feat(claude-code): add headless Claude Code agent image - #2
Merged
Conversation
Builds on sandbox-agent and installs the Claude Code CLI. The entrypoint optionally clones a target repo into /workspace and installs an agent profile from a git repo into CLAUDE_CONFIG_DIR before exec'ing the container command, defaulting to a one-shot 'claude -p' run. With no variables set the agent starts in an empty /workspace scratch space. Signed-off-by: swibrow <15628653+swibrow@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
ghcr.io/cloudsnacks/claude-code: a headless Claude Code agent for sandboxed runs.Design
ghcr.io/cloudsnacks/sandbox-agent:1.0.0, digest-pinned. Inherits Node, Python, uv, git, gh, ripgrep, theagentuser (uid 1001) and/workspace.@anthropic-ai/claude-code(2.1.220). Themetadata.yamlversioncarries the same# renovate: datasource=npmannotation as the DockerfileARG, so both bump together.ENTRYPOINTbootstraps, thenexec "$@". DefaultCMDis a one-shotclaude -p; any command passed in replaces it, so the same image works for a Job and for a long-lived sandbox pod driven overexec.exec, so PID 1 is stillclaude- one process, no init framework. An init container is not required, though it remains an option if you'd rather keep clone credentials out of the agent pod.Configuration
All optional; with nothing set the agent starts in an empty
/workspacescratch space.AGENT_REPO/AGENT_REPO_REF.git, so a persistent volume survives restarts)AGENT_PROFILE_REPO/AGENT_PROFILE/AGENT_PROFILE_REFCLAUDE_CONFIG_DIRAGENT_PROMPTAGENT_WORKSPACE/workspaceGITHUB_TOKENinsteadOfrewrite for authenticated clonesVerified locally (arm64, Apple
container)metadata.yamltest passes;whoamiisagent, uid/gid 1001.AGENT_PROMPT-on-stdin all work.CMDwith no prompt errors out rather than hanging.Note for review
This image ships a third file,
entrypoint.sh, where existing images have two. The build context is the image directory so CI handles it fine; the alternative was a ~35-line heredoc inside the Dockerfile, which loses shellcheck coverage. Happy to inline it if the two-file convention should stay strict.