Documentation
Container images for AI coding agents and the development shells they run in, published to GHCR and Docker Hub for developers and CI pipelines. Each tool page lists the image variants and links recipes for Docker, Podman, Kubernetes, CI, and the other platforms it supports.
Repository guidance starts in AGENTS.md (opens in new tab) and is implemented as
on-demand repository skills (opens in new tab).
Catalog
AI
| Tool | Description |
|---|---|
| agentbloat | Codex, Claude Code, Cursor, Grok, OpenCode, Copilot, Gemini, and Pi agent CLIs in one image |
| Claude Code | Anthropic's Claude Code (opens in new tab) CLI on devbox |
| Codex CLI | OpenAI's Codex CLI (opens in new tab) on devbox |
| Omnigent | The Omnigent (opens in new tab) agent meta-harness on agentbloat |
| Open Code Review | Alibaba's Open Code Review CLI on devbox |
| Pi Coding Agent | The Pi (opens in new tab) terminal coding agent on devbox |
| T3 Code | The T3 Code (opens in new tab) web GUI for coding agents on agentbloat |
Base
| Tool | Description |
|---|---|
| core | Hardened Wolfi, Alpine, and Ubuntu application bases |
| devbox | Ubuntu and Alpine development and CI image in lite, full, and browser tiers |
CI
None yet.
Sandboxes
None yet.
Images and tags
Every image is published with the same tags to ghcr.io/hambn/<tool> and
docker.io/hambn/<tool>. Each variant has its own tag, such as devbox:ubuntu-lite or
codex:alpine-browser, and each tool README lists them.
| Image | latest points to |
Version tag |
|---|---|---|
| core | ubuntu |
none |
| devbox | ubuntu-browser |
none |
| agentbloat | ubuntu |
none |
| Other AI images | ubuntu |
<tool>-<version> on ubuntu, for example codex:codex-<version> |
Tags move to each new build. Pin a digest, such as
ghcr.io/hambn/codex@sha256:<digest>, when you need the same image every time.
The agentimg image and its old tag schemes are no longer published. Replace
agentimg:<variant> with devbox:<distro>-full, or devbox:<distro>-browser if you
used headless Chromium.
Tags from earlier layouts are frozen: they still pull, but never get another build. That
covers <tool>-v<version> release tags such as claude-code-v<version> and
ocr-v<version>, <variant>-<sha> commit tags, dated <variant>-<YYYYMMDD>-<sha7> tags,
and <version>-<variant> or bare <version> tags. Move to a current variant tag or a
digest.
How images are built
Each tool directory holds a Dockerfile that pins every version as an ARG default,
kept current by Renovate, and a docker-bake.hcl that lists its variants. Each image
builds FROM its published parent: core, then devbox, then agentbloat. A workflow per
tool, .github/workflows/<category>-<tool>.yml, calls the shared
tool-image.yml (opens in new tab) to test, scan, and publish.
Build locally:
docker build tools/ai/claude-code # default variant, ubuntu-browser
cd tools/ai/claude-code && docker buildx bake # every variant
docker buildx bake claude-code-alpine # one variant, from the tool directory
docker buildx bake --print # list the variants