fix: repair 11 more Dockerfiles — inline ccb-repo images, truncate Docker Hub tags, fix validation script

sjarmak · claude · sjarmak · commit 2a2a372dd0dc · 2026-02-21T13:27:58.000Z
- Inline ccb-repo-* base images into task Dockerfiles (docgen-runbook-002,
  envoy-arch-doc-gen-001, curl-cve-triage-001, curl-vuln-reachability-001)
  using git init+fetch+checkout pattern with ca-certificates
- Truncate openlibrary sweap-image tags to Docker Hub 128-char limit
  (fntocli-adapter, search-query, solr-boolean)
- Remove -vnan suffix from nodebb-notif-dropdown tag
- Remove broken Alpine apk upgrade block from 3 protonmail Dockerfiles
  (images still corrupted on Docker Hub — exec format error)
- Regenerate Dockerfile.artifact_only for all 11 tasks
- Fix validate_artifact_golden.py arg-too-long: use file-mount staging
  instead of base64-in-command injection

Co-Authored-By: Claude Opus 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/benchmarks/ccb_document/docgen-runbook-002/environment/Dockerfile b/benchmarks/ccb_document/docgen-runbook-002/environment/Dockerfile
@@ -1 +1,18 @@
-FROM ccb-repo-envoy-1d0ba73a
+FROM ubuntu:22.04
+
+WORKDIR /workspace
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    curl \
+    python3 \
+    ripgrep \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN git init && \
+    git remote add origin https://github.com/envoyproxy/envoy.git && \
+    git fetch --depth 1 origin 1d0ba73ad200d28e86c0c23f76c55320f82a8fba && \
+    git checkout FETCH_HEAD && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
diff --git a/benchmarks/ccb_document/docgen-runbook-002/environment/Dockerfile.artifact_only b/benchmarks/ccb_document/docgen-runbook-002/environment/Dockerfile.artifact_only
@@ -3,7 +3,24 @@
 # MCP agent deletes source files at runtime via agent startup script.
 # Verifier scores agent output only — no repo restore needed.
 
-FROM ccb-repo-envoy-1d0ba73a
+FROM ubuntu:22.04
+
+WORKDIR /workspace
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    curl \
+    python3 \
+    ripgrep \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN git init && \
+    git remote add origin https://github.com/envoyproxy/envoy.git && \
+    git fetch --depth 1 origin 1d0ba73ad200d28e86c0c23f76c55320f82a8fba && \
+    git checkout FETCH_HEAD && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
 # --- artifact_only mode ---
 # Sentinel flag for artifact-based verification.
 # Source stays readable for baseline agent; MCP agent deletes at runtime.
diff --git a/benchmarks/ccb_document/envoy-arch-doc-gen-001/environment/Dockerfile b/benchmarks/ccb_document/envoy-arch-doc-gen-001/environment/Dockerfile
@@ -1 +1,18 @@
-FROM ccb-repo-envoy-1d0ba73a
+FROM ubuntu:22.04
+
+WORKDIR /workspace
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    curl \
+    python3 \
+    ripgrep \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN git init && \
+    git remote add origin https://github.com/envoyproxy/envoy.git && \
+    git fetch --depth 1 origin 1d0ba73ad200d28e86c0c23f76c55320f82a8fba && \
+    git checkout FETCH_HEAD && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
diff --git a/benchmarks/ccb_document/envoy-arch-doc-gen-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_document/envoy-arch-doc-gen-001/environment/Dockerfile.artifact_only
@@ -3,7 +3,24 @@
 # MCP agent deletes source files at runtime via agent startup script.
 # Verifier scores agent output only — no repo restore needed.
 
-FROM ccb-repo-envoy-1d0ba73a
+FROM ubuntu:22.04
+
+WORKDIR /workspace
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    curl \
+    python3 \
+    ripgrep \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN git init && \
+    git remote add origin https://github.com/envoyproxy/envoy.git && \
+    git fetch --depth 1 origin 1d0ba73ad200d28e86c0c23f76c55320f82a8fba && \
+    git checkout FETCH_HEAD && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
 # --- artifact_only mode ---
 # Sentinel flag for artifact-based verification.
 # Source stays readable for baseline agent; MCP agent deletes at runtime.
diff --git a/benchmarks/ccb_fix/nodebb-notif-dropdown-fix-001/environment/Dockerfile b/benchmarks/ccb_fix/nodebb-notif-dropdown-fix-001/environment/Dockerfile
@@ -2,7 +2,7 @@
 # Instance: instance_NodeBB__NodeBB-eb49a64974ca844bca061744fb3383f5d13b02ad-vnan
 # Repo: NodeBB/NodeBB
 
-FROM jefzda/sweap-images:nodebb.nodebb-NodeBB__NodeBB-eb49a64974ca844bca061744fb3383f5d13b02ad-vnan
+FROM jefzda/sweap-images:nodebb.nodebb-NodeBB__NodeBB-eb49a64974ca844bca061744fb3383f5d13b02ad
 
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
diff --git a/benchmarks/ccb_fix/nodebb-notif-dropdown-fix-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_fix/nodebb-notif-dropdown-fix-001/environment/Dockerfile.artifact_only
@@ -7,7 +7,7 @@
 # Instance: instance_NodeBB__NodeBB-eb49a64974ca844bca061744fb3383f5d13b02ad-vnan
 # Repo: NodeBB/NodeBB
 
-FROM jefzda/sweap-images:nodebb.nodebb-NodeBB__NodeBB-eb49a64974ca844bca061744fb3383f5d13b02ad-vnan
+FROM jefzda/sweap-images:nodebb.nodebb-NodeBB__NodeBB-eb49a64974ca844bca061744fb3383f5d13b02ad
 
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
diff --git a/benchmarks/ccb_fix/openlibrary-fntocli-adapter-fix-001/environment/Dockerfile b/benchmarks/ccb_fix/openlibrary-fntocli-adapter-fix-001/environment/Dockerfile
@@ -2,7 +2,7 @@
 # Instance: instance_internetarchive__openlibrary-c506c1b0b678892af5cb22c1c1dbc35d96787a0a-v0f5aece3601a5b4419f7ccec1dbda2071be28ee4
 # Repo: internetarchive/openlibrary
 
-FROM jefzda/sweap-images:internetarchive.openlibrary-internetarchive__openlibrary-c506c1b0b678892af5cb22c1c1dbc35d96787a0a-v0f5aece3601a5b4419f7ccec1dbda2071be28ee4
+FROM jefzda/sweap-images:internetarchive.openlibrary-internetarchive__openlibrary-c506c1b0b678892af5cb22c1c1dbc35d96787a0a-v0f5aece3601a5b4419f7ccec1dbda
 
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
diff --git a/benchmarks/ccb_fix/openlibrary-fntocli-adapter-fix-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_fix/openlibrary-fntocli-adapter-fix-001/environment/Dockerfile.artifact_only
@@ -7,7 +7,7 @@
 # Instance: instance_internetarchive__openlibrary-c506c1b0b678892af5cb22c1c1dbc35d96787a0a-v0f5aece3601a5b4419f7ccec1dbda2071be28ee4
 # Repo: internetarchive/openlibrary
 
-FROM jefzda/sweap-images:internetarchive.openlibrary-internetarchive__openlibrary-c506c1b0b678892af5cb22c1c1dbc35d96787a0a-v0f5aece3601a5b4419f7ccec1dbda2071be28ee4
+FROM jefzda/sweap-images:internetarchive.openlibrary-internetarchive__openlibrary-c506c1b0b678892af5cb22c1c1dbc35d96787a0a-v0f5aece3601a5b4419f7ccec1dbda
 
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
diff --git a/benchmarks/ccb_fix/openlibrary-search-query-fix-001/environment/Dockerfile b/benchmarks/ccb_fix/openlibrary-search-query-fix-001/environment/Dockerfile
@@ -2,7 +2,7 @@
 # Instance: instance_internetarchive__openlibrary-7f6b722a10f822171501d027cad60afe53337732-ve8c8d62a2b60610a3c4631f5f23ed866bada9818
 # Repo: internetarchive/openlibrary
 
-FROM jefzda/sweap-images:internetarchive.openlibrary-internetarchive__openlibrary-7f6b722a10f822171501d027cad60afe53337732-ve8c8d62a2b60610a3c4631f5f23ed866bada9818
+FROM jefzda/sweap-images:internetarchive.openlibrary-internetarchive__openlibrary-7f6b722a10f822171501d027cad60afe53337732-ve8c8d62a2b60610a3c4631f5f23ed
 
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
diff --git a/benchmarks/ccb_fix/openlibrary-search-query-fix-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_fix/openlibrary-search-query-fix-001/environment/Dockerfile.artifact_only
@@ -7,7 +7,7 @@
 # Instance: instance_internetarchive__openlibrary-7f6b722a10f822171501d027cad60afe53337732-ve8c8d62a2b60610a3c4631f5f23ed866bada9818
 # Repo: internetarchive/openlibrary
 
-FROM jefzda/sweap-images:internetarchive.openlibrary-internetarchive__openlibrary-7f6b722a10f822171501d027cad60afe53337732-ve8c8d62a2b60610a3c4631f5f23ed866bada9818
+FROM jefzda/sweap-images:internetarchive.openlibrary-internetarchive__openlibrary-7f6b722a10f822171501d027cad60afe53337732-ve8c8d62a2b60610a3c4631f5f23ed
 
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
diff --git a/benchmarks/ccb_fix/openlibrary-solr-boolean-fix-001/environment/Dockerfile b/benchmarks/ccb_fix/openlibrary-solr-boolean-fix-001/environment/Dockerfile
@@ -2,7 +2,7 @@
 # Instance: instance_internetarchive__openlibrary-92db3454aeaa02f89b4cdbc3103f7e95c9759f92-v2c55207218fb8a0138425cbf7d9675272e240b90
 # Repo: internetarchive/openlibrary
 
-FROM jefzda/sweap-images:internetarchive.openlibrary-internetarchive__openlibrary-92db3454aeaa02f89b4cdbc3103f7e95c9759f92-v2c55207218fb8a0138425cbf7d9675272e240b90
+FROM jefzda/sweap-images:internetarchive.openlibrary-internetarchive__openlibrary-92db3454aeaa02f89b4cdbc3103f7e95c9759f92-v2c55207218fb8a0138425cbf7d967
 
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
diff --git a/benchmarks/ccb_fix/openlibrary-solr-boolean-fix-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_fix/openlibrary-solr-boolean-fix-001/environment/Dockerfile.artifact_only
@@ -7,7 +7,7 @@
 # Instance: instance_internetarchive__openlibrary-92db3454aeaa02f89b4cdbc3103f7e95c9759f92-v2c55207218fb8a0138425cbf7d9675272e240b90
 # Repo: internetarchive/openlibrary
 
-FROM jefzda/sweap-images:internetarchive.openlibrary-internetarchive__openlibrary-92db3454aeaa02f89b4cdbc3103f7e95c9759f92-v2c55207218fb8a0138425cbf7d9675272e240b90
+FROM jefzda/sweap-images:internetarchive.openlibrary-internetarchive__openlibrary-92db3454aeaa02f89b4cdbc3103f7e95c9759f92-v2c55207218fb8a0138425cbf7d967
 
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
diff --git a/benchmarks/ccb_fix/protonmail-conv-testhooks-fix-001/environment/Dockerfile b/benchmarks/ccb_fix/protonmail-conv-testhooks-fix-001/environment/Dockerfile
@@ -4,12 +4,6 @@
 
 FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-c6f65d205c401350a226bb005f42fac1754b0b5b
 
-# Upgrade Node.js from v16 (base image) to v18 (required by Claude Code >= 2.1.37)
-# Remove old Node, then install from Alpine 3.18+ repos (ships Node 18.x)
-RUN apk del nodejs nodejs-current npm 2>/dev/null || true; \
-    rm -f /usr/local/bin/node /usr/local/bin/npm /usr/local/bin/npx 2>/dev/null || true; \
-    apk add --no-cache nodejs npm
-
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
 
diff --git a/benchmarks/ccb_fix/protonmail-conv-testhooks-fix-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_fix/protonmail-conv-testhooks-fix-001/environment/Dockerfile.artifact_only
@@ -9,12 +9,6 @@
 
 FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-c6f65d205c401350a226bb005f42fac1754b0b5b
 
-# Upgrade Node.js from v16 (base image) to v18 (required by Claude Code >= 2.1.37)
-# Remove old Node, then install from Alpine 3.18+ repos (ships Node 18.x)
-RUN apk del nodejs nodejs-current npm 2>/dev/null || true; \
-    rm -f /usr/local/bin/node /usr/local/bin/npm /usr/local/bin/npx 2>/dev/null || true; \
-    apk add --no-cache nodejs npm
-
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
 
diff --git a/benchmarks/ccb_fix/protonmail-dropdown-sizing-fix-001/environment/Dockerfile b/benchmarks/ccb_fix/protonmail-dropdown-sizing-fix-001/environment/Dockerfile
@@ -4,12 +4,6 @@
 
 FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-8be4f6cb9380fcd2e67bcb18cef931ae0d4b869c
 
-# Upgrade Node.js from v16 (base image) to v18 (required by Claude Code >= 2.1.37)
-# Remove old Node, then install from Alpine 3.18+ repos (ships Node 18.x)
-RUN apk del nodejs nodejs-current npm 2>/dev/null || true; \
-    rm -f /usr/local/bin/node /usr/local/bin/npm /usr/local/bin/npx 2>/dev/null || true; \
-    apk add --no-cache nodejs npm
-
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
 
diff --git a/benchmarks/ccb_fix/protonmail-dropdown-sizing-fix-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_fix/protonmail-dropdown-sizing-fix-001/environment/Dockerfile.artifact_only
@@ -9,12 +9,6 @@
 
 FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-8be4f6cb9380fcd2e67bcb18cef931ae0d4b869c
 
-# Upgrade Node.js from v16 (base image) to v18 (required by Claude Code >= 2.1.37)
-# Remove old Node, then install from Alpine 3.18+ repos (ships Node 18.x)
-RUN apk del nodejs nodejs-current npm 2>/dev/null || true; \
-    rm -f /usr/local/bin/node /usr/local/bin/npm /usr/local/bin/npx 2>/dev/null || true; \
-    apk add --no-cache nodejs npm
-
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
 
diff --git a/benchmarks/ccb_fix/protonmail-holiday-calendar-fix-001/environment/Dockerfile b/benchmarks/ccb_fix/protonmail-holiday-calendar-fix-001/environment/Dockerfile
@@ -4,12 +4,6 @@
 
 FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-369fd37de29c14c690cb3b1c09a949189734026f
 
-# Upgrade Node.js from v16 (base image) to v18 (required by Claude Code >= 2.1.37)
-# Remove old Node, then install from Alpine 3.18+ repos (ships Node 18.x)
-RUN apk del nodejs nodejs-current npm 2>/dev/null || true; \
-    rm -f /usr/local/bin/node /usr/local/bin/npm /usr/local/bin/npx 2>/dev/null || true; \
-    apk add --no-cache nodejs npm
-
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
 
diff --git a/benchmarks/ccb_fix/protonmail-holiday-calendar-fix-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_fix/protonmail-holiday-calendar-fix-001/environment/Dockerfile.artifact_only
@@ -9,12 +9,6 @@
 
 FROM jefzda/sweap-images:protonmail.webclients-protonmail__webclients-369fd37de29c14c690cb3b1c09a949189734026f
 
-# Upgrade Node.js from v16 (base image) to v18 (required by Claude Code >= 2.1.37)
-# Remove old Node, then install from Alpine 3.18+ repos (ships Node 18.x)
-RUN apk del nodejs nodejs-current npm 2>/dev/null || true; \
-    rm -f /usr/local/bin/node /usr/local/bin/npm /usr/local/bin/npx 2>/dev/null || true; \
-    apk add --no-cache nodejs npm
-
 # Install uv for Python package management
 RUN curl -LsSf https://astral.sh/uv/0.7.13/install.sh | sh || true
 
diff --git a/benchmarks/ccb_secure/curl-cve-triage-001/environment/Dockerfile b/benchmarks/ccb_secure/curl-cve-triage-001/environment/Dockerfile
@@ -1 +1,20 @@
-FROM ccb-repo-curl-09e25b9d
+FROM debian:bookworm-slim
+
+WORKDIR /workspace
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    curl \
+    python3 \
+    build-essential \
+    jq \
+    bc \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN git init && \
+    git remote add origin https://github.com/curl/curl.git && \
+    git fetch --depth 1 origin 09e25b9d94f4106eac8ca3a43b221bdc66f405e4 && \
+    git checkout FETCH_HEAD && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
diff --git a/benchmarks/ccb_secure/curl-cve-triage-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_secure/curl-cve-triage-001/environment/Dockerfile.artifact_only
@@ -3,7 +3,26 @@
 # MCP agent deletes source files at runtime via agent startup script.
 # Verifier scores agent output only — no repo restore needed.
 
-FROM ccb-repo-curl-09e25b9d
+FROM debian:bookworm-slim
+
+WORKDIR /workspace
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    curl \
+    python3 \
+    build-essential \
+    jq \
+    bc \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN git init && \
+    git remote add origin https://github.com/curl/curl.git && \
+    git fetch --depth 1 origin 09e25b9d94f4106eac8ca3a43b221bdc66f405e4 && \
+    git checkout FETCH_HEAD && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
 # --- artifact_only mode ---
 # Sentinel flag for artifact-based verification.
 # Source stays readable for baseline agent; MCP agent deletes at runtime.
diff --git a/benchmarks/ccb_secure/curl-vuln-reachability-001/environment/Dockerfile b/benchmarks/ccb_secure/curl-vuln-reachability-001/environment/Dockerfile
@@ -1 +1,20 @@
-FROM ccb-repo-curl-09e25b9d
+FROM debian:bookworm-slim
+
+WORKDIR /workspace
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    curl \
+    python3 \
+    build-essential \
+    jq \
+    bc \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN git init && \
+    git remote add origin https://github.com/curl/curl.git && \
+    git fetch --depth 1 origin 09e25b9d94f4106eac8ca3a43b221bdc66f405e4 && \
+    git checkout FETCH_HEAD && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
diff --git a/benchmarks/ccb_secure/curl-vuln-reachability-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_secure/curl-vuln-reachability-001/environment/Dockerfile.artifact_only
@@ -3,7 +3,26 @@
 # MCP agent deletes source files at runtime via agent startup script.
 # Verifier scores agent output only — no repo restore needed.
 
-FROM ccb-repo-curl-09e25b9d
+FROM debian:bookworm-slim
+
+WORKDIR /workspace
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    curl \
+    python3 \
+    build-essential \
+    jq \
+    bc \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN git init && \
+    git remote add origin https://github.com/curl/curl.git && \
+    git fetch --depth 1 origin 09e25b9d94f4106eac8ca3a43b221bdc66f405e4 && \
+    git checkout FETCH_HEAD && \
+    git config user.email "agent@example.com" && \
+    git config user.name "Agent"
 # --- artifact_only mode ---
 # Sentinel flag for artifact-based verification.
 # Source stays readable for baseline agent; MCP agent deletes at runtime.
diff --git a/scripts/validate_artifact_golden.py b/scripts/validate_artifact_golden.py
@@ -248,14 +248,18 @@ def run_golden_test(
         (logs_dir / "verifier").mkdir()
         (logs_dir / "agent").mkdir()
 
-        # Build file injection commands
+        # Write mock files to host tmpdir, then mount and copy inside container.
+        # This avoids OS argument-list-too-long for large files (e.g. solve.sh).
+        import base64
+        staging_dir = Path(tmpdir) / "staging"
+        staging_dir.mkdir()
         inject_cmds = []
         for path, content in mock_files.items():
+            # Write each file to staging dir with a safe filename
+            safe_name = path.replace("/", "__").lstrip("_")
+            (staging_dir / safe_name).write_text(content)
             inject_cmds.append(f"mkdir -p $(dirname '{path}')")
-            # Use base64 to avoid shell escaping issues
-            import base64
-            b64 = base64.b64encode(content.encode()).decode()
-            inject_cmds.append(f"echo '{b64}' | base64 -d > '{path}'")
+            inject_cmds.append(f"cp '/tmp/_staging/{safe_name}' '{path}'")
 
         inject_script = "\n".join(inject_cmds)
 
@@ -276,6 +280,7 @@ def run_golden_test(
             "docker", "run", "--rm",
             "-v", f"{tests_dir}:/tests:ro",
             "-v", f"{logs_dir}:/logs",
+            "-v", f"{staging_dir}:/tmp/_staging:ro",
             tag,
             "bash", "-c", run_script,
         ]
