docker v5: boot refresh mirrors workflows/ from the repo (refresh-workspace.sh), claude alias (IS_SANDBOX=1 --dangerously-skip-permissions); document interim v4 (no auto-start, script refresh)

docker/Dockerfile

@@ -2,23 +2,32 @@
 #
 # NOTE: published plx1029/comfyui-qwen tags were NOT built from this file — they
 # were assembled daemonlessly (v1: crane append on the pod; v2: skopeo + umoci;
-# v3: crane append of a /workspace layer on top of v2). This Dockerfile is the
-# reproducible equivalent: building it on any machine with Docker produces the
-# same setup.
+# v3: crane append of a /workspace layer on top of v2; v4 and v5: further
+# crane appends). This Dockerfile is the reproducible equivalent: building it
+# on any machine with Docker produces the same setup.
 #
 # Build from the REPO ROOT (context needs download_missing_models.sh + workflows/):
-#   docker build -t plx1029/comfyui-qwen:v3 -f docker/Dockerfile .
-#   docker push plx1029/comfyui-qwen:v3
+#   docker build -t plx1029/comfyui-qwen:v5 -f docker/Dockerfile .
+#   docker push plx1029/comfyui-qwen:v5
 #
 # No secrets are baked into this image (it is public). The model-download
 # script prompts for your Hugging Face token at runtime (or reads $HF_TOKEN).
 #
 # v3: EVERYTHING lives in /workspace — /workspace/ComfyUI, /workspace/workflows,
-# /workspace/download_missing_models.sh — and ComfyUI auto-starts on boot.
-# A compressed seed of the /workspace payload is kept at /opt/workspace-seed.tar.gz
-# so that when a network volume is mounted over /workspace (shadowing the baked
-# files), seed-workspace.sh restores the missing pieces without touching
-# anything already on the volume.
+# /workspace/download_missing_models.sh. A compressed seed of the /workspace
+# payload is kept at /opt/workspace-seed.tar.gz so that when a network volume
+# is mounted over /workspace (shadowing the baked files), seed-workspace.sh
+# restores the missing pieces without touching anything already on the volume.
+#
+# v4: ComfyUI no longer auto-starts (COMFY_AUTOSTART=true re-enables);
+# download_missing_models.sh + README.md are re-fetched from the HF repo at
+# boot.
+#
+# v5: the boot refresh lives in refresh-workspace.sh and now also MIRRORS
+# workflows/ from hf.co/aleph65/ComfyUI (deletions included; uses
+# HUGGING_FACE_ACCESS_TOKEN or HF_TOKEN if set; WORKSPACE_REFRESH=false
+# disables). Also: interactive `claude` is aliased to
+# `IS_SANDBOX=1 claude --dangerously-skip-permissions`.
 
 FROM runpod/pytorch:1.0.2-cu1281-torch280-ubuntu2404
 
@@ -50,6 +59,10 @@ RUN curl -fsSL https://claude.ai/install.sh | bash && \
     printf '{\n  "bypassPermissionsModeAccepted": true\n}\n' > /root/.claude.json
 ENV PATH="/root/.local/bin:${PATH}"
 
+# Interactive shells: `claude` always runs sandboxed with permissions skipped
+# (/root/.bashrc from the base image sources ~/.bash_aliases when present)
+COPY docker/bash_aliases /root/.bash_aliases
+
 # Manager config baked in: security_level=weak, network_mode=personal_cloud
 COPY docker/config.ini /workspace/ComfyUI/user/__manager/config.ini
 COPY docker/comfy.settings.json /workspace/ComfyUI/user/default/comfy.settings.json
@@ -67,12 +80,14 @@ RUN chmod +x /workspace/download_missing_models.sh && \
 # Seed tarball: restores /workspace when a network volume shadows it
 RUN tar -czf /opt/workspace-seed.tar.gz -C /workspace ComfyUI workflows download_missing_models.sh
 
-# Startup: seed /workspace if needed, then AUTO-START ComfyUI (v3 default).
-# Set COMFY_AUTOSTART=false in the pod env to disable; `comfy` runs it manually.
+# Startup: seed /workspace if needed, refresh workflows + downloader from the
+# HF repo (v5). ComfyUI does NOT auto-start (v4 default) — run `comfy`
+# manually or set COMFY_AUTOSTART=true in the pod env.
 COPY docker/seed-workspace.sh /usr/local/bin/seed-workspace.sh
+COPY docker/refresh-workspace.sh /usr/local/bin/refresh-workspace.sh
 COPY docker/comfy /usr/local/bin/comfy
 COPY docker/start-comfy.sh /start-comfy.sh
-RUN chmod +x /usr/local/bin/comfy /usr/local/bin/seed-workspace.sh /start-comfy.sh
+RUN chmod +x /usr/local/bin/comfy /usr/local/bin/seed-workspace.sh /usr/local/bin/refresh-workspace.sh /start-comfy.sh
 
 EXPOSE 7865
 CMD ["/start-comfy.sh"]

docker/README.md

@@ -11,8 +11,16 @@ Everything from the manual setup is baked in — **no reinstalling on new pods**
   - **`/workspace/download_missing_models.sh`** — pick workflows, it fetches their
     missing models from `hf.co/aleph65/ComfyUI` into place (prompts for HF token
     or reads `$HF_TOKEN`); still on PATH via symlink
-- **v3: ComfyUI AUTO-STARTS on boot** (port **7865**, log `/workspace/comfyui.log`,
-  auto-restart loop). Set `COMFY_AUTOSTART=false` in the pod env to disable.
+- **v4: ComfyUI does NOT auto-start** (was the default in v3). Run `comfy` in a
+  terminal, or set `COMFY_AUTOSTART=true` in the pod env to re-enable
+  (port **7865**, log `/workspace/comfyui.log`, auto-restart loop).
+- **v5: fresh workflows + downloader on every boot** — `refresh-workspace.sh`
+  re-pulls `workflows/` (mirrored, deletions included),
+  `download_missing_models.sh`, and `README.md` from `hf.co/aleph65/ComfyUI` at
+  startup, using `HUGGING_FACE_ACCESS_TOKEN`/`HF_TOKEN` if set. On any failure
+  the existing copies stay. Set `WORKSPACE_REFRESH=false` to disable.
+- **v5: `claude` alias** — in interactive shells `claude` runs
+  `IS_SANDBOX=1 claude --dangerously-skip-permissions` (via `/root/.bash_aliases`).
 - rgthree-comfy @ `27b4f4c` in `custom_nodes/`
 - comfyui-manager 4.2.2 + all pip deps preinstalled system-wide
 - Manager config baked: `security_level = weak`, `network_mode = personal_cloud`
@@ -35,14 +43,17 @@ and outputs already on the volume are untouched.
 
 ## Using it on RunPod
 
-1. Create a template with container image `plx1029/comfyui-qwen:v3`.
+1. Create a template with container image `plx1029/comfyui-qwen:v5`.
 2. Expose HTTP port **7865** (plus 8888/22 as usual).
-3. (Optional) attach your network volume at `/workspace`.
-4. ComfyUI starts automatically. In a terminal: `download_missing_models.sh`
-   to fetch models for your workflows.
+3. Set `HUGGING_FACE_ACCESS_TOKEN` in the template env (used for the boot-time
+   workflow/script refresh and by `download_missing_models.sh`).
+4. (Optional) attach your network volume at `/workspace`.
+5. In a terminal: `download_missing_models.sh` to fetch models for your
+   workflows, then `comfy` to start ComfyUI (or set `COMFY_AUTOSTART=true`).
 
-`COMFY_PORT` overrides the port. `COMFY_AUTOSTART=false` disables auto-start
-(then run `comfy` manually).
+`COMFY_PORT` overrides the port. `COMFY_AUTOSTART=true` enables auto-start
+(otherwise run `comfy` manually). `WORKSPACE_REFRESH=false` skips the boot
+refresh.
 
 ## How the image was built
 
@@ -52,13 +63,20 @@ assembled daemonlessly: v1 with [`crane`](https://github.com/google/go-container
 **v3 with `crane append`** — a single layer holding `/workspace` (ComfyUI +
 workflows + downloader), the seed tarball, the new startup scripts, and a
 whiteout of the old `/ComfyUI`, appended on top of v2 (the ~11 GB base is never
-re-uploaded).
+re-uploaded); **v4 with `crane append` on top of v3** (no-auto-start
+`start-comfy.sh`, boot refresh of the downloader, updated seed tarball);
+**v5 with `crane append` on top of v4** — a small layer holding
+`refresh-workspace.sh`, the updated `start-comfy.sh`, `/root/.bash_aliases`,
+and current `workflows/` + `download_missing_models.sh` copies.
+
+Note: `/opt/workspace-seed.tar.gz` inside v5 still holds the v4-era workflows
+and script — that's fine, the boot refresh replaces them on the next start.
 
 `Dockerfile` in this directory is the reproducible equivalent for rebuilding on
 any machine with real Docker (build from the repo root — the context needs
 `download_missing_models.sh` and `workflows/`):
 
 ```bash
-docker build -t plx1029/comfyui-qwen:v3 -f docker/Dockerfile .
-docker push plx1029/comfyui-qwen:v3
+docker build -t plx1029/comfyui-qwen:v5 -f docker/Dockerfile .
+docker push plx1029/comfyui-qwen:v5
 ```

docker/bash_aliases

@@ -0,0 +1,3 @@
+# Baked into plx1029/comfyui-qwen (sourced by /root/.bashrc): `claude` always
+# runs with sandbox flag + permissions skipped — this is a throwaway pod.
+alias claude='IS_SANDBOX=1 claude --dangerously-skip-permissions'

docker/refresh-workspace.sh

@@ -0,0 +1,68 @@
+#!/bin/bash
+# Pull the freshest workflows/, download_missing_models.sh, and README.md from
+# the HF repo (aleph65/ComfyUI) into /workspace on every boot, so pods never
+# run against the stale copies baked into the image or left on a network
+# volume. Best-effort: on any failure (offline, bad token, read-only
+# /workspace) the existing copies stay in place and startup never blocks.
+# Set WORKSPACE_REFRESH=false in the pod env to skip.
+
+REPO_ID="aleph65/ComfyUI"
+TAG="[refresh-workspace]"
+TOKEN="${HUGGING_FACE_ACCESS_TOKEN:-${HF_TOKEN:-}}"
+
+if [[ "${WORKSPACE_REFRESH:-true}" == "false" ]]; then
+    echo "$TAG disabled via WORKSPACE_REFRESH=false — skipping."
+    exit 0
+fi
+if [[ ! -d /workspace || ! -w /workspace ]]; then
+    echo "$TAG /workspace missing or not writable — skipping." >&2
+    exit 0
+fi
+
+set -u
+
+# 1) single files: atomic swap, keep the old copy on any failure
+update_workspace_file() {
+    local name="$1" check="$2"
+    local url="https://huggingface.co/$REPO_ID/resolve/main/$name"
+    local dest="/workspace/$name"
+    local tmp auth=()
+    tmp=$(mktemp) || return 0
+    [[ -n "$TOKEN" ]] && auth=(-H "Authorization: Bearer $TOKEN")
+    if curl -fsSL --connect-timeout 10 --max-time 60 "${auth[@]}" "$url" -o "$tmp" \
+        && head -c 2 "$tmp" | grep -q "$check"; then
+        if ! cmp -s "$tmp" "$dest" 2>/dev/null; then
+            [[ "$name" == *.sh ]] && chmod 755 "$tmp" || chmod 644 "$tmp"
+            mv "$tmp" "$dest"
+            echo "$TAG updated $name from hf.co/$REPO_ID."
+        fi
+    else
+        echo "$TAG could not fetch latest $name — keeping existing copy." >&2
+    fi
+    rm -f "$tmp"
+}
+update_workspace_file download_missing_models.sh '#!' || true
+update_workspace_file README.md '.' || true
+
+# 2) mirror workflows/ from the repo (temp snapshot + rsync --delete, so
+# renamed/removed workflows disappear too; local-only edits do NOT survive —
+# the repo is the source of truth)
+TMP_DIR=$(mktemp -d)
+if timeout 240 python3 - "$REPO_ID" "$TMP_DIR" "$TOKEN" <<'PY'
+import sys
+repo_id, tmp, token = sys.argv[1], sys.argv[2], sys.argv[3]
+from huggingface_hub import snapshot_download
+snapshot_download(repo_id=repo_id, allow_patterns=["workflows/*"],
+                  local_dir=tmp, token=token or None)
+PY
+then
+    if [[ -d "$TMP_DIR/workflows" ]]; then
+        rsync -a --delete --exclude='.cache' "$TMP_DIR/workflows/" /workspace/workflows/
+        echo "$TAG workflows/ synced from hf.co/$REPO_ID ($(find /workspace/workflows -name '*.json' | wc -l) json files)."
+    else
+        echo "$TAG snapshot returned no workflows/ — keeping existing copies." >&2
+    fi
+else
+    echo "$TAG workflows sync failed — keeping existing copies." >&2
+fi
+rm -rf "$TMP_DIR"

docker/start-comfy.sh

@@ -1,12 +1,16 @@
 #!/bin/bash
-# Image CMD: make sure /workspace is fully populated, start ComfyUI in the
-# background (auto-restart loop), then hand off to the stock RunPod
-# /start.sh (SSH, Jupyter, nginx).
-# v3: ComfyUI AUTO-STARTS by default. Set COMFY_AUTOSTART=false to disable.
+# Image CMD: make sure /workspace is fully populated, refresh workflows/,
+# download_missing_models.sh, and README.md from the HF repo, then hand off
+# to the stock RunPod /start.sh (SSH, Jupyter, nginx).
+# v4: ComfyUI does NOT auto-start (start it manually with 'comfy' or
+# python main.py). Set COMFY_AUTOSTART=true to re-enable the old behavior.
+# v5: the boot refresh moved to refresh-workspace.sh and now also mirrors
+# workflows/ from hf.co/aleph65/ComfyUI (WORKSPACE_REFRESH=false to skip).
 
 /usr/local/bin/seed-workspace.sh || true
+/usr/local/bin/refresh-workspace.sh || true
 
-if [[ "${COMFY_AUTOSTART:-true}" != "false" ]]; then
+if [[ "${COMFY_AUTOSTART:-false}" == "true" ]]; then
     LOG=/workspace/comfyui.log
     [[ -d /workspace && -w /workspace ]] || LOG=/var/log/comfyui.log
     (
@@ -19,7 +23,7 @@ if [[ "${COMFY_AUTOSTART:-true}" != "false" ]]; then
     echo "ComfyUI starting in background (log: $LOG, port ${COMFY_PORT:-7865})"
     echo "Run 'download_missing_models.sh' to fetch models for your workflows."
 else
-    echo "ComfyUI not auto-started (COMFY_AUTOSTART=false). Run 'comfy' to start it (port ${COMFY_PORT:-7865})."
+    echo "ComfyUI not auto-started. Run 'comfy' (or cd /workspace/ComfyUI && python main.py --listen 0.0.0.0 --port ${COMFY_PORT:-7865} --enable-manager) to start it."
 fi
 
 exec /start.sh