agent-containers 0.1.0.dev0__py3-none-any.whl

agent_containers/_assets/agent-images/claude-code/packages-apt.txt

@@ -0,0 +1,16 @@
+# Default/optional apt packages installed at build time, one per line.
+# Blank lines and lines starting with '#' are ignored. Edit freely and
+# rebuild the image — this is separate from the Dockerfile's own
+# required-infra apt list (git, iptables, gosu, etc.), which this file
+# cannot remove packages from.
+gh
+jq
+ripgrep
+fd-find
+tree
+unzip
+less
+file
+lsof
+yq
+miller

agent_containers/_assets/agent-images/claude-code/packages-npm.txt

@@ -0,0 +1,7 @@
+# Optional global npm packages installed at build time (via `npm install -g`),
+# one per line. Blank lines and lines starting with '#' are ignored. Empty by
+# default — there's no "everyone wants this" global npm CLI the way there is
+# for apt utilities.
+#
+# Example:
+# @some-scope/some-cli

agent_containers/_assets/agent-images/claude-code/packages-uv.txt

@@ -0,0 +1,9 @@
+# Optional Python libraries installed into the system Python at build time
+# (via `uv pip install --system`), one per line. Blank lines and lines
+# starting with '#' are ignored. Empty by default. Unlike tools-uv.txt, these
+# land in the one shared system Python rather than an isolated venv, so
+# they're importable by whatever runs inside the image — a CLI-only package
+# with no importable module of its own belongs in tools-uv.txt instead.
+#
+# Example:
+# langfuse

agent_containers/_assets/agent-images/claude-code/plugin-marketplaces.txt

@@ -0,0 +1,23 @@
+# Additional plugin marketplaces to add at build time, one per line.
+# Blank lines and lines starting with '#' are ignored.
+#
+# Each line is passed as-is to `claude plugin marketplace add <source>`.
+# Accepted forms of <source>:
+#   owner/repo                              GitHub shorthand
+#   owner/repo@branch-or-tag                GitHub shorthand, pinned to a ref
+#   https://git-host/team/plugins.git       Any git URL
+#   https://git-host/team/plugins.git#ref   Git URL, pinned to a ref
+#   https://example.com/marketplace.json    Raw marketplace.json URL
+#   /absolute/or/./relative/path            Local filesystem path
+#
+# The official Anthropic marketplace (claude-plugins-official) is added
+# automatically and must not be listed here.
+#
+# NOTE: the name used in plugins.txt as "<plugin>@<marketplace-name>" is
+# whatever that marketplace's own .claude-plugin/marketplace.json declares as
+# its "name" field -- it is NOT necessarily derived from the owner/repo slug
+# or URL above. Check the marketplace's manifest (or its docs) to find the
+# right suffix to use in plugins.txt.
+#
+# Example:
+# my-org/my-claude-marketplace

agent_containers/_assets/agent-images/claude-code/plugins.txt

@@ -0,0 +1,13 @@
+clangd-lsp@claude-plugins-official
+claude-md-management@claude-plugins-official
+code-review@claude-plugins-official
+gopls-lsp@claude-plugins-official
+playground@claude-plugins-official
+playwright@claude-plugins-official
+pydantic-ai@claude-plugins-official
+remember@claude-plugins-official
+rust-analyzer-lsp@claude-plugins-official
+security-guidance@claude-plugins-official
+skill-creator@claude-plugins-official
+superpowers@claude-plugins-official
+typescript-lsp@claude-plugins-official

agent_containers/_assets/agent-images/claude-code/proxy-ca.d/.keep

@@ -0,0 +1 @@
+# Profile-specific CA certificates are injected into this directory by the onboarding CLI.

agent_containers/_assets/agent-images/claude-code/tools-uv.txt

@@ -0,0 +1,9 @@
+# Optional Python CLI tools installed at build time (via `uv tool install`),
+# one per line, each into its own isolated venv. Blank lines and lines
+# starting with '#' are ignored. Empty by default — there's no "everyone
+# wants this" uv-installed CLI the way there is for apt utilities. A plain
+# importable library (no console-script entry point of its own) belongs in
+# packages-uv.txt instead.
+#
+# Example:
+# ruff

agent_containers/_assets/agent-images/codex/Dockerfile

@@ -0,0 +1,147 @@
+FROM python:3.14-slim-trixie AS base
+
+ARG TARGETARCH
+
+# Shared Node.js, containment, gateway-client, and cloudflared baseline for
+# the first-party Python-and-Node workload images.
+COPY --from=shared install-workload-base.sh /usr/local/lib/agent/install-workload-base.sh
+RUN TARGETARCH="$TARGETARCH" bash /usr/local/lib/agent/install-workload-base.sh
+
+# Optional profile-managed organisational CAs; see claude-code/Dockerfile.
+COPY proxy-ca.d/ /tmp/agent-containers-proxy-ca/
+RUN set -eu; \
+    mkdir -p /usr/local/share/ca-certificates/custom; \
+    found=0; \
+    for cert in /tmp/agent-containers-proxy-ca/*; do \
+        [ -f "$cert" ] || continue; \
+        name="$(basename "$cert")"; \
+        [ "$name" = ".keep" ] && continue; \
+        case "$name" in *.crt) ;; *) name="${name%.*}.crt" ;; esac; \
+        cp "$cert" "/usr/local/share/ca-certificates/custom/$name"; \
+        found=1; \
+    done; \
+    if [ "$found" -eq 1 ]; then update-ca-certificates; fi; \
+    rm -rf /tmp/agent-containers-proxy-ca
+
+COPY --from=shared install-additional-packages.sh /usr/local/lib/agent/install-additional-packages.sh
+COPY packages-apt.txt /tmp/packages-apt.txt
+RUN bash -c '. /usr/local/lib/agent/install-additional-packages.sh \
+        && install_apt_packages /tmp/packages-apt.txt' \
+    && rm -f /tmp/packages-apt.txt
+
+# Keep Python tooling available for Python-based MCP servers and project work,
+# matching the other first-party CLI workload image.
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/
+
+# packages-uv.txt — general Python libraries (not CLI tools; see
+# tools-uv.txt below), installed via `uv pip install --system` into this
+# system Python. Runs as root, before the codex user exists, since it writes
+# into the image's system site-packages rather than $HOME.
+COPY packages-uv.txt /tmp/packages-uv.txt
+RUN bash -c '. /usr/local/lib/agent/install-additional-packages.sh \
+        && install_uv_packages /tmp/packages-uv.txt' \
+    && rm -f /tmp/packages-uv.txt
+
+RUN npm install -g @openai/codex \
+    && codex_path="$(command -v codex)" \
+    && codex_target="$(readlink -f "$codex_path")" \
+    && ln -s "$codex_target" /usr/local/bin/codex-cli \
+    && rm -f "$codex_path"
+
+COPY codex-wrapper.sh /usr/local/bin/codex
+RUN chmod +x /usr/local/bin/codex
+
+# The codex account is created here, at a fixed placeholder UID/GID
+# (1000:1000), purely so the root-only installers below (npm, uv tool) have
+# a real non-root account to run as. `final` remaps this account to the
+# operator's actual host UID/GID instead of recreating it, so a rebuild for
+# a different host user reuses everything installed below unchanged rather
+# than reinstalling it over the network.
+RUN groupadd -g 1000 codex \
+    && useradd -m -u 1000 -g 1000 -s /bin/bash codex \
+    && mkdir -p /home/codex/.codex /workspace \
+    && chown -R codex:codex /home/codex /workspace
+
+ENV HOME=/home/codex
+ENV npm_config_prefix=/home/codex/.npm-global
+# Home-managed installations intentionally precede profile-managed tools. The
+# latter are image-owned under /opt so a populated home volume cannot hide a
+# rebuilt profile image's requested versions.
+ENV PATH="/home/codex/.local/bin:/home/codex/.npm-global/bin:/opt/agent-tools/bin:/opt/agent-tools/npm/bin:${PATH}"
+
+# $HOME (uv's default cache location) and /workspace are deliberately
+# separate mounts in this containment model, so uv's hardlink/reflink
+# optimisation can never apply between them — declare the copy fallback
+# explicit rather than have uv warn about it on every install.
+ENV UV_LINK_MODE=copy
+
+COPY packages-npm.txt /tmp/packages-npm.txt
+COPY tools-uv.txt /tmp/tools-uv.txt
+RUN mkdir -p /opt/agent-tools/npm /opt/agent-tools/uv-tools /opt/agent-tools/bin \
+    && chown -R codex:codex /opt/agent-tools \
+    && gosu codex env \
+        npm_config_prefix=/opt/agent-tools/npm \
+        UV_TOOL_DIR=/opt/agent-tools/uv-tools \
+        UV_TOOL_BIN_DIR=/opt/agent-tools/bin \
+        bash -c '. /usr/local/lib/agent/install-additional-packages.sh \
+        && install_npm_packages /tmp/packages-npm.txt \
+        && install_uv_tools /tmp/tools-uv.txt' \
+    && rm -f /tmp/packages-npm.txt /tmp/tools-uv.txt
+
+COPY plugin-marketplaces.txt /tmp/plugin-marketplaces.txt
+COPY plugins.txt /tmp/plugins.txt
+RUN while IFS= read -r marketplace; do \
+        case "$marketplace" in ''|'#'*) continue ;; esac; \
+        gosu codex codex-cli plugin marketplace add "${marketplace}"; \
+    done < /tmp/plugin-marketplaces.txt \
+    && while IFS= read -r plugin; do \
+        case "$plugin" in ''|'#'*) continue ;; esac; \
+        gosu codex codex-cli plugin add "${plugin}"; \
+    done < /tmp/plugins.txt \
+    && rm -f /tmp/plugin-marketplaces.txt /tmp/plugins.txt
+
+# Everything above this line is UID/GID-independent and layer-cacheable
+# across hosts: the codex account exists at the fixed placeholder UID/GID
+# only so the installers above have a non-root account to run as. From here
+# down, `final` remaps that account to the operator's actual host UID/GID
+# with --build-arg UID=$(id -u) --build-arg GID=$(id -g) — the base stage
+# above is reused unchanged from cache, and nothing installed above is
+# reinstalled, rather than rebuilding per host user.
+FROM base AS final
+ARG UID=1000
+ARG GID=1000
+
+# Only remap when the caller supplied a different UID/GID than the fixed
+# placeholder baked into `base` above — usermod/groupmod plus a chown -R
+# walk over already-installed content is far cheaper than rerunning the
+# npm/uv-tool installs above, but it's skippable entirely for the common
+# case where the caller never overrides UID/GID. Deliberately no -o:
+# without it, usermod/groupmod refuse to reuse an ID already assigned to
+# another account, so a caller can never remap codex onto UID/GID 0 (root)
+# or collide it with another in-image identity — the build fails instead of
+# silently succeeding.
+RUN if [ "$UID" != "1000" ] || [ "$GID" != "1000" ]; then \
+        groupmod -g "$GID" codex \
+        && usermod -u "$UID" -g "$GID" codex \
+        && chown -R "$UID":"$GID" /home/codex /workspace /opt/agent-tools; \
+    fi
+
+COPY --from=shared egress-allowlist.sh /usr/local/lib/agent/egress-allowlist.sh
+COPY --from=shared workload-entrypoint.sh /usr/local/lib/agent/workload-entrypoint.sh
+RUN chmod +x /usr/local/lib/agent/workload-entrypoint.sh
+
+# Strip setuid/setgid bits from the base image and every package installed
+# above — required infra (install-workload-base.sh), packages-apt.txt,
+# packages-npm.txt, packages-uv.txt, and tools-uv.txt — run last so nothing
+# installed by any of those is missed. NoNewPrivs=1 (set by every documented
+# run invocation) already makes these bits inert on execve, but that's an
+# argument for stripping them, not against: if any single control ever
+# regresses, a setuid-root `mount` becomes a live escalation primitive. None
+# of these binaries are needed at runtime, so none should ship
+# exploitable-shaped.
+RUN find / -xdev -perm /6000 -type f -exec chmod a-s {} + || true
+
+WORKDIR /workspace
+
+ENTRYPOINT ["/usr/local/lib/agent/workload-entrypoint.sh", "codex", "codex"]
+CMD ["codex"]

agent_containers/_assets/agent-images/codex/codex-wrapper.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+
+# The outer container provides the filesystem and process sandbox. Avoid
+# starting Codex's nested sandbox, which cannot create its required namespaces
+# under the container's deliberately restricted runtime security flags. Keep
+# an explicit caller-selected sandbox mode intact.
+for arg in "$@"; do
+  case "$arg" in
+    --sandbox|--sandbox=*|-s) exec /usr/local/bin/codex-cli "$@" ;;
+  esac
+done
+
+exec /usr/local/bin/codex-cli --sandbox danger-full-access "$@"

agent_containers/_assets/agent-images/codex/examples/egress-allowlist.txt

@@ -0,0 +1,10 @@
+# Hosts/IPs the container is allowed to reach outbound, one per line.
+# Blank lines and lines starting with '#' are ignored. Mount this file at
+# /etc/agent/egress-allowlist.txt; it takes precedence over
+# $AGENT_ALLOWED_EGRESS. If neither is set, outbound traffic is denied.
+#
+# The documented default supports ChatGPT-account authentication and the
+# `codex_apps` MCP integration, both of which need all three hosts.
+api.openai.com
+auth.openai.com
+chatgpt.com

agent_containers/_assets/agent-images/codex/packages-apt.txt

@@ -0,0 +1,13 @@
+# Optional apt packages installed at build time, one per line.
+# Blank lines and lines starting with '#' are ignored.
+gh
+jq
+ripgrep
+fd-find
+tree
+unzip
+less
+file
+lsof
+yq
+miller

agent_containers/_assets/agent-images/codex/packages-npm.txt

@@ -0,0 +1,2 @@
+# Optional global npm packages installed at build time, one per line.
+# Blank lines and lines starting with '#' are ignored.

agent_containers/_assets/agent-images/codex/packages-uv.txt

@@ -0,0 +1,6 @@
+# Optional Python libraries installed into the system Python at build time
+# via `uv pip install --system`, one per line. Blank lines and lines
+# starting with '#' are ignored. Unlike tools-uv.txt, these land in the one
+# shared system Python rather than an isolated venv, so they're importable
+# by whatever runs inside the image — a CLI-only package with no importable
+# module of its own belongs in tools-uv.txt instead.

agent_containers/_assets/agent-images/codex/plugin-marketplaces.txt

@@ -0,0 +1,2 @@
+# Optional profile-managed Codex plugin marketplaces.
+# The onboarding CLI adds the Langfuse marketplace only when explicitly enabled.

agent_containers/_assets/agent-images/codex/plugins.txt

@@ -0,0 +1,2 @@
+# Optional profile-managed Codex plugins.
+# The onboarding CLI adds the Langfuse tracing plugin only when explicitly enabled.

agent_containers/_assets/agent-images/codex/proxy-ca.d/.keep

@@ -0,0 +1 @@
+# Profile-specific CA certificates are injected into this directory by the onboarding CLI.

agent_containers/_assets/agent-images/codex/tools-uv.txt

@@ -0,0 +1,4 @@
+# Optional Python CLI tools installed at build time via `uv tool install`,
+# each into its own isolated venv, one per line. Blank lines and lines
+# starting with '#' are ignored. A plain importable library (no
+# console-script entry point of its own) belongs in packages-uv.txt instead.

agent_containers/_assets/agent-images/hermes/Dockerfile

@@ -0,0 +1,122 @@
+FROM nousresearch/hermes-agent:latest
+
+ARG TARGETARCH
+
+# iptables/ipset/dnsmasq/dnsutils enforce the in-container egress allowlist;
+# openssh-client/sshuttle are the gateway-client tunnel (see entrypoint.sh);
+# curl fetches cloudflared below. Upstream's own Node/Python/Playwright
+# toolchain and its s6-overlay boot sequence are untouched by any of this —
+# it only adds the network-containment layer claude-code also has.
+RUN apt-get update \
+    && apt-get upgrade -y \
+    && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        iptables \
+        ipset \
+        dnsmasq \
+        dnsutils \
+        openssh-client \
+        sshuttle \
+    && rm -rf /var/lib/apt/lists/*
+
+# Optional profile-managed organisational CAs; see claude-code/Dockerfile.
+COPY proxy-ca.d/ /tmp/agent-containers-proxy-ca/
+RUN set -eu; \
+    mkdir -p /usr/local/share/ca-certificates/custom; \
+    found=0; \
+    for cert in /tmp/agent-containers-proxy-ca/*; do \
+        [ -f "$cert" ] || continue; \
+        name="$(basename "$cert")"; \
+        [ "$name" = ".keep" ] && continue; \
+        case "$name" in *.crt) ;; *) name="${name%.*}.crt" ;; esac; \
+        cp "$cert" "/usr/local/share/ca-certificates/custom/$name"; \
+        found=1; \
+    done; \
+    if [ "$found" -eq 1 ]; then update-ca-certificates; fi; \
+    rm -rf /tmp/agent-containers-proxy-ca
+
+# User-configurable default software (gh, jq, ripgrep, ...) — see
+# packages-apt.txt. Kept as a separate RUN from the baseline block above so
+# the required-infra list stays untouched by editing that file.
+COPY --from=shared install-additional-packages.sh /usr/local/lib/agent/install-additional-packages.sh
+COPY packages-apt.txt /tmp/packages-apt.txt
+RUN bash -c '. /usr/local/lib/agent/install-additional-packages.sh \
+        && install_apt_packages /tmp/packages-apt.txt' \
+    && rm -f /tmp/packages-apt.txt
+
+# packages-uv.txt — general Python libraries (not CLI tools; see
+# tools-uv.txt below), installed via `uv pip install --system` into
+# upstream's system Python (already on PATH in this base image — no
+# separate uv/uvx COPY needed here, unlike claude-code). Runs as root, since
+# it writes into the image's system site-packages rather than $HOME.
+COPY packages-uv.txt /tmp/packages-uv.txt
+RUN bash -c '. /usr/local/lib/agent/install-additional-packages.sh \
+        && install_uv_packages /tmp/packages-uv.txt' \
+    && rm -f /tmp/packages-uv.txt
+
+# Unlike claude-code, this image has no build-time privilege-drop tool
+# installed (upstream's own runtime drop uses s6-setuidgid, not gosu) — `su`,
+# already present in the base image, does the same job here without adding a
+# new apt dependency. HOME/npm_config_prefix/PATH point at /opt/data
+# (upstream's HERMES_HOME, already owned by the hermes user at this layer)
+# so npm/uv installs below, and any further installs the hermes user makes
+# at runtime, land there instead of under root's home or the read-only
+# rootfs.
+ENV HOME=/opt/data
+ENV npm_config_prefix=/opt/data/.npm-global
+# Home-managed installations intentionally precede profile-managed tools. The
+# latter are image-owned under /opt so a populated data volume cannot hide a
+# rebuilt profile image's requested versions.
+ENV PATH="/opt/data/.local/bin:/opt/data/.npm-global/bin:/opt/agent-tools/bin:/opt/agent-tools/npm/bin:${PATH}"
+
+# $HOME (uv's default cache location) and /workspace are deliberately
+# separate mounts in this containment model, so uv's hardlink/reflink
+# optimisation can never apply between them — declare the copy fallback
+# explicit rather than have uv warn about it on every install.
+ENV UV_LINK_MODE=copy
+
+# packages-npm.txt / tools-uv.txt — see packages-apt.txt above. These managed
+# tools are deliberately separate from /opt/data, the upstream persistent home.
+COPY packages-npm.txt /tmp/packages-npm.txt
+COPY tools-uv.txt /tmp/tools-uv.txt
+RUN mkdir -p /opt/agent-tools/npm /opt/agent-tools/uv-tools /opt/agent-tools/bin \
+    && chown -R hermes:hermes /opt/agent-tools \
+    && su hermes -s /bin/bash -c 'export \
+        npm_config_prefix=/opt/agent-tools/npm \
+        UV_TOOL_DIR=/opt/agent-tools/uv-tools \
+        UV_TOOL_BIN_DIR=/opt/agent-tools/bin; \
+        . /usr/local/lib/agent/install-additional-packages.sh \
+        && install_npm_packages /tmp/packages-npm.txt \
+        && install_uv_tools /tmp/tools-uv.txt' \
+    && rm -f /tmp/packages-npm.txt /tmp/tools-uv.txt
+
+# cloudflared is always installed but only invoked (see entrypoint.sh) when
+# AGENT_GATEWAY_ACCESS_HOSTNAME is set, as an alternative to reaching the
+# gateway by direct TCP — TARGETARCH is supplied automatically by Buildx and
+# matches cloudflared's own release-asset naming (amd64/arm64/386/...).
+RUN curl -fsSL "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${TARGETARCH}" \
+      -o /usr/local/bin/cloudflared \
+    && chmod +x /usr/local/bin/cloudflared
+
+COPY --from=shared egress-allowlist.sh /usr/local/lib/agent/egress-allowlist.sh
+
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+
+# Strip setuid/setgid bits picked up from upstream's base image and the
+# packages installed above (mount, passwd, su, ...). --security-opt
+# no-new-privileges (every documented run invocation) already makes these
+# inert on execve; stripping them removes the exploitable shape instead of
+# relying solely on that flag never regressing. Safe after this point:
+# upstream's runtime privilege drop is s6-setuidgid, which runs as root
+# under the container's own granted CAP_SETUID/CAP_SETGID rather than
+# through any setuid-bit binary.
+RUN find / -xdev -perm /6000 -type f -exec chmod a-s {} + || true
+
+# No useradd/UID build-arg here (unlike claude-code): upstream already
+# ships its own non-root user (hermes, UID 10000, home /opt/data) and its
+# own privilege-drop chain; see entrypoint.sh. CMD is deliberately left at
+# whatever upstream's own image sets it to, so every documented invocation
+# shape keeps working unmodified.
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

agent_containers/_assets/agent-images/hermes/entrypoint.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+set -euo pipefail
+
+if [ -n "${AGENT_GATEWAY_HOST:-}" ]; then
+    echo "[entrypoint] AGENT_GATEWAY_HOST=$AGENT_GATEWAY_HOST — tunneling all egress through the gateway." >&2
+    if [ -n "${AGENT_ALLOWED_EGRESS:-}" ] || [ -f /etc/agent/egress-allowlist.txt ]; then
+        echo "[entrypoint] AGENT_ALLOWED_EGRESS/egress-allowlist.txt are ignored in gateway mode — set the allowlist on the gateway container instead." >&2
+    fi
+    if [ -n "${AGENT_GATEWAY_BOOTSTRAP_ALLOW:-}" ]; then
+        echo "[entrypoint] Seeding a bootstrap allow rule for ${AGENT_GATEWAY_BOOTSTRAP_ALLOW} until the tunnel is up." >&2
+        iptables -P OUTPUT DROP
+        iptables -A OUTPUT -m addrtype --dst-type LOCAL -j ACCEPT
+        iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+        ip6tables -P OUTPUT DROP
+        ip6tables -A OUTPUT -m addrtype --dst-type LOCAL -j ACCEPT
+        ip6tables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+        IFS=',' read -ra BOOTSTRAP_ALLOW <<< "$AGENT_GATEWAY_BOOTSTRAP_ALLOW"
+        for addr in "${BOOTSTRAP_ALLOW[@]}"; do
+            if [[ "$addr" == *:* ]]; then
+                ip6tables -A OUTPUT -d "$addr" -j ACCEPT
+            else
+                iptables -A OUTPUT -d "$addr" -j ACCEPT
+            fi
+        done
+    fi
+    install -m 600 /etc/agent/gateway-key /tmp/gateway-key
+    SSH_CMD="ssh -i /tmp/gateway-key -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/etc/agent/gateway-known-hosts"
+    if [ -n "${AGENT_GATEWAY_ACCESS_HOSTNAME:-}" ]; then
+        echo "[entrypoint] Reaching the gateway via Cloudflare Access hostname ${AGENT_GATEWAY_ACCESS_HOSTNAME}." >&2
+        SSH_CMD="$SSH_CMD -o ProxyCommand='cloudflared access ssh --hostname ${AGENT_GATEWAY_ACCESS_HOSTNAME}'"
+    fi
+    sshuttle -r "${AGENT_GATEWAY_USER:-tunnel}@${AGENT_GATEWAY_HOST}:${AGENT_GATEWAY_PORT:-2222}" \
+        0.0.0.0/0 ::/0 --dns --daemon --pidfile=/tmp/sshuttle.pid \
+        -e "$SSH_CMD"
+else
+    source /usr/local/lib/agent/egress-allowlist.sh
+    configure_egress_allowlist
+fi
+
+# Root has done its network setup above; hand off to upstream's own boot
+# sequence unmodified. /init runs the s6-rc service tree (including
+# stage2-hook.sh, which chowns /opt/data to the hermes user on first boot —
+# hence this image needing CAP_CHOWN under --cap-drop=ALL) and its own
+# s6-setuidgid drop to the unprivileged hermes user, so no gosu/privilege
+# drop is needed on our side. DAC_OVERRIDE is also required under
+# --cap-drop=ALL: 02-reconcile-profiles registers the main-hermes/dashboard
+# services after the static supervise trees are already chowned, so
+# s6-supervise can't open their supervise/lock files without it.
+exec /init /opt/hermes/docker/main-wrapper.sh "$@"

agent_containers/_assets/agent-images/hermes/packages-apt.txt

@@ -0,0 +1,16 @@
+# Default/optional apt packages installed at build time, one per line.
+# Blank lines and lines starting with '#' are ignored. Edit freely and
+# rebuild the image — this is separate from the Dockerfile's own
+# required-infra apt list (iptables, dnsmasq, sshuttle, etc.), which this
+# file cannot remove packages from.
+gh
+jq
+ripgrep
+fd-find
+tree
+unzip
+less
+file
+lsof
+yq
+miller

agent_containers/_assets/agent-images/hermes/packages-npm.txt

@@ -0,0 +1,7 @@
+# Optional global npm packages installed at build time (via `npm install -g`),
+# one per line. Blank lines and lines starting with '#' are ignored. Empty by
+# default — there's no "everyone wants this" global npm CLI the way there is
+# for apt utilities.
+#
+# Example:
+# @some-scope/some-cli

agent_containers/_assets/agent-images/hermes/packages-uv.txt

@@ -0,0 +1,9 @@
+# Optional Python libraries installed into the system Python at build time
+# (via `uv pip install --system`), one per line. Blank lines and lines
+# starting with '#' are ignored. Empty by default. Unlike tools-uv.txt, these
+# land in the one shared system Python rather than an isolated venv, so
+# they're importable by whatever runs inside the image — a CLI-only package
+# with no importable module of its own belongs in tools-uv.txt instead.
+#
+# Example:
+# langfuse

agent_containers/_assets/agent-images/hermes/proxy-ca.d/.keep

@@ -0,0 +1 @@
+# Profile-specific CA certificates are injected into this directory by the onboarding CLI.

agent_containers/_assets/agent-images/hermes/tools-uv.txt

@@ -0,0 +1,9 @@
+# Optional Python CLI tools installed at build time (via `uv tool install`),
+# one per line, each into its own isolated venv. Blank lines and lines
+# starting with '#' are ignored. Empty by default — there's no "everyone
+# wants this" uv-installed CLI the way there is for apt utilities. A plain
+# importable library (no console-script entry point of its own) belongs in
+# packages-uv.txt instead.
+#
+# Example:
+# ruff

agent_containers/_assets/agent-images/kilo-code/Dockerfile

@@ -0,0 +1,101 @@
+FROM python:3.14-slim-trixie AS base
+
+ARG TARGETARCH
+
+# Shared Node.js, containment, gateway-client, and cloudflared baseline for
+# the first-party Python-and-Node workload images.
+COPY --from=shared install-workload-base.sh /usr/local/lib/agent/install-workload-base.sh
+RUN TARGETARCH="$TARGETARCH" bash /usr/local/lib/agent/install-workload-base.sh
+
+COPY --from=shared install-additional-packages.sh /usr/local/lib/agent/install-additional-packages.sh
+COPY packages-apt.txt /tmp/packages-apt.txt
+RUN bash -c '. /usr/local/lib/agent/install-additional-packages.sh \
+        && install_apt_packages /tmp/packages-apt.txt' \
+    && rm -f /tmp/packages-apt.txt
+
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/
+
+# packages-uv.txt — general Python libraries (not CLI tools; see
+# tools-uv.txt below), installed via `uv pip install --system` into this
+# system Python. Runs as root, before the kilo user exists, since it writes
+# into the image's system site-packages rather than $HOME.
+COPY packages-uv.txt /tmp/packages-uv.txt
+RUN bash -c '. /usr/local/lib/agent/install-additional-packages.sh \
+        && install_uv_packages /tmp/packages-uv.txt' \
+    && rm -f /tmp/packages-uv.txt
+
+RUN npm install -g @kilocode/cli
+
+# The kilo account is created here, at a fixed placeholder UID/GID
+# (1000:1000), purely so the root-only installers below (npm, uv tool) have
+# a real non-root account to run as. `final` remaps this account to the
+# operator's actual host UID/GID instead of recreating it, so a rebuild for
+# a different host user reuses everything installed below unchanged rather
+# than reinstalling it over the network.
+RUN groupadd -g 1000 kilo \
+    && useradd -m -u 1000 -g 1000 -s /bin/bash kilo \
+    && mkdir -p /home/kilo/.config/kilo /workspace \
+    && chown -R kilo:kilo /home/kilo /workspace
+
+ENV HOME=/home/kilo
+ENV npm_config_prefix=/home/kilo/.npm-global
+ENV PATH="/home/kilo/.local/bin:/home/kilo/.npm-global/bin:${PATH}"
+
+# $HOME (uv's default cache location) and /workspace are deliberately
+# separate mounts in this containment model, so uv's hardlink/reflink
+# optimisation can never apply between them — declare the copy fallback
+# explicit rather than have uv warn about it on every install.
+ENV UV_LINK_MODE=copy
+
+COPY packages-npm.txt /tmp/packages-npm.txt
+COPY tools-uv.txt /tmp/tools-uv.txt
+RUN gosu kilo bash -c '. /usr/local/lib/agent/install-additional-packages.sh \
+        && install_npm_packages /tmp/packages-npm.txt \
+        && install_uv_tools /tmp/tools-uv.txt' \
+    && rm -f /tmp/packages-npm.txt /tmp/tools-uv.txt
+
+# Everything above this line is UID/GID-independent and layer-cacheable
+# across hosts: the kilo account exists at the fixed placeholder UID/GID
+# only so the installers above have a non-root account to run as. From here
+# down, `final` remaps that account to the operator's actual host UID/GID
+# with --build-arg UID=$(id -u) --build-arg GID=$(id -g) — the base stage
+# above is reused unchanged from cache, and nothing installed above is
+# reinstalled, rather than rebuilding per host user.
+FROM base AS final
+ARG UID=1000
+ARG GID=1000
+
+# Only remap when the caller supplied a different UID/GID than the fixed
+# placeholder baked into `base` above — usermod/groupmod plus a chown -R
+# walk over already-installed content is far cheaper than rerunning the
+# npm/uv-tool installs above, but it's skippable entirely for the common
+# case where the caller never overrides UID/GID. Deliberately no -o:
+# without it, usermod/groupmod refuse to reuse an ID already assigned to
+# another account, so a caller can never remap kilo onto UID/GID 0 (root)
+# or collide it with another in-image identity — the build fails instead of
+# silently succeeding.
+RUN if [ "$UID" != "1000" ] || [ "$GID" != "1000" ]; then \
+        groupmod -g "$GID" kilo \
+        && usermod -u "$UID" -g "$GID" kilo \
+        && chown -R "$UID":"$GID" /home/kilo /workspace; \
+    fi
+
+COPY --from=shared egress-allowlist.sh /usr/local/lib/agent/egress-allowlist.sh
+COPY --from=shared workload-entrypoint.sh /usr/local/lib/agent/workload-entrypoint.sh
+RUN chmod +x /usr/local/lib/agent/workload-entrypoint.sh
+
+# Strip setuid/setgid bits from the base image and every package installed
+# above — required infra (install-workload-base.sh), packages-apt.txt,
+# packages-npm.txt, packages-uv.txt, and tools-uv.txt — run last so nothing
+# installed by any of those is missed. NoNewPrivs=1 (set by every documented
+# run invocation) already makes these bits inert on execve, but that's an
+# argument for stripping them, not against: if any single control ever
+# regresses, a setuid-root `mount` becomes a live escalation primitive. None
+# of these binaries are needed at runtime, so none should ship
+# exploitable-shaped.
+RUN find / -xdev -perm /6000 -type f -exec chmod a-s {} + || true
+
+WORKDIR /workspace
+
+ENTRYPOINT ["/usr/local/lib/agent/workload-entrypoint.sh", "kilo", "kilo"]
+CMD ["kilo"]

agent_containers/_assets/agent-images/kilo-code/examples/egress-allowlist.txt

@@ -0,0 +1,7 @@
+# One hostname or IP/CIDR per line. This file takes precedence over
+# AGENT_ALLOWED_EGRESS when mounted at /etc/agent/egress-allowlist.txt.
+#
+# Kilo's hosted AI Gateway. Use this only when the Kilo gateway is the selected
+# provider; add a configured direct provider, source-control host, MCP server,
+# and package registry explicitly as needed.
+api.kilo.ai