Skip to content

[repo-health] Low: Unpinned @anthropic-ai/claude-code in Dockerfile — image rebuilds may silently break #9

Description

@Liohtml

Summary

assets/Dockerfile installs @anthropic-ai/claude-code (and tsx) globally with no version pin, so every agentbox rebuild or clean CI build pulls the latest release. A breaking Claude Code update will silently change a cached image without any version in the Dockerfile changing.

Category

Dependency

Severity

Low

Location

  • File: assets/Dockerfile
  • Line(s): 38 — RUN npm install -g @anthropic-ai/claude-code tsx \

Details

Without a pinned version, the installed Claude Code version is determined at image-build time by whatever npm resolves as latest. This creates two problems:

  1. Two developers who built their image at different times may have different Claude Code versions installed, making issues hard to reproduce.
  2. A newly released Claude Code version with a breaking change will affect the next agentbox rebuild with no visible diff in the repository.

Suggested Fix

Pin to a specific version in the Dockerfile:

RUN npm install -g @anthropic-ai/claude-code@<version> tsx@<version> \
    && npm cache clean --force

Check the current latest with npm view @anthropic-ai/claude-code version, then update the Dockerfile. Add a comment noting when it was last pinned and how to update it.

Effort Estimate

5 min


Automated finding by repo-health-agent v1.0

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions