tool-containers
Search docs…Ctrl K
Menu
GitHub (opens in new tab)

Run agentbloat with Docker

run.sh opens a Zsh login shell in agentbloat with the current directory mounted at /workspace. airgapped.run.sh does the same from a saved image on a host that cannot pull.

Images
  • GHCRghcr.io/hambn/agentbloat
  • Docker Hubdocker.io/hambn/agentbloat
Use case
Interactive multi-agent workspace
Source
tools/ai/agentbloat/docs/docker (opens in new tab)
On this page

Prerequisites

  • Docker Engine 23 or later.

Open a shell

Shell
./run.sh
cd /workspace

The shell starts in /home/sysadmin. Run any agent, for example claude or codex, and sign in from its prompt. Logins are saved in the home directory and removed with the container when you exit. To pass an API key instead, add -e OPENAI_API_KEY or another variable to the docker run line in run.sh.

To let agents run Docker commands, set AGENTBLOAT_DOCKER_SOCKET to the host socket. run.sh mounts it at /var/run/docker.sock and adds its group:

Shell
AGENTBLOAT_DOCKER_SOCKET=/var/run/docker.sock ./run.sh

Access to the socket gives the container root on the host.

Run without registry access

On a machine that can pull, save the image:

Shell
docker save ghcr.io/hambn/agentbloat:ubuntu-browser -o agentbloat.tar

Copy the tar to the offline host and pass its path first; any remaining arguments replace the shell command:

Shell
./airgapped.run.sh agentbloat.tar

The script loads the tar and runs AGENTBLOAT_IMAGE with --pull=never. The agents still need network access to their model providers.

Variables

Variable Required Purpose
AGENTBLOAT_IMAGE no Image both scripts run. Defaults to ghcr.io/hambn/agentbloat:ubuntu-browser; set ghcr.io/hambn/agentbloat@sha256:<digest> to pin one build.
AGENTBLOAT_DOCKER_SOCKET no Host Docker socket for run.sh to mount at /var/run/docker.sock.

Workspace

The current directory is mounted at /workspace. The agents run as sysadmin (UID 1000), so new files belong to UID 1000 on the host.

Files

  • run.sh pulls the image if needed and opens the shell.
  • airgapped.run.sh loads a saved tar and runs it without pulling.

File contents

airgapped.run.sh17 lines
#!/usr/bin/env bash
# Offline host: load the image from a tar saved on an online host, never pull.
#   docker save ghcr.io/hambn/agentbloat:ubuntu-browser -o agentbloat.tar
set -euo pipefail

image=${AGENTBLOAT_IMAGE:-ghcr.io/hambn/agentbloat:ubuntu-browser}
tar=${1:-agentbloat.tar}
shift $(($# > 0 ? 1 : 0))
[[ -f "$tar" ]] || {
    echo "missing $tar; docker save it on an online host first" >&2
    exit 1
}

docker load -i "$tar"
docker run -it --rm --pull=never \
    -v "$PWD:/workspace" \
    "$image" "$@"
run.sh21 lines
#!/usr/bin/env bash
# Run an interactive agentbloat shell against the current directory.
set -euo pipefail

image=${AGENTBLOAT_IMAGE:-ghcr.io/hambn/agentbloat:ubuntu-browser}
docker_options=()
if [[ -n "${AGENTBLOAT_DOCKER_SOCKET:-}" ]]; then
    [[ -S "$AGENTBLOAT_DOCKER_SOCKET" ]] || {
        echo "not a Docker socket: $AGENTBLOAT_DOCKER_SOCKET" >&2
        exit 1
    }
    docker_options+=(
        --volume "$AGENTBLOAT_DOCKER_SOCKET:/var/run/docker.sock"
        --group-add "$(stat -c %g "$AGENTBLOAT_DOCKER_SOCKET")"
    )
fi

docker run -it --rm \
    "${docker_options[@]}" \
    -v "$PWD:/workspace" \
    "$image" "$@"

Topics