kuberex 0.2.0: Debian base, multi-arch, Rex and Claude Code installed at pod start #11

Merged

mikluko merged 5 commits from image-agent-toolchain into main

2026-10-31 17:42:40 +00:00

mikluko commented

2026-10-31 16:32:43 +00:00

Owner

machine-debian is arm64-only and its systemd and unbound never run under
dumb-init, so the image builds on debian:trixie-YYYYMMDD and pins to Debian
snapshots instead.

kuberex install in an init container installs rex, then the apt specs in
KUBEREX_PACKAGES, through userxattr overlays on /usr, /etc and /var kept on an
emptyDir; kuberex run mounts the same overlays and drops to rex. Shape and
constraints come from the overlay prototype (#10): hostUsers: false,
CAP_SYS_ADMIN, AppArmor unconfined.

Extra apt sources and keyrings mounted under /etc/kuberex/apt are copied into
the overlaid /etc/apt. Credentials stay where they are mounted: apt reads the
rex file (REX_APT_AUTH) through Dir::Etc::netrc and
/etc/kuberex/apt/auth.conf.d through Dir::Etc::netrcparts. The build no longer
takes the REX_APT secret.

No agent tooling or wiring: that is out of this effort.

Refs #7

machine-debian is arm64-only and its systemd and unbound never run under dumb-init, so the image builds on debian:trixie-YYYYMMDD and pins to Debian snapshots instead. `kuberex install` in an init container installs rex, then the apt specs in KUBEREX_PACKAGES, through userxattr overlays on /usr, /etc and /var kept on an emptyDir; `kuberex run` mounts the same overlays and drops to rex. Shape and constraints come from the overlay prototype (#10): hostUsers: false, CAP_SYS_ADMIN, AppArmor unconfined. Extra apt sources and keyrings mounted under /etc/kuberex/apt are copied into the overlaid /etc/apt. Credentials stay where they are mounted: apt reads the rex file (REX_APT_AUTH) through Dir::Etc::netrc and /etc/kuberex/apt/auth.conf.d through Dir::Etc::netrcparts. The build no longer takes the REX_APT secret. No agent tooling or wiring: that is out of this effort. Refs #7

mikluko added 1 commit

2026-10-31 16:32:43 +00:00

kuberex 0.2.0: Debian base, multi-arch, Rex and Claude Code installed at pod start

test / go (pull_request) Failing after 34s

Details

e7c2717f34

machine-debian is arm64-only and its systemd and unbound never run under
dumb-init, so the image builds on debian:trixie-YYYYMMDD and pins to Debian
snapshots instead.

Rex and Claude Code are installed by `kuberex install` in an init container
through userxattr overlays on /usr, /etc and /var kept on an emptyDir; `kuberex
run` mounts the same overlays and drops to rex. Shape and constraints come from
the overlay prototype (#10): hostUsers: false, CAP_SYS_ADMIN, AppArmor
unconfined. The rex apt credential is a runtime file, so the build no longer
takes the REX_APT secret.

forgejo-mcp is not wired: nothing in saraksh/kube deploys it yet. AWS is not
wired: no account or role names are settled for agents.

Refs #7

mikluko added 1 commit

2026-10-31 16:36:08 +00:00

Drop the agent toolchain and wiring from the image

test / go (pull_request) Failing after 35s

Details

f047560140

Agent tooling is out of this effort: no baox, bao, gh, kubectl or awscli, and
no baked baox, git credential, kubeconfig or Claude Code settings.

Refs #7

mikluko added 1 commit

2026-10-31 16:50:40 +00:00

Install only rex by default; extra packages and apt config come from the deployment

test / go (pull_request) Failing after 32s

Details

8f59a2c8bc

KUBEREX_PACKAGES names apt package specs installed after rex. Sources and
keyrings mounted under /etc/kuberex/apt are copied into the overlaid /etc/apt;
credentials stay where they are mounted: apt reads the rex file through
Dir::Etc::netrc and /etc/kuberex/apt/auth.conf.d through Dir::Etc::netrcparts,
so both are honoured without combining them.

The baked claude-code source and CLAUDE_CODE_VERSION are gone.

Refs #7

mikluko added 1 commit

2026-10-31 17:41:24 +00:00

README: where the Rex repository credential comes from and how the pod gets it

test / go (pull_request) Successful in 13s

Details

1b4e8b6e56

mikluko added 1 commit

2026-10-31 17:41:43 +00:00

README: define kuberex as the wiring for Rex on Kubernetes

test / go (pull_request) Successful in 9s

Details

a1fe615832