agent-containers 0.1.0.dev0__py3-none-any.whl

agent_containers/_assets/agent-images/kilo-code/packages-apt.txt

@@ -0,0 +1,5 @@
+# One package name per line. These optional packages install at build time.
+file
+lsof
+yq
+miller

agent_containers/_assets/agent-images/kilo-code/packages-npm.txt

@@ -0,0 +1 @@
+# One npm package specifier per line. These optional packages install at build time.

agent_containers/_assets/agent-images/kilo-code/packages-uv.txt

@@ -0,0 +1,4 @@
+# One uv package specifier per line. These optional Python libraries install
+# at build time via `uv pip install --system` into the system Python, so
+# they're importable by whatever runs inside the image — a CLI-only package
+# with no importable module of its own belongs in tools-uv.txt instead.

agent_containers/_assets/agent-images/kilo-code/tools-uv.txt

@@ -0,0 +1,4 @@
+# One uv CLI tool specifier per line. These optional tools install at build
+# time via `uv tool install`, each into its own isolated venv. A plain
+# importable library (no console-script entry point of its own) belongs in
+# packages-uv.txt instead.

agent_containers/_assets/agent-images/opencode/Dockerfile

@@ -0,0 +1,126 @@
+FROM python:3.14-slim-trixie AS base
+
+ARG TARGETARCH
+
+# Shared Node.js, containment, gateway-client, and cloudflared baseline for
+# the first-party Python-and-Node workload images.
+COPY --from=shared install-workload-base.sh /usr/local/lib/agent/install-workload-base.sh
+RUN TARGETARCH="$TARGETARCH" bash /usr/local/lib/agent/install-workload-base.sh
+
+# Optional profile-managed organisational CAs; see claude-code/Dockerfile.
+COPY proxy-ca.d/ /tmp/agent-containers-proxy-ca/
+RUN set -eu; \
+    mkdir -p /usr/local/share/ca-certificates/custom; \
+    found=0; \
+    for cert in /tmp/agent-containers-proxy-ca/*; do \
+        [ -f "$cert" ] || continue; \
+        name="$(basename "$cert")"; \
+        [ "$name" = ".keep" ] && continue; \
+        case "$name" in *.crt) ;; *) name="${name%.*}.crt" ;; esac; \
+        cp "$cert" "/usr/local/share/ca-certificates/custom/$name"; \
+        found=1; \
+    done; \
+    if [ "$found" -eq 1 ]; then update-ca-certificates; fi; \
+    rm -rf /tmp/agent-containers-proxy-ca
+
+COPY --from=shared install-additional-packages.sh /usr/local/lib/agent/install-additional-packages.sh
+COPY packages-apt.txt /tmp/packages-apt.txt
+RUN bash -c '. /usr/local/lib/agent/install-additional-packages.sh \
+        && install_apt_packages /tmp/packages-apt.txt' \
+    && rm -f /tmp/packages-apt.txt
+
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/
+
+# packages-uv.txt — general Python libraries (not CLI tools; see
+# tools-uv.txt below), installed via `uv pip install --system` into this
+# system Python. Runs as root, before the opencode user exists, since it
+# writes into the image's system site-packages rather than $HOME.
+COPY packages-uv.txt /tmp/packages-uv.txt
+RUN bash -c '. /usr/local/lib/agent/install-additional-packages.sh \
+        && install_uv_packages /tmp/packages-uv.txt' \
+    && rm -f /tmp/packages-uv.txt
+
+RUN npm install -g opencode-ai
+
+# The opencode account is created here, at a fixed placeholder UID/GID
+# (1000:1000), purely so the root-only installers below (npm, uv tool) have
+# a real non-root account to run as. `final` remaps this account to the
+# operator's actual host UID/GID instead of recreating it, so a rebuild for
+# a different host user reuses everything installed below unchanged rather
+# than reinstalling it over the network.
+RUN groupadd -g 1000 opencode \
+    && useradd -m -u 1000 -g 1000 -s /bin/bash opencode \
+    && mkdir -p /home/opencode/.config/opencode /home/opencode/.local/share/opencode /workspace \
+    && chown -R opencode:opencode /home/opencode /workspace
+
+ENV HOME=/home/opencode
+ENV npm_config_prefix=/home/opencode/.npm-global
+# Home-managed installations intentionally precede profile-managed tools. The
+# latter are image-owned under /opt so a populated home volume cannot hide a
+# rebuilt profile image's requested versions.
+ENV PATH="/home/opencode/.local/bin:/home/opencode/.npm-global/bin:/opt/agent-tools/bin:/opt/agent-tools/npm/bin:${PATH}"
+
+# $HOME (uv's default cache location) and /workspace are deliberately
+# separate mounts in this containment model, so uv's hardlink/reflink
+# optimisation can never apply between them — declare the copy fallback
+# explicit rather than have uv warn about it on every install.
+ENV UV_LINK_MODE=copy
+
+COPY packages-npm.txt /tmp/packages-npm.txt
+COPY tools-uv.txt /tmp/tools-uv.txt
+RUN mkdir -p /opt/agent-tools/npm /opt/agent-tools/uv-tools /opt/agent-tools/bin \
+    && chown -R opencode:opencode /opt/agent-tools \
+    && gosu opencode env \
+        npm_config_prefix=/opt/agent-tools/npm \
+        UV_TOOL_DIR=/opt/agent-tools/uv-tools \
+        UV_TOOL_BIN_DIR=/opt/agent-tools/bin \
+        bash -c '. /usr/local/lib/agent/install-additional-packages.sh \
+        && install_npm_packages /tmp/packages-npm.txt \
+        && install_uv_tools /tmp/tools-uv.txt' \
+    && rm -f /tmp/packages-npm.txt /tmp/tools-uv.txt
+
+# Everything above this line is UID/GID-independent and layer-cacheable
+# across hosts: the opencode account exists at the fixed placeholder
+# UID/GID only so the installers above have a non-root account to run as.
+# From here down, `final` remaps that account to the operator's actual host
+# UID/GID with --build-arg UID=$(id -u) --build-arg GID=$(id -g) — the base
+# stage above is reused unchanged from cache, and nothing installed above
+# is reinstalled, rather than rebuilding per host user.
+FROM base AS final
+ARG UID=1000
+ARG GID=1000
+
+# Only remap when the caller supplied a different UID/GID than the fixed
+# placeholder baked into `base` above — usermod/groupmod plus a chown -R
+# walk over already-installed content is far cheaper than rerunning the
+# npm/uv-tool installs above, but it's skippable entirely for the common
+# case where the caller never overrides UID/GID. Deliberately no -o:
+# without it, usermod/groupmod refuse to reuse an ID already assigned to
+# another account, so a caller can never remap opencode onto UID/GID 0
+# (root) or collide it with another in-image identity — the build fails
+# instead of silently succeeding.
+RUN if [ "$UID" != "1000" ] || [ "$GID" != "1000" ]; then \
+        groupmod -g "$GID" opencode \
+        && usermod -u "$UID" -g "$GID" opencode \
+        && chown -R "$UID":"$GID" /home/opencode /workspace /opt/agent-tools; \
+    fi
+
+COPY --from=shared egress-allowlist.sh /usr/local/lib/agent/egress-allowlist.sh
+COPY --from=shared workload-entrypoint.sh /usr/local/lib/agent/workload-entrypoint.sh
+RUN chmod +x /usr/local/lib/agent/workload-entrypoint.sh
+
+# Strip setuid/setgid bits from the base image and every package installed
+# above — required infra (install-workload-base.sh), packages-apt.txt,
+# packages-npm.txt, packages-uv.txt, and tools-uv.txt — run last so nothing
+# installed by any of those is missed. NoNewPrivs=1 (set by every documented
+# run invocation) already makes these bits inert on execve, but that's an
+# argument for stripping them, not against: if any single control ever
+# regresses, a setuid-root `mount` becomes a live escalation primitive. None
+# of these binaries are needed at runtime, so none should ship
+# exploitable-shaped.
+RUN find / -xdev -perm /6000 -type f -exec chmod a-s {} + || true
+
+WORKDIR /workspace
+
+ENTRYPOINT ["/usr/local/lib/agent/workload-entrypoint.sh", "opencode", "opencode"]
+CMD ["opencode"]

agent_containers/_assets/agent-images/opencode/examples/egress-allowlist.txt

@@ -0,0 +1,6 @@
+# Hosts/IPs the container is allowed to reach outbound, one per line.
+# Blank lines and lines starting with '#' are ignored. Mount this file at
+# /etc/agent/egress-allowlist.txt; it takes precedence over
+# $AGENT_ALLOWED_EGRESS. If neither is set, outbound traffic is denied.
+opencode.ai
+models.dev

agent_containers/_assets/agent-images/opencode/packages-apt.txt

@@ -0,0 +1,13 @@
+# Optional apt packages installed at build time, one per line.
+# Blank lines and lines starting with '#' are ignored.
+gh
+jq
+ripgrep
+fd-find
+tree
+unzip
+less
+file
+lsof
+yq
+miller

agent_containers/_assets/agent-images/opencode/packages-npm.txt

@@ -0,0 +1,2 @@
+# Optional global npm packages installed at build time, one per line.
+# Blank lines and lines starting with '#' are ignored.

agent_containers/_assets/agent-images/opencode/packages-uv.txt

@@ -0,0 +1,6 @@
+# Optional Python libraries installed into the system Python at build time
+# via `uv pip install --system`, one per line. Blank lines and lines
+# starting with '#' are ignored. Unlike tools-uv.txt, these land in the one
+# shared system Python rather than an isolated venv, so they're importable
+# by whatever runs inside the image — a CLI-only package with no importable
+# module of its own belongs in tools-uv.txt instead.

agent_containers/_assets/agent-images/opencode/proxy-ca.d/.keep

@@ -0,0 +1 @@
+# Profile-specific CA certificates are injected into this directory by the onboarding CLI.

agent_containers/_assets/agent-images/opencode/tools-uv.txt

@@ -0,0 +1,4 @@
+# Optional Python CLI tools installed at build time via `uv tool install`,
+# each into its own isolated venv, one per line. Blank lines and lines
+# starting with '#' are ignored. A plain importable library (no
+# console-script entry point of its own) belongs in packages-uv.txt instead.

agent_containers/_assets/agent-images/qwen-code/Dockerfile

@@ -0,0 +1,104 @@
+FROM python:3.14-slim-trixie AS base
+
+ARG TARGETARCH
+
+# Shared Node.js, containment, gateway-client, and cloudflared baseline for
+# the first-party Python-and-Node workload images.
+COPY --from=shared install-workload-base.sh /usr/local/lib/agent/install-workload-base.sh
+RUN TARGETARCH="$TARGETARCH" bash /usr/local/lib/agent/install-workload-base.sh
+
+COPY --from=shared install-additional-packages.sh /usr/local/lib/agent/install-additional-packages.sh
+COPY packages-apt.txt /tmp/packages-apt.txt
+RUN bash -c '. /usr/local/lib/agent/install-additional-packages.sh \
+        && install_apt_packages /tmp/packages-apt.txt' \
+    && rm -f /tmp/packages-apt.txt
+
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/
+
+# packages-uv.txt — general Python libraries (not CLI tools; see
+# tools-uv.txt below), installed via `uv pip install --system` into this
+# system Python. Runs as root, before the qwen user exists, since it writes
+# into the image's system site-packages rather than $HOME.
+COPY packages-uv.txt /tmp/packages-uv.txt
+RUN bash -c '. /usr/local/lib/agent/install-additional-packages.sh \
+        && install_uv_packages /tmp/packages-uv.txt' \
+    && rm -f /tmp/packages-uv.txt
+
+RUN npm install -g @qwen-code/qwen-code
+
+# The qwen account is created here, at a fixed placeholder UID/GID
+# (1000:1000), purely so the root-only installers below (npm, uv tool) have
+# a real non-root account to run as. `final` remaps this account to the
+# operator's actual host UID/GID instead of recreating it, so a rebuild for
+# a different host user reuses everything installed below unchanged rather
+# than reinstalling it over the network.
+RUN groupadd -g 1000 qwen \
+    && useradd -m -u 1000 -g 1000 -s /bin/bash qwen \
+    && mkdir -p /home/qwen/.qwen /workspace \
+    && chown -R qwen:qwen /home/qwen /workspace
+
+ENV HOME=/home/qwen
+ENV npm_config_prefix=/home/qwen/.npm-global
+ENV PATH="/home/qwen/.local/bin:/home/qwen/.npm-global/bin:${PATH}"
+
+# $HOME (uv's default cache location) and /workspace are deliberately
+# separate mounts in this containment model, so uv's hardlink/reflink
+# optimisation can never apply between them — declare the copy fallback
+# explicit rather than have uv warn about it on every install.
+ENV UV_LINK_MODE=copy
+# The outer container is the sandbox. Never let Qwen Code start a nested
+# Docker/Podman sandbox, which would require access to a container runtime.
+ENV QWEN_SANDBOX=false
+
+COPY packages-npm.txt /tmp/packages-npm.txt
+COPY tools-uv.txt /tmp/tools-uv.txt
+RUN gosu qwen bash -c '. /usr/local/lib/agent/install-additional-packages.sh \
+        && install_npm_packages /tmp/packages-npm.txt \
+        && install_uv_tools /tmp/tools-uv.txt' \
+    && rm -f /tmp/packages-npm.txt /tmp/tools-uv.txt
+
+# Everything above this line is UID/GID-independent and layer-cacheable
+# across hosts: the qwen account exists at the fixed placeholder UID/GID
+# only so the installers above have a non-root account to run as. From here
+# down, `final` remaps that account to the operator's actual host UID/GID
+# with --build-arg UID=$(id -u) --build-arg GID=$(id -g) — the base stage
+# above is reused unchanged from cache, and nothing installed above is
+# reinstalled, rather than rebuilding per host user.
+FROM base AS final
+ARG UID=1000
+ARG GID=1000
+
+# Only remap when the caller supplied a different UID/GID than the fixed
+# placeholder baked into `base` above — usermod/groupmod plus a chown -R
+# walk over already-installed content is far cheaper than rerunning the
+# npm/uv-tool installs above, but it's skippable entirely for the common
+# case where the caller never overrides UID/GID. Deliberately no -o:
+# without it, usermod/groupmod refuse to reuse an ID already assigned to
+# another account, so a caller can never remap qwen onto UID/GID 0 (root)
+# or collide it with another in-image identity — the build fails instead of
+# silently succeeding.
+RUN if [ "$UID" != "1000" ] || [ "$GID" != "1000" ]; then \
+        groupmod -g "$GID" qwen \
+        && usermod -u "$UID" -g "$GID" qwen \
+        && chown -R "$UID":"$GID" /home/qwen /workspace; \
+    fi
+
+COPY --from=shared egress-allowlist.sh /usr/local/lib/agent/egress-allowlist.sh
+COPY --from=shared workload-entrypoint.sh /usr/local/lib/agent/workload-entrypoint.sh
+RUN chmod +x /usr/local/lib/agent/workload-entrypoint.sh
+
+# Strip setuid/setgid bits from the base image and every package installed
+# above — required infra (install-workload-base.sh), packages-apt.txt,
+# packages-npm.txt, packages-uv.txt, and tools-uv.txt — run last so nothing
+# installed by any of those is missed. NoNewPrivs=1 (set by every documented
+# run invocation) already makes these bits inert on execve, but that's an
+# argument for stripping them, not against: if any single control ever
+# regresses, a setuid-root `mount` becomes a live escalation primitive. None
+# of these binaries are needed at runtime, so none should ship
+# exploitable-shaped.
+RUN find / -xdev -perm /6000 -type f -exec chmod a-s {} + || true
+
+WORKDIR /workspace
+
+ENTRYPOINT ["/usr/local/lib/agent/workload-entrypoint.sh", "qwen", "qwen"]
+CMD ["qwen"]

agent_containers/_assets/agent-images/qwen-code/examples/egress-allowlist.txt

@@ -0,0 +1,10 @@
+# Hosts/IPs the container is allowed to reach outbound, one per line.
+# Blank lines and lines starting with '#' are ignored. Mount this file at
+# /etc/agent/egress-allowlist.txt; it takes precedence over
+# $AGENT_ALLOWED_EGRESS. If neither is set, outbound traffic is denied.
+#
+# These are the DashScope-compatible official Qwen API endpoints. Use only the
+# endpoint appropriate for your account, and add every separately configured
+# model provider, MCP server, source-control host, or package registry.
+dashscope.aliyuncs.com
+dashscope-intl.aliyuncs.com

agent_containers/_assets/agent-images/qwen-code/packages-apt.txt

@@ -0,0 +1,13 @@
+# Optional apt packages installed at build time, one per line.
+# Blank lines and lines starting with '#' are ignored.
+gh
+jq
+ripgrep
+fd-find
+tree
+unzip
+less
+file
+lsof
+yq
+miller

agent_containers/_assets/agent-images/qwen-code/packages-npm.txt

@@ -0,0 +1,2 @@
+# Optional global npm packages installed at build time, one per line.
+# Blank lines and lines starting with '#' are ignored.

agent_containers/_assets/agent-images/qwen-code/packages-uv.txt

@@ -0,0 +1,6 @@
+# Optional Python libraries installed into the system Python at build time
+# via `uv pip install --system`, one per line. Blank lines and lines
+# starting with '#' are ignored. Unlike tools-uv.txt, these land in the one
+# shared system Python rather than an isolated venv, so they're importable
+# by whatever runs inside the image — a CLI-only package with no importable
+# module of its own belongs in tools-uv.txt instead.

agent_containers/_assets/agent-images/qwen-code/tools-uv.txt

@@ -0,0 +1,4 @@
+# Optional Python CLI tools installed at build time via `uv tool install`,
+# each into its own isolated venv, one per line. Blank lines and lines
+# starting with '#' are ignored. A plain importable library (no
+# console-script entry point of its own) belongs in packages-uv.txt instead.

agent_containers/_assets/agent-images/shared/egress-allowlist.sh

@@ -0,0 +1,138 @@
+#!/bin/bash
+# Shared by the workload and agent-gateway entrypoints. Configures this
+# container's own OUTPUT chain to allow only the hosts/IPs in AGENT_ALLOWED_EGRESS /
+# /etc/agent/egress-allowlist.txt (file mount takes precedence over the env
+# var), defaulting to deny-all when neither is set. Must be sourced and
+# called as root, before any privilege drop, since it installs iptables
+# rules and starts dnsmasq.
+
+configure_egress_allowlist() {
+    local allowlist_file="/etc/agent/egress-allowlist.txt"
+    local ipset_name="agent_allowed"
+    local ipset6_name="agent_allowed6"
+    local -a allowlist
+
+    # File mount takes precedence over the env var; neither set means deny-all.
+    if [ -f "$allowlist_file" ]; then
+        mapfile -t allowlist < <(grep -v '^\s*#' "$allowlist_file" | grep -v '^\s*$')
+    elif [ -n "${AGENT_ALLOWED_EGRESS:-}" ]; then
+        IFS=',' read -ra allowlist <<< "$AGENT_ALLOWED_EGRESS"
+    else
+        allowlist=()
+    fi
+
+    _egress_is_ipv4() { [[ "$1" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(/[0-9]{1,2})?$ ]]; }
+    _egress_is_ipv6() { [[ "$1" == *:* ]]; }
+
+    if [ "${#allowlist[@]}" -eq 1 ] && [ "${allowlist[0]}" = "*" ]; then
+        echo "[egress-allowlist] AGENT_ALLOWED_EGRESS=* — no egress restrictions applied (IPv4 and IPv6)." >&2
+        return 0
+    fi
+
+    if [ "${#allowlist[@]}" -eq 0 ]; then
+        echo "[egress-allowlist] No allowlist configured (\$AGENT_ALLOWED_EGRESS unset, no $allowlist_file mount)." >&2
+        echo "[egress-allowlist] Defaulting to deny-all outbound traffic (IPv4 and IPv6). Set AGENT_ALLOWED_EGRESS=host1,host2 (or '*' for unrestricted) to change this." >&2
+        iptables -P OUTPUT DROP
+        iptables -A OUTPUT -o lo -j ACCEPT
+        iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+        ip6tables -P OUTPUT DROP
+        ip6tables -A OUTPUT -o lo -j ACCEPT
+        ip6tables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+        return 0
+    fi
+
+    echo "[egress-allowlist] Restricting egress to: ${allowlist[*]}" >&2
+
+    # Preserve whatever resolvers were in place before we take over DNS.
+    local upstream_dns
+    upstream_dns=$(grep '^nameserver' /etc/resolv.conf | awk '{print $2}')
+
+    ipset create "$ipset_name" hash:ip family inet -exist
+    ipset create "$ipset6_name" hash:ip family inet6 -exist
+
+    # /tmp rather than /etc: entrypoint runs before rootfs is guaranteed
+    # writable (a --read-only container only gets /tmp and /run as tmpfs).
+    local dnsmasq_conf=/tmp/dnsmasq.agent.conf
+    {
+        echo "no-resolv"
+        echo "listen-address=127.0.0.1"
+        echo "bind-interfaces"
+        # Pin dnsmasq to a known, unprivileged UID so the NAT rules below can
+        # tell its own upstream forwarding apart from every other process's
+        # DNS traffic (both otherwise share the same destination: $upstream_dns).
+        echo "user=dnsmasq"
+        # Deliberately no unqualified "server=$ns" default here. Only the
+        # per-domain "server=/entry/$ns" lines added below (one per
+        # allowlisted name) are allowed to forward upstream; a query for
+        # anything else matches no server line, so dnsmasq answers it
+        # locally (NXDOMAIN) instead of forwarding it. Without this, every
+        # domain — allowlisted or not — would resolve via the blanket
+        # default, and only the *connection* to the resolved address would
+        # be filtered, leaving DNS itself as an unfiltered exfiltration
+        # channel (arbitrary data encoded in queried names, or in the
+        # queried names of an attacker-controlled zone, still reaches the
+        # upstream resolver even though the matching IP egress is blocked).
+    } > "$dnsmasq_conf"
+
+    local entry
+    for entry in "${allowlist[@]}"; do
+        entry="$(echo "$entry" | xargs)" # trim whitespace
+        if _egress_is_ipv6 "$entry"; then
+            ipset add "$ipset6_name" "$entry" -exist
+        elif _egress_is_ipv4 "$entry"; then
+            ipset add "$ipset_name" "$entry" -exist
+        else
+            # dnsmasq routes A records into the first set and AAAA records
+            # into the second, based on each set's own address family.
+            echo "ipset=/$entry/$ipset_name,$ipset6_name" >> "$dnsmasq_conf"
+            local ns
+            for ns in $upstream_dns; do
+                echo "server=/$entry/$ns" >> "$dnsmasq_conf"
+            done
+        fi
+    done
+
+    dnsmasq --conf-file="$dnsmasq_conf"
+
+    iptables -P OUTPUT DROP
+    iptables -A OUTPUT -d 127.0.0.0/8 -j ACCEPT
+    iptables -A OUTPUT -o lo -j ACCEPT
+    iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+    ip6tables -P OUTPUT DROP
+    ip6tables -A OUTPUT -d ::1/128 -j ACCEPT
+    ip6tables -A OUTPUT -o lo -j ACCEPT
+    ip6tables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+    for ns in $upstream_dns; do
+        if _egress_is_ipv6 "$ns"; then
+            ip6tables -A OUTPUT -p udp -d "$ns" --dport 53 -j ACCEPT
+            ip6tables -A OUTPUT -p tcp -d "$ns" --dport 53 -j ACCEPT
+        else
+            iptables -A OUTPUT -p udp -d "$ns" --dport 53 -j ACCEPT
+            iptables -A OUTPUT -p tcp -d "$ns" --dport 53 -j ACCEPT
+        fi
+    done
+    iptables -A OUTPUT -m set --match-set "$ipset_name" dst -j ACCEPT
+    ip6tables -A OUTPUT -m set --match-set "$ipset6_name" dst -j ACCEPT
+
+    # Force every process's DNS traffic to the local filtering dnsmasq
+    # instance via NAT instead of rewriting /etc/resolv.conf, which isn't
+    # writable under --read-only. dnsmasq's own upstream forwarding (to the
+    # same $upstream_dns) must not be redirected back to itself, so it's
+    # excluded by UID via a negated owner match on the same rule, rather than
+    # a separate RETURN rule ahead of a blanket REDIRECT — a plain append
+    # (-A) here loses a race on Docker user-defined networks: Docker inserts
+    # its own embedded-DNS NAT rule (destination 127.0.0.11) ahead of
+    # whatever this script appends, and that rule is a terminating DNAT, so
+    # a RETURN-then-REDIRECT pair appended afterward never even runs for
+    # traffic to 127.0.0.11 — dnsmasq is silently bypassed, its ipset never
+    # gets populated, and domain-based allowlist entries stay permanently
+    # (and confusingly) blocked. Inserting (-I ... 1) a single rule with a
+    # negated owner match wins that race: dnsmasq's own query still falls
+    # through untouched to Docker's rule below it, while every other
+    # process's query is redirected to the local dnsmasq before Docker's
+    # rule ever sees it.
+    iptables -t nat -I OUTPUT 1 -p tcp --dport 53 -m owner ! --uid-owner dnsmasq -j REDIRECT --to-ports 53
+    iptables -t nat -I OUTPUT 1 -p udp --dport 53 -m owner ! --uid-owner dnsmasq -j REDIRECT --to-ports 53
+    ip6tables -t nat -I OUTPUT 1 -p tcp --dport 53 -m owner ! --uid-owner dnsmasq -j REDIRECT --to-ports 53
+    ip6tables -t nat -I OUTPUT 1 -p udp --dport 53 -m owner ! --uid-owner dnsmasq -j REDIRECT --to-ports 53
+}

agent_containers/_assets/agent-images/shared/install-additional-packages.sh

@@ -0,0 +1,79 @@
+#!/bin/bash
+# Shared support for installing additional packages in workload-image
+# Dockerfiles. Build-time only, unlike
+# egress-allowlist.sh: invoked directly during `docker build`, never sourced
+# at runtime. Installs each image's
+# user-configurable default software from plain package-list files (one
+# entry per line, '#' comments, blank lines ignored) — same convention as
+# plugins.txt. Each function no-ops if its file is missing or has no
+# non-comment entries, so an image can ship empty lists at zero cost.
+#
+# Two distinct uv-backed installers exist because `uv tool install` and
+# `uv pip install --system` put packages in fundamentally incompatible
+# places: install_uv_tools gives each entry its own isolated venv (only that
+# entry's own console-script wrapper ends up on PATH — nothing importable
+# lands anywhere shared), while install_uv_packages installs into the one
+# shared system Python so entries can `import` each other and whatever else
+# runs in that interpreter. A library with no console-script entry point
+# (e.g. a plain SDK) has no wrapper to run in isolation, so it belongs in
+# packages-uv.txt/install_uv_packages, not tools-uv.txt/install_uv_tools.
+
+# Inherited by whatever sources this file, so a failed apt-get/npm/uv install
+# aborts the build immediately instead of being masked by a later command
+# (e.g. `rm -rf /var/lib/apt/lists/*`) that succeeds regardless.
+set -e
+
+install_apt_packages() {
+    local file="$1"
+    [ -s "$file" ] || return 0
+    local -a packages
+    mapfile -t packages < <(grep -v '^[[:space:]]*#' "$file" \
+        | grep -v '^[[:space:]]*$' \
+        | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
+    [ "${#packages[@]}" -eq 0 ] && return 0
+    apt-get update
+    apt-get install -y --no-install-recommends "${packages[@]}"
+    rm -rf /var/lib/apt/lists/*
+}
+
+install_npm_packages() {
+    local file="$1"
+    [ -s "$file" ] || return 0
+    local line package
+    while IFS= read -r line; do
+        # sed, not xargs, to trim -- xargs parses its input for shell-style
+        # quoting, which breaks on ordinary text like "there's" or "'#'" in
+        # this file's own comment lines.
+        package="$(printf '%s' "$line" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
+        case "$package" in ''|'#'*) continue ;; esac
+        npm install -g "$package"
+    done < "$file"
+}
+
+install_uv_tools() {
+    local file="$1"
+    [ -s "$file" ] || return 0
+    local line package
+    # uv doesn't batch multi-package installs the way apt/npm do — each
+    # package gets its own isolated venv, so this must be one call per line.
+    while IFS= read -r line; do
+        package="$(printf '%s' "$line" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
+        case "$package" in ''|'#'*) continue ;; esac
+        uv tool install "$package"
+    done < "$file"
+}
+
+install_uv_packages() {
+    local file="$1"
+    [ -s "$file" ] || return 0
+    local -a packages
+    mapfile -t packages < <(grep -v '^[[:space:]]*#' "$file" \
+        | grep -v '^[[:space:]]*$' \
+        | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
+    [ "${#packages[@]}" -eq 0 ] && return 0
+    # --system, unlike uv tool install: lands in the one shared system Python
+    # so entries can import each other and whatever else runs in that
+    # interpreter. Batched in one resolve/install, same as apt/npm, since
+    # there's no per-entry isolation to force one-call-per-line here.
+    uv pip install --system "${packages[@]}"
+}

agent_containers/_assets/agent-images/shared/install-workload-base.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+# Shared build-time baseline for the first-party Python-and-Node workload
+# images: adal, claude-code, codex, kilo-code, opencode, and qwen-code. Keep this
+# separate from install-additional-packages.sh: this file owns required
+# containment and runtime infrastructure, whereas that script consumes each
+# image's optional user-selected package lists.
+
+set -euo pipefail
+
+: "${TARGETARCH:?TARGETARCH must be set by the Dockerfile}"
+
+# Node.js installs each image's CLI. The remaining packages support the
+# in-container egress allowlist, the optional gateway tunnel, and gosu's
+# privilege drop after root installs those firewall rules.
+apt-get update
+apt-get upgrade -y
+apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    git \
+    gnupg \
+    iptables \
+    ipset \
+    dnsmasq \
+    dnsutils \
+    gosu \
+    openssh-client \
+    sshuttle
+curl -fsSL https://deb.nodesource.com/setup_lts.x | bash -
+apt-get install -y --no-install-recommends nodejs
+rm -rf /var/lib/apt/lists/*
+
+# cloudflared is only invoked when AGENT_GATEWAY_ACCESS_HOSTNAME is set, but
+# installing it in every workload keeps the gateway-client contract uniform.
+# TARGETARCH is supplied automatically by Buildx and matches Cloudflare's
+# release-asset naming (amd64/arm64/386/...).
+curl -fsSL "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${TARGETARCH}" \
+    -o /usr/local/bin/cloudflared
+chmod +x /usr/local/bin/cloudflared
+
+# Deliberately no setuid/setgid strip here: this script runs before each
+# consuming Dockerfile's optional packages-apt.txt install, so stripping at
+# this point would miss any setuid/setgid binary a user-added apt package
+# ships. Each Dockerfile that sources this script instead runs its own strip
+# as its last build step, after every package list (required and optional)
+# has been installed. See claude-code/Dockerfile for the reference comment.