Slim the Prebuilt Image to agent-first baseline (#8)#9
Merged
Conversation
Per ADR 0002: the image bakes only what both the AI Agent Toolchain and a debugging Human Supervisor need. - Drop tmux, bat, eza, xclip from apt; drop htop/tree from our layer (base-image copies are left alone -- purging upstream content costs more maintenance than the ~20MB it saves) - Drop zsh plugins, zshrc-addon, tmux.conf + TPM; remove configs/ - common-utils: installZsh/installOhMyZsh -> false, no configureZshAsDefaultShell; login shell is bash (base default) - Symlink fdfind -> fd so agents and humans call it directly - dev-cache mappings: remove zsh/tmux volumes, keep package caches - Template terminal profile zsh -> bash (would break with no zsh config) - devimage-build/README rewritten to describe the slimmed reality
devcontainers/base:* ships common-utils defaults pre-baked (zsh, oh-my-zsh, etc.), so slimming our own layer was not enough. Switch to a bare distro base and let the common-utils Feature (installZsh: false) supply the devcontainer essentials instead. - Create the vscode user (uid/gid 1000, bash) in the Dockerfile since a bare base has no non-root user; common-utils adopts it and adds passwordless sudo - Move git config --global below USER vscode: it previously ran as root and wrote /root/.gitconfig, never reaching the actual user - add ca-certificates/curl (Feature scripts need them) and git (no longer inherited from the devcontainers base) - htop/tree return via common-utils base packages; counted as Human-Supervisor debug tools (keep side), not leakage Verified locally: all agent tools present (node 24 / python 3.13 / rust / gh / rg 14 / fd / jq), zsh+omz/tmux/bat/eza/xclip absent, bash login shell, sudo works, cache symlinks intact. Size: 2.61GB -> 2.03GB (-22%).
devcontainer build was only exercised at release time, so an image regression surfaced after tagging. Build the image (no push) on every PR touching devimage-build/ and assert the ADR 0002 agent-first baseline inside the built image: required tools present, ergonomics layer absent, bash login shell, passwordless sudo, dev-cache symlinks, git config owned by the vscode user.
A plain Docker Compose entry point for the same Prebuilt Image, for terminals/servers/CI where the VS Code devcontainer machinery is not available or wanted. - Shares the dev-home / dev-cache named volumes with .devcontainer, so agent login state and package caches work in both worlds - bootstrap.sh mirrors post-create.sh's Startup Install (claude / codex / gemini) minus the HAPI Local Hub, which stays owned by the devcontainer flow - WORKSPACE_DIR env points the container at any host project; docker compose -p gives one agent container per project
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #8. Implements the image side of the agent-first pivot recorded in ADR 0002.
What changed
1. Slim our own layer
tmux/bat/eza/xclipfrom apt; drop zsh plugins,zshrc-addon,tmux.conf+ TPM; removeconfigs/entirelycommon-utils:installZsh/installOhMyZsh→false, noconfigureZshAsDefaultShellfdfindsymlinked asfdzsh→bash(would break once zsh config is gone)2. Rebase onto bare
debian:trixie-slimSlimming our layer wasn't enough:
devcontainers/base:*ships zsh / oh-my-zsh pre-baked. A bare distro base +common-utilsFeature supplies just the devcontainer essentials. The Dockerfile now creates thevscodeuser itself (bare base has none), andgit config --globalmoved belowUSER vscode— it previously wrote/root/.gitconfig, never reaching the actual user.htop/treereturn via common-utils' own base package list; counted as Human-Supervisor debug tools (keep side per ADR 0002), not leakage.3. PR-gated build check (new CI)
devcontainer buildwas only exercised at release time.image-build-check.ymlnow builds the image (no push) on PRs touchingdevimage-build/and asserts the agent-first baseline inside it: required tools present, ergonomics layer absent, bash login shell, passwordless sudo, cache symlinks, git config under the vscode user.4.
agent-compose/— run coding agents without devcontainerPlain Docker Compose entry point for the same image (terminals / servers / CI). Shares
dev-home/dev-cachenamed volumes with.devcontainer, so agent login state works in both worlds.bootstrap.shmirrors post-create's Startup Install (claude / codex / gemini), HAPI stays devcontainer-owned.Verification
Built locally via devcontainer CLI and asserted inside the image:
/bin/bash; passwordless sudo OKscripts/check-release-contract.shpassesAfter merge
v2.0.0(breaking: removes tmux/zsh-based workflows) per ADR 0001