web_url}", :cyan
+      say "  Web UI:    #{box.web_url} (http://#{HostsFile::HOSTNAME}:#{box.web_port})", :cyan
       say "  Agent:     ssh #{box.ssh_host_alias} -t #{box.harness.bin}", :cyan
     end
   end

data/lib/gdkbox/completion.rb

@@ -11,7 +11,8 @@ module GDKBox
     SHELLS = %w[bash zsh].freeze
 
     # Subcommands whose first positional argument is an existing box.
-    BOX_COMMANDS = %w[status dispatch ssh code install-agent set-key start stop rm add-skill].freeze
+    BOX_COMMANDS = %w[status dispatch ssh code install-agent set-key set-git set-remote start
+      stop rm add-skill].freeze
 
     def initialize(cli_class = CLI)
       @cli = cli_class

data/lib/gdkbox/config.rb

@@ -14,6 +14,7 @@ module GDKBox
   #
   #   # ~/.gdkbox/config.yml
   #   image: registry.example.com/my-gdk:latest   # default image for `up`
+  #   gitlab_remote: gitlab-org/gitlab             # repoint the GitLab checkout
   #   skills:                                      # transferred into every box
   #     - gdkbox-fleet
   #     - code-history
@@ -22,6 +23,12 @@ module GDKBox
     DEFAULT_IMAGE =
       "registry.gitlab.com/gitlab-org/gitlab-development-kit/gitlab-gdk-in-a-box:main"
 
+    # The hostname GDK is configured for. It is set as the container's own
+    # hostname (so services inside the box can resolve it) and mapped to
+    # loopback in the host's /etc/hosts by HostsFile (so the host browser can
+    # follow GDK's redirects to it).
+    GDK_HOSTNAME = "gdk.local"
+
     CONTAINER_PREFIX = "gdkbox-"
     HOST_ALIAS_PREFIX = "gdkbox-"
 
@@ -96,6 +103,19 @@ module GDKBox
       key.empty? ? Harness.default : key
     end
 
+    # The git remote to point each box's GitLab checkout at, from config.yml
+    # (`gitlab_remote:`), or nil to keep the image's default (the community
+    # mirror). A URL or a "namespace/project" shorthand.
+    def default_gitlab_remote
+      remote = file_settings["gitlab_remote"].to_s.strip
+      remote.empty? ? nil : remote
+    end
+
+    # Where the GitLab repository lives inside the box.
+    def gitlab_checkout_path
+      File.join(remote_path, "gitlab")
+    end
+
     # An API key read from config.yml under `config_key` (e.g.
     # "anthropic_api_key", "openai_api_key"), or nil. This is a plaintext
     # secret on disk, so it is the lowest-priority source (a flag or the

data/lib/gdkbox/docker.rb

@@ -192,9 +192,13 @@ module GDKBox
       end
     end
 
-    # Start a detached container, returning its id.
-    def run_container(name:, image:, publish: [], labels: {}, env: {}, args: [])
+    # Start a detached container, returning its id. When a hostname is given,
+    # Docker also maps it to the container's IP in the container's /etc/hosts
+    # and re-applies that mapping on every start (a manual edit would be lost:
+    # Docker regenerates the file when the container starts).
+    def run_container(name:, image:, publish: [], labels: {}, env: {}, args: [], hostname: nil)
       cmd = ["docker", "run", "-d", "--name", name]
+      cmd.push("--hostname", hostname) if hostname
       labels.each { |key, value| cmd.push("--label", "#{key}=#{value}") }
       env.each { |key, value| cmd.push("-e", "#{key}=#{value}") }
       publish.each { |mapping| cmd.push("-p", mapping) }

data/lib/gdkbox/hosts_file.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module GDKBox
+  # Manages the gdk.local entry in the host's /etc/hosts.
+  #
+  # GDK generates URLs and redirects that use the `gdk.local` hostname, so the
+  # host's browser needs it mapped to loopback to reach a box's web UI. The
+  # line gdkbox adds is tagged with a marker comment so it can be recognized
+  # and removed later without touching entries the user wrote themselves.
+  #
+  # /etc/hosts is root-owned: writes are attempted directly first (covers
+  # tests and unusual setups), then via `sudo tee`. Callers get a symbol
+  # describing what happened — :present/:added/:removed/:absent/:manual —
+  # and decide how to talk to the user; :manual means nothing was changed
+  # and the user has to edit the file themselves.
+  class HostsFile
+    HOSTNAME = Config::GDK_HOSTNAME
+    MARKER = "# added by gdkbox"
+    ENTRY = "127.0.0.1 #{HOSTNAME} #{MARKER}"
+
+    attr_reader :path
+
+    def initialize(path: "/etc/hosts", shell: Shell.new)
+      @path = path
+      @shell = shell
+    end
+
+    # Whether any active (non-comment) line already maps HOSTNAME, regardless
+    # of who added it — a user's own entry counts, so we never duplicate it.
+    def entry?
+      return false unless File.readable?(path)
+
+      File.foreach(path).any? { |line| maps_hostname?(line) }
+    end
+
+    # Ensure the entry exists. Returns :present when it already does, :added
+    # on success, or :manual when the file could not be written (with sudo
+    # declined/failed or disabled).
+    def add(sudo: true)
+      return :present if entry?
+
+      File.open(path, "a") { |f| f.puts(ENTRY) }
+      :added
+    rescue Errno::EACCES
+      return :manual unless sudo
+
+      result = @shell.run("sudo", "tee", "-a", path, input: "#{ENTRY}\n")
+      result.success? ? :added : :manual
+    end
+
+    # Remove the gdkbox-managed entry (matched by MARKER; user-written lines
+    # are never touched). Returns :absent when there is nothing to remove,
+    # :removed on success, or :manual when the file could not be written.
+    def remove(sudo: true)
+      lines = File.readable?(path) ? File.readlines(path) : []
+      kept = lines.reject { |line| managed?(line) }
+      return :absent if kept.size == lines.size
+
+      content = kept.join
+      begin
+        File.write(path, content)
+        :removed
+      rescue Errno::EACCES
+        return :manual unless sudo
+
+        result = @shell.run("sudo", "tee", path, input: content)
+        result.success? ? :removed : :manual
+      end
+    end
+
+    private
+
+    # Does this line actively map HOSTNAME? Comments are stripped first, so a
+    # commented-out entry does not count.
+    def maps_hostname?(line)
+      fields = line.sub(/#.*/, "").split
+      fields.length >= 2 && fields[1..].include?(HOSTNAME)
+    end
+
+    def managed?(line)
+      line.include?(MARKER) && line.include?(HOSTNAME)
+    end
+  end
+end

data/lib/gdkbox/ports.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require "socket"
+
+module GDKBox
+  # Answers whether a host port is actually usable.
+  #
+  # gdkbox's metadata store only knows about ports gdkbox itself allocated;
+  # anything else on the machine — typically a locally running GDK on 2222 and
+  # 3000 — is invisible to it. Binding is the authoritative test: gdkbox
+  # publishes container ports on 127.0.0.1, so try to bind exactly there.
+  module Ports
+    module_function
+
+    # True when something on the host already holds the port (or the bind is
+    # not permitted, which is just as unusable for publishing).
+    def bound?(port)
+      TCPServer.new("127.0.0.1", port).close
+      false
+    rescue SystemCallError
+      true
+    end
+  end
+end

data/lib/gdkbox/provisioner.rb

@@ -131,6 +131,27 @@ module GDKBox
       done
     BASH
 
+    # Seeds the GDK user's global git identity so `git commit` works inside
+    # the box. Values arrive via the environment (dodging shell quoting) and
+    # blanks are skipped, so a partial host config seeds what it can.
+    GIT_IDENTITY_SETUP = <<~'BASH'
+      set -e
+      [ -n "$GDKBOX_GIT_NAME" ] && git config --global user.name "$GDKBOX_GIT_NAME"
+      [ -n "$GDKBOX_GIT_EMAIL" ] && git config --global user.email "$GDKBOX_GIT_EMAIL"
+      true
+    BASH
+
+    # Points the GitLab checkout's origin at a different repository. The image
+    # hardcodes the community mirror (gitlab-community/gitlab-org/gitlab);
+    # team members typically want the canonical gitlab-org/gitlab. The mirror
+    # shares its history, so a set-url plus fetch is all it takes (the
+    # checkout is treeless, keeping the fetch cheap).
+    GITLAB_REMOTE_SETUP = <<~'BASH'
+      set -e
+      git remote set-url origin "$GDKBOX_GITLAB_REMOTE"
+      git fetch --quiet origin
+    BASH
+
     def initialize(docker:, config:)
       @docker = docker
       @config = config
@@ -168,6 +189,26 @@ module GDKBox
       )
     end
 
+    def setup_git_identity(container_name, name:, email:)
+      @docker.exec(
+        container_name, GIT_IDENTITY_SETUP,
+        user: @config.ssh_user,
+        env: {
+          "GDKBOX_GIT_NAME" => name.to_s,
+          "GDKBOX_GIT_EMAIL" => email.to_s
+        }
+      )
+    end
+
+    def setup_gitlab_remote(container_name, url)
+      @docker.exec(
+        container_name, GITLAB_REMOTE_SETUP,
+        user: @config.ssh_user,
+        workdir: @config.gitlab_checkout_path,
+        env: { "GDKBOX_GITLAB_REMOTE" => url }
+      )
+    end
+
     def setup_api_key(container_name, api_key, key_env)
       @docker.exec(
         container_name, API_KEY_SETUP,

data/lib/gdkbox/ssh_config.rb

@@ -32,6 +32,11 @@ module GDKBox
         lines << "  User #{box['ssh_user']}"
         lines << "  IdentityFile #{@config.private_key_path}"
         lines << "  IdentitiesOnly yes"
+        # Forward the host's ssh-agent so `git push` inside the box uses the
+        # user's own keys — which never enter the container, and are only
+        # reachable while a human session is connected (dispatched agents run
+        # via `docker exec` and never see the agent).
+        lines << "  ForwardAgent yes"
         lines << "  StrictHostKeyChecking no"
         lines << "  UserKnownHostsFile /dev/null"
         lines << ""

data/lib/gdkbox/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module GDKBox
-  VERSION = "0.1.5"
+  VERSION = "0.1.10"
 end

data/lib/gdkbox.rb

@@ -10,6 +10,8 @@ require "gdkbox/shell"
 require "gdkbox/progress_bar"
 require "gdkbox/config"
 require "gdkbox/docker"
+require "gdkbox/hosts_file"
+require "gdkbox/ports"
 require "gdkbox/store"
 require "gdkbox/ssh_key"
 require "gdkbox/ssh_config"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gdkbox
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.1.10
 platform: ruby
 authors:
 - jotolo
@@ -62,6 +62,8 @@ files:
 - lib/gdkbox/config.rb
 - lib/gdkbox/docker.rb
 - lib/gdkbox/harness.rb
+- lib/gdkbox/hosts_file.rb
+- lib/gdkbox/ports.rb
 - lib/gdkbox/progress_bar.rb
 - lib/gdkbox/provisioner.rb
 - lib/gdkbox/shell.rb