mikluko/kuberex

Watch

Fork 0

Image: Debian base, multi-arch, Rex and Claude Code pinned in the image #7

New issue

Closed

opened 2026-10-31 13:09:04 +00:00 by mikluko · 6 comments

mikluko commented

2026-10-31 13:09:04 +00:00

Owner

Map: #1

Question

Release sarak.sh/mikluko/kuberex with Rex and Claude Code preinstalled at pinned versions, through CHANGELOG.md:

FROM debian:trixie-YYYYMMDD, linux/amd64 and linux/arm64, the base packages already in main.
Install rex=<pin> from https://pkgs.superlogical.com/rex/apt and claude-code=<pin> from https://downloads.claude.ai/claude-code/apt at build, keyrings and sources baked. Pins live in this repo. The Rex repo is public: no credential.
Remove kuberex install, the overlays, KUBEREX_PACKAGES, /etc/kuberex/apt, REX_APT_AUTH; the entrypoint runs rex server run --tailscale as rex with the TS_* settings.
README: drop the credential section, state the pinned versions.
Fix the release workflow: on push, pin is skipped and plan/image/release are skipped with it (runs 272, 289), so 0.2.0 never published.
Check the registry login (vars.REGISTRY_AUDIENCE) after the rename.

0.2.0 is untagged; its CHANGELOG entry is rewritten to this content rather than followed by 0.3.0.

Resolved when the tag is in sarak.sh/mikluko/kuberex for both platforms.

Map: #1 ## Question Release `sarak.sh/mikluko/kuberex` with Rex and Claude Code preinstalled at pinned versions, through CHANGELOG.md: - `FROM debian:trixie-YYYYMMDD`, `linux/amd64` and `linux/arm64`, the base packages already in `main`. - Install `rex=<pin>` from `https://pkgs.superlogical.com/rex/apt` and `claude-code=<pin>` from `https://downloads.claude.ai/claude-code/apt` at build, keyrings and sources baked. Pins live in this repo. The Rex repo is public: no credential. - Remove `kuberex install`, the overlays, `KUBEREX_PACKAGES`, `/etc/kuberex/apt`, `REX_APT_AUTH`; the entrypoint runs `rex server run --tailscale` as `rex` with the `TS_*` settings. - README: drop the credential section, state the pinned versions. - Fix the release workflow: on push, `pin` is skipped and `plan`/`image`/`release` are skipped with it (runs 272, 289), so 0.2.0 never published. - Check the registry login (`vars.REGISTRY_AUDIENCE`) after the rename. 0.2.0 is untagged; its CHANGELOG entry is rewritten to this content rather than followed by 0.3.0. Resolved when the tag is in `sarak.sh/mikluko/kuberex` for both platforms.

mikluko added the

wayfinder:task

label

2026-10-31 13:09:16 +00:00

mikluko added a new dependency

2026-10-31 13:09:18 +00:00

#5 Image toolchain for agents in Rex terminals

mikluko added a new dependency

2026-10-31 13:09:18 +00:00

#8 Deploy kuberex on saraksh via Flux HelmRelease

mikluko changed title from ~~Image: ship the agent toolchain~~ to Image: agent toolchain, multi-arch

2026-10-31 14:28:43 +00:00

mikluko added a new dependency

2026-10-31 15:49:29 +00:00

#10 Prototype: startup install through a shared overlay

mikluko commented

2026-10-31 16:08:12 +00:00

Author

Owner

From the overlay prototype (#10): create rex with a fixed uid/gid before installing; ship ca-certificates, mount/setpriv (util-linux); the entrypoint shape is on branch prototype/overlay-install.

From the overlay prototype (#10): create `rex` with a fixed uid/gid before installing; ship `ca-certificates`, `mount`/`setpriv` (util-linux); the entrypoint shape is on branch `prototype/overlay-install`.

mikluko commented

2026-10-31 16:19:32 +00:00

Author

Owner

Exposure decided (#3): the entrypoint maps TS_HOSTNAME (default kuberex), TS_AUTHKEY_FILE and TS_CONTROL_URL onto rex server run --tailscale.

Exposure decided (#3): the entrypoint maps `TS_HOSTNAME` (default `kuberex`), `TS_AUTHKEY_FILE` and `TS_CONTROL_URL` onto `rex server run --tailscale`.

mikluko self-assigned this

2026-10-31 16:21:31 +00:00

mikluko referenced this issue from a commit

2026-10-31 16:32:33 +00:00

kuberex 0.2.0: Debian base, multi-arch, Rex and Claude Code installed at pod start

mikluko referenced this issue

2026-10-31 16:32:43 +00:00

kuberex 0.2.0: Debian base, multi-arch, Rex and Claude Code installed at pod start #11

mikluko changed title from ~~Image: agent toolchain, multi-arch~~ to Image: Debian base, multi-arch, startup install

2026-10-31 16:33:18 +00:00

mikluko commented

2026-10-31 16:33:18 +00:00

Author

Owner

Rescoped: agent tooling and wiring are out of scope (baox, bao, gh, kubectl, aws, credential helpers, managed settings, forgejo-mcp). The image keeps the Debian base packages, the fixed rex user, the startup install of Rex and Claude Code, and the tailnet parameters.

Rescoped: agent tooling and wiring are out of scope (baox, bao, gh, kubectl, aws, credential helpers, managed settings, forgejo-mcp). The image keeps the Debian base packages, the fixed `rex` user, the startup install of Rex and Claude Code, and the tailnet parameters.

mikluko referenced this issue from a commit

2026-10-31 16:36:08 +00:00

Drop the agent toolchain and wiring from the image

mikluko added a new dependency

2026-10-31 16:37:56 +00:00

#12 Helm chart for kuberex

mikluko commented

2026-10-31 16:37:57 +00:00

Author

Owner

Decided: the image installs only rex by itself. Extra packages come from KUBEREX_PACKAGES (apt specs, pins allowed), extra apt sources, keyrings and auth from a mount at /etc/kuberex/apt/. Claude Code's source leaves the image and CLAUDE_CODE_VERSION goes. The Helm chart is #12, in this repo, published as OCI next to the image.

Decided: the image installs only `rex` by itself. Extra packages come from `KUBEREX_PACKAGES` (apt specs, pins allowed), extra apt sources, keyrings and auth from a mount at `/etc/kuberex/apt/`. Claude Code's source leaves the image and `CLAUDE_CODE_VERSION` goes. The Helm chart is #12, in this repo, published as OCI next to the image.

mikluko referenced this issue from a commit

2026-10-31 16:50:40 +00:00

Install only rex by default; extra packages and apt config come from the deployment

mikluko referenced this issue from a commit

2026-10-31 17:42:42 +00:00

kuberex 0.2.0: Debian base, multi-arch, Rex and Claude Code installed at pod start (#11)

mikluko changed title from ~~Image: Debian base, multi-arch, startup install~~ to Image: Debian base, multi-arch, Rex and Claude Code pinned in the image

2026-10-31 18:55:35 +00:00

mikluko added a new dependency

2026-10-31 18:55:56 +00:00

#13 Upgrade workflow: watch Rex and Claude Code, bump the pins

mikluko referenced this issue from a commit

2026-11-02 19:53:26 +00:00

kuberex 0.3.0: Rex and Claude Code pinned in the image

mikluko referenced this issue

2026-11-02 19:53:30 +00:00

kuberex 0.3.0: Rex and Claude Code pinned in the image #14

mikluko commented

2026-11-02 19:53:56 +00:00

Author

Owner

In review as PR #14 (0.3.0). Facts found on the way:

0.2.0 did publish: the scheduled run on 2026-10-31 built and tagged it, so the bake ships as 0.3.0 rather than a rewrite of 0.2.0.
Registry login after the rename works (that run pushed the image).
The Rex repo is public, so the image needs no credential. Its snapshot index keeps only the 20 newest builds, about four days, so a pinned REX_VERSION stops building after that; #13 has to bump at least that often.
Built locally with container build: runs as uid 999, rex server run --tailscale reaches "Rex server ready" on a read-only root with only /run/rex and /var/lib/rex writable.
TS_CONTROL_URL was documented in 0.2.0 but never passed; now it maps to --tailscale-control-url.

In review as PR #14 (0.3.0). Facts found on the way: - 0.2.0 did publish: the scheduled run on 2026-10-31 built and tagged it, so the bake ships as 0.3.0 rather than a rewrite of 0.2.0. - Registry login after the rename works (that run pushed the image). - The Rex repo is public, so the image needs no credential. Its `snapshot` index keeps only the 20 newest builds, about four days, so a pinned `REX_VERSION` stops building after that; #13 has to bump at least that often. - Built locally with `container build`: runs as uid 999, `rex server run --tailscale` reaches "Rex server ready" on a read-only root with only `/run/rex` and `/var/lib/rex` writable. - `TS_CONTROL_URL` was documented in 0.2.0 but never passed; now it maps to `--tailscale-control-url`.

mikluko referenced this issue from a commit

2026-11-02 19:58:39 +00:00

kuberex 0.3.0: Rex and Claude Code pinned in the image (#14)

mikluko commented

2026-11-02 20:07:20 +00:00

Author

Owner

Resolved: sarak.sh/mikluko/kuberex:0.3.0 (tag v0.3.0, PR #14) is published for linux/amd64 and linux/arm64, with Rex 0.0.1793645657-gd018d2 and Claude Code 2.1.309-1 pinned as REX_VERSION and CLAUDE_CODE_VERSION ARGs in the Dockerfile. The container runs as rex (uid 999) with no capabilities; the server starts on a read-only root with /run/rex and /var/lib/rex writable. The release workflow now runs on push (run 325 released from the merge).

Resolved: `sarak.sh/mikluko/kuberex:0.3.0` (tag `v0.3.0`, PR #14) is published for `linux/amd64` and `linux/arm64`, with Rex `0.0.1793645657-gd018d2` and Claude Code `2.1.309-1` pinned as `REX_VERSION` and `CLAUDE_CODE_VERSION` ARGs in the `Dockerfile`. The container runs as `rex` (uid 999) with no capabilities; the server starts on a read-only root with `/run/rex` and `/var/lib/rex` writable. The release workflow now runs on push (run 325 released from the merge).

mikluko closed this issue

2026-11-02 20:07:20 +00:00

mikluko referenced this issue

2026-11-02 20:07:20 +00:00

Map: Rex server on saraksh #1