instabox 0.8.19 → 0.8.21

package/cli/SHA256SUMS

@@ -1,6 +1,6 @@
-83bd3679f85c885779d2d98c3e0f19ee8b8e4f056b9ebde88a6bda7a8004c094  instabox-darwin-amd64
-98d5afc07aec20b840241cf6d3914d297e650059d3332f9c1d374cf312dc1e06  instabox-darwin-arm64
-fbecd1e3acf2bdf7267609235cd18f5098b0682046ebbbd21694b84b5aca8b2b  instabox-linux-amd64
-09eaec858a7337f661c382b3c09cb159700501d62af5a9f39a9f99cbdc490b2a  instabox-linux-arm64
-292591e3952d550271c7e140bd886250ae8d54730baf05689574aefe74aef21a  instabox-windows-amd64.exe
-3b26cac78d0ea41ddd748558e8dc31b8a4de7ab57d8d58ba53d8831d19d0ddc7  instabox-windows-arm64.exe
+f0091476b08faafa410324a5a5e055ae3fed7ff95837365adfcd95b27848fd2d  instabox-darwin-amd64
+0cff50ccffadcbb44ef498fd829039976022e95b8ccfd7ab5162a03289459812  instabox-darwin-arm64
+6152f12555fece24c7e6baf9a7788eb9273a3be867d539e337ea3b73191f7175  instabox-linux-amd64
+7c1cc65e31e590ea54052479ab0152523bfed96ed9f0a3cfb13ef9b7b66c035a  instabox-linux-arm64
+5374d5d3f5c976955daf20234d190e0844cab37ab4658ea1517f382c862206ac  instabox-windows-amd64.exe
+b41b0b5d17fca6c920a86211c67096038893cf69d98a03bcd05ccdff7d521617  instabox-windows-arm64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instabox",
-  "version": "0.8.19",
+  "version": "0.8.21",
   "description": "A cloud box for your coding agent, the instabox CLI and its agent skills in one command: npx instabox@latest",
   "type": "module",
   "bin": {

package/skills/instabox/SKILL.md

@@ -33,6 +33,8 @@ With no key and nobody at the keyboard, sign up by yourself: `instabox login --a
 - `orca`: for Orca desktop and mobile. The same tools as `herdr` plus the Orca runtime instead of herdr; an 8 GiB root disk.
 - `t3`: for the T3 Code desktop and mobile clients. `universal` plus the T3 Code server (port 3774); a 16 GiB root disk.
 
+To run an older or different image (say `node:16-buster`), use Docker in the box: on `agent-browser`, `universal` and `t3` the box user is in group `docker`, so `docker run --rm node:16-buster node -v` works without sudo. An operator can also turn a public Debian- or Ubuntu-based image into its own template (`images/templates/oci/build.sh`); it then shows up in `instabox templates` like any other.
+
 `instabox templates` lists the ones this server offers, one row per version with a description; its TAG column (`--json`: `"latest"`, `"default"`) marks the version `create` gets for `--template T` alone (latest) and with no `--template` (default). Pin another version with `--template T@VERSION` (or `--template-version`). `--json` also lists retired ones with `"creatable": false`, which no new box can start from. The free plan creates boxes from `agent-browser` only: another template is refused with `403 template_not_allowed` and needs a paid plan (the user upgrades on the dashboard). A box from a snapshot (`--snapshot`) works on every plan, whatever template the snapshot came from. Do not retry another template on the free plan; use `agent-browser`. Over the HTTP API, `POST /v1/machines` with an unknown `templateId` is `400 bad_request` whose message lists the templates your plan can create from, and a version that template does not have (`agent-browser@nope`, or `templateVersion`) is `400 bad_request` listing its versions newest first, the one you get without a version tagged `(latest)` or `(default)`; a body field the API does not have is `400 unknown_field` naming the closest real one (`template`: did you mean `templateId`?); `name` may be left out (`box-` and 8 random hex digits).
 
 ## Sizes
@@ -53,6 +55,7 @@ A box is 4 vCPU / 8 GB of memory unless `create` names another size of the accou
 instabox templates                              # base systems to start from
 instabox create --name work                     # new box; waits until it is running
 instabox create --name work --setup-file ./setup.sh   # then runs the script in it
+instabox create --devcontainer                     # from ./.devcontainer/devcontainer.json (no Dev Containers CLI needed)
 instabox ls                                     # your boxes and their states
 instabox ssh work                               # interactive shell (leave with: exit)
 instabox exec work -- uname -a                  # one command, no SSH client needed
@@ -79,6 +82,7 @@ instabox rm --yes work                          # delete the box (without --yes
 - For large uploads use `instabox push` or `instabox cp` (the HTTP API, parallel-friendly), not scp or rsync over `ssh.instabox.sh`, which keeps about 2 MiB in flight per connection and so slows with distance. Measured: at a 5 ms round trip both paths do ~104 MB/s; at 305 ms the API does 11-13 MB/s per stream and SSH 3-6 MB/s; 4 parallel API PUTs did 39 MB/s total.
 - `create` options: `--template T` or `--snapshot S`, `--vcpus N --mem-mib M` (a size of the plan, see Sizes), `--auto-suspend D|0`, `--max-run-minutes N`, `--delete-after D` (delete it D after creation, 1m-24h, whatever its state), `--meta K=V`, `--org O`, `--secrets all|NAME,NAME|none`, `--no-wait`, `--setup-file PATH|-` (`--wait-setup`), `--fail-fast` (when no host has room, fail at once and create nothing instead of failing the create after; with `--snapshot`, instead of creating it stopped).
 - `create --setup-file PATH` (`-`: stdin; at most 64 KB) runs that script in the new box once it is running, in HOME as the box's user (by its `#!` line, else with bash; CRLF line endings become LF), and prints its output; it replaces create + push + exec for provisioning. A failing script makes `create` exit with the script's code and keeps the box: debug it with `instabox exec work -- /tmp/instabox-setup.sh`. With `--json` the sandbox object gets a `setup` object (`exitCode`, `stdout`, `stderr`, `signal`, `timedOut`, `truncated`, `durationMs`). `create` always waits for the script (`--wait-setup` names that; `=false` is refused) and keeps its state in the box's metadata, so `instabox get work --json` shows it later: `metadata.setupStatus` (`pending`, `running`, `succeeded`, `failed`), `setupExitCode` (`124`: timed out) and `setupLog` (the last 512 characters of its stdout then stderr). The script is killed after `--setup-timeout` (default and at most 10m); for longer installs, use `ssh`. A missing, empty or over-64 KB file is refused before any box is created. `run --setup-file` does the same before its command, with its `-e` variables; when the script fails, run's `--json` `exitCode` is the script's. The script stays at `/tmp/instabox-setup.sh` (and in snapshots), so keep credentials out of it.
+- `create --devcontainer [PATH|DIR]` (also `run --devcontainer`) builds a box from a repo's devcontainer.json (default `.devcontainer/devcontainer.json` or `.devcontainer.json` here; JSONC): it pushes the repo into `workspaceFolder` (default `/workspaces/<dir>`), writes `containerEnv`/`remoteEnv` to `/etc/profile.d/instabox-devcontainer.sh`, installs `features` via their install.sh (ones the template already has, such as node/python/go/docker-in-docker/github-cli at the default version, are skipped), and runs `onCreateCommand`/`updateContentCommand`/`postCreateCommand`/`postStartCommand` in the workspace. Do not install the Dev Containers CLI in a box for this. `image`/`build`/compose are not booted (boxes are VM templates); the summary (stderr, or `--json`'s `devcontainer`: `applied`, `skipped`, `ports`, `steps`, `status`, `failedStep`) says what was skipped, and `forwardPorts` come with `instabox port-forward`/`port publish` commands. A failed step exits with its code and keeps the box (`metadata.setupStep` names it); `--name` defaults to the config's name. `${devcontainerId}` is the box's name; the summary shows commands as written (a `${localEnv:TOKEN}` is not printed), but the profile file keeps env values (readable by root and the box user's group, and in snapshots). In `run`, write `--devcontainer=PATH` when a command follows without `--`.
 - Idle auto-pause defaults to 30 minutes. Paid boxes allow 5, 10, 15, 20, 25 or 30 minutes (a time between rounds up; below 5m or above 30m is refused, nothing created), or `0` to turn it off. Free boxes keep 30 minutes unless an admin grants an idle override; asking another value on a free box fails (`permission_denied`, nothing created), so leave `--auto-suspend` out there. Idle means no agent working, no terminal use and little CPU.
 - Max run minutes is independent of idle activity: `-1` is unlimited, `0` pauses immediately, and a positive integer forces a pause after that many running minutes. Free boxes have a fixed 480-minute cap that only an admin session can change; paid boxes default to `-1` and can change it. An idle override does not permit changes to a free box's runtime cap. The first limit reached pauses the box; both timers restart after sleep and wake.
 - A runtime pause blocks every wake path during a server-configured cooldown, 10 minutes by default. Wait until the `cooldownUntil` deadline shown by `instabox get`; edits cannot clear it. Afterward, an automatically paused box wakes on `exec`, `ssh`, `files`, a public port request or `instabox wake <box>`. A zero runtime cap must be changed before waking. A normal pause preserves memory and processes.