From 15dc62d9294d70da45d63e84d565f2ce236ce7fd Mon Sep 17 00:00:00 2001
From: Jeffery <jiantw83@yahoo.com>
Date: Mon, 29 Jun 2026 10:13:58 +0000
Subject: [PATCH] =?UTF-8?q?chore(Dockerfile):=20=E5=BB=BA=E7=BD=AE?=
 =?UTF-8?q?=E6=99=82=E9=A9=97=E8=AD=89=20Codex=20=E5=B8=B3=E8=99=9F?=
 =?UTF-8?q?=E9=9B=BB=E5=AD=90=E9=83=B5=E4=BB=B6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Dockerfile                | 16 +++++++++++++---
 README.md                 | 10 +++++++---
 app/verify_codex_email.sh | 16 ++++++++++++++++
 3 files changed, 36 insertions(+), 6 deletions(-)
 create mode 100644 app/verify_codex_email.sh

diff --git a/Dockerfile b/Dockerfile
index 7794cde..ef752b0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,8 @@
+# syntax=docker/dockerfile:1.4
 FROM ubuntu:latest
 
 ENV DEBIAN_FRONTEND=noninteractive
+ARG EXPECTED_CODEX_EMAIL=temp@gmail.com
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
@@ -14,8 +16,16 @@ RUN apt-get update \
 WORKDIR /workspace
 
 COPY app/codex_account.js /usr/local/bin/codex-account
-RUN chmod +x /usr/local/bin/codex-account
+COPY app/verify_codex_email.sh /usr/local/bin/verify-codex-email
+RUN chmod +x /usr/local/bin/codex-account /usr/local/bin/verify-codex-email
 
-ENV EXPECTED_CODEX_EMAIL=temp@gmail.com
+ENV EXPECTED_CODEX_EMAIL=${EXPECTED_CODEX_EMAIL}
 
-CMD ["sh", "-c", "email=\"$(codex-account)\"; if [ \"$email\" = \"$EXPECTED_CODEX_EMAIL\" ]; then printf 'Codex account email verified: %s\\n' \"$email\"; else printf 'Codex account email mismatch: expected %s, got %s\\n' \"$EXPECTED_CODEX_EMAIL\" \"${email:-<empty>}\" >&2; exit 1; fi"]
+RUN --mount=type=secret,id=codex_auth,required=true \
+    install -d -m 700 /root/.codex \
+    && cp /run/secrets/codex_auth /root/.codex/auth.json \
+    && chmod 600 /root/.codex/auth.json \
+    && EXPECTED_CODEX_EMAIL="$EXPECTED_CODEX_EMAIL" verify-codex-email \
+    && rm -f /root/.codex/auth.json
+
+CMD ["codex-account"]
diff --git a/README.md b/README.md
index 7a95dae..e1d650b 100644
--- a/README.md
+++ b/README.md
@@ -71,15 +71,19 @@ node app/codex_account.js
 此專案提供以 `ubuntu:latest` 為基底的 Dockerfile，會安裝 Node.js/npm 與 `@openai/codex`：
 
 ```bash
-docker build -t codex-account .
+DOCKER_BUILDKIT=1 docker build \
+  --secret id=codex_auth,src=/home/coder/jiantw83/Docker/gitea/codex/housefun.dev.01@gmail.com \
+  --build-arg EXPECTED_CODEX_EMAIL='temp@gmail.com' \
+  -t codex-account .
 docker run --rm -v "$HOME/.codex:/root/.codex:ro" codex-account
 ```
 
-容器啟動時會執行 `codex-account`，並確認取得的 email 是否等於 `EXPECTED_CODEX_EMAIL`。預設值為 `temp@gmail.com`，可用環境變數覆寫：
+建置階段會透過 BuildKit secret 暫時掛載 OAuth token，執行 `verify-codex-email` 檢查 `codex-account` 取得的 email 是否等於 `EXPECTED_CODEX_EMAIL`。預設值為 `temp@gmail.com`；不相符時 `docker build` 會失敗，且 token 不會保留在 image layer。
+
+容器啟動後預設執行 `codex-account`：
 
 ```bash
 docker run --rm \
-  -e EXPECTED_CODEX_EMAIL='temp@gmail.com' \
   -v "$HOME/.codex:/root/.codex:ro" \
   codex-account
 ```
diff --git a/app/verify_codex_email.sh b/app/verify_codex_email.sh
new file mode 100644
index 0000000..e3f5fb9
--- /dev/null
+++ b/app/verify_codex_email.sh
@@ -0,0 +1,16 @@
+#!/bin/sh
+# 驗證 codex-account 取得的登入 email 是否符合 EXPECTED_CODEX_EMAIL。
+
+set -eu
+
+expected_email="${EXPECTED_CODEX_EMAIL:-temp@gmail.com}"
+actual_email="$(codex-account)"
+
+if [ "$actual_email" = "$expected_email" ]; then
+  printf 'Codex account email verified: %s\n' "$actual_email"
+  exit 0
+fi
+
+printf 'Codex account email mismatch: expected %s, got %s\n' \
+  "$expected_email" "${actual_email:-<empty>}" >&2
+exit 1