foosinn/agentic-env
Watch
1
0
Fork
You've already forked agentic-env
 0
Code Issues 1 Pull requests 4 Projects Releases Packages Wiki Activity Actions
No description
62 commits 5 branches 0 tags 191 KiB
  • Dockerfile 83.6%
  • Shell 16.4%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
renovate adca68e038 Merge pull request 'chore(deps): update dependency stablyai/orca to v1.4.227' (#24) from renovate-stablyai-orca-1.x into main
2026-10-16 21:00:43 +00:00
.claude docs(openspec): propose podman based agent environment 2026-09-23 17:32:54 +02:00
agent Merge pull request 'chore(deps): update dependency stablyai/orca to v1.4.227' (#24) from renovate-stablyai-orca-1.x into main 2026-10-16 21:00:43 +00:00
gmp chore(deps): update dependency googlecloudplatform/prometheus-engine to v0.17.2 2026-10-03 20:30:29 +00:00
k8s-mcp feat: renovate tracks pinned upstream versions 2026-09-28 19:27:02 +02:00
openspec feat(agent): openspec cli in the image 2026-09-28 19:27:03 +02:00
.env.example refactor: home bind mount, k8s-mcp and one gmp container per project 2026-09-25 14:41:39 +02:00
.gitignore feat: compose file, env example and readme 2026-09-23 17:32:54 +02:00
compose.yaml feat(agent): lazygit, zoxide, hostname command and fixed hostnames 2026-09-25 15:27:44 +02:00
README.md docs: readme for home bind mount, per-server containers and orca 2026-09-25 14:57:23 +02:00
renovate.json feat: renovate tracks pinned upstream versions 2026-09-28 19:27:02 +02:00

README.md

agentic-env

Coding agents (Claude Code, pi, codex) in rootless podman, driven by herdr in the terminal or orca in the browser, without access to host credentials. Small credential containers expose a read-only Kubernetes MCP server and one Prometheus query proxy per GCP project.

Layout

compose.yaml      agent, orca, k8s-mcp, gmp-<short> x9
agent/            Arch image: tooling, claude, pi, codex, herdr, orca
k8s-mcp/          gcloud CLI image + kubernetes-mcp-server (read-only)
gmp/              alpine + gmp-frontend
.env.example      AGENT_HOME

$AGENT_HOME (default ~/agentic) is mounted as /home/stefan in the agent and orca containers. Repos go to $AGENT_HOME/git, which is ~/git inside.

First run

  1. cp .env.example .env, adjust AGENT_HOME, create the directory.
  2. podman compose build agent k8s-mcp gmp-tho-prod (one service per image, docker-compose would otherwise build the shared gmp image nine times in parallel).
  3. podman compose up -d
  4. podman compose exec agent herdr attaches to the herdr session.
  5. In a pane: ssh-keygen -t ed25519, add the key to GitHub, clone into ~/git, run claude to log in.
  6. podman compose logs orca prints the pairing URL, open it in the host browser.

Daily

podman compose up -d
podman compose exec agent herdr        # terminal
podman compose logs orca | grep -i pair # browser
podman compose down

Detaching from herdr or closing the browser leaves agents running.

Inside the agent container

  • Kubernetes: kubernetes MCP server, read-only, at http://k8s-mcp:8080/mcp.
  • Prometheus: http://gmp-<short>:9090, see ~/.claude/CLAUDE.md for the list.
  • Nix: nix-shell -p <pkg> and nu <pkg> use the host store through the host nix daemon.
  • No kubectl, gcloud, oc, terraform.

Credentials

k8s-mcp mounts ~/.config/gcloud and ~/.kube/config read-only and copies the gcloud config into the container at start. The gmp-* containers mount only application_default_credentials.json. When the host login expires, run gcloud auth login and gcloud auth application-default login on the host as usual and podman compose restart k8s-mcp plus the gmp services. Kube contexts that authenticate through secret-tool do not work in k8s-mcp.

The orca pairing URL grants access to the orca runtime. It is only reachable on 127.0.0.1:6768. Treat it like a password.

Rebuild

Versions are pinned as build args in the Containerfiles. Bump them, rebuild the affected image as in step 2, then podman compose up -d.