tool-containers
Search docs…Ctrl K
Menu
GitHub (opens in new tab)

Run agentbloat with Kubernetes

deployment.yaml keeps one agentbloat pod running with sleep infinity, so you can open shells in it with kubectl exec.

Images
  • GHCRghcr.io/hambn/agentbloat
  • Docker Hubdocker.io/hambn/agentbloat
Use case
Long-lived cluster workspace from plain manifests
Source
tools/ai/agentbloat/docs/kubernetes (opens in new tab)
On this page

Prerequisites

  • A Kubernetes cluster and kubectl configured for it.

Open a shell

Shell
kubectl apply -f deployment.yaml
kubectl exec -it deploy/agentbloat -- zsh -l

Run cd /workspace, then any agent, and sign in from its prompt. To supply API keys instead, add env entries that read them from a Secret with secretKeyRef.

Workspace

/workspace is an emptyDir: it survives container restarts but not a new pod. Agent logins are in the container's home directory and reset whenever the container restarts. Mount a PersistentVolumeClaim at /workspace, and at an agent's config directory, such as /home/sysadmin/.codex, to keep its login. A volume over all of /home/sysadmin would hide the shell configuration in the image. The pod runs as UID 1000 with all capabilities dropped.

Files

  • deployment.yaml defines the single-replica Deployment with resource limits.

Cleanup

Shell
kubectl delete -f deployment.yaml

File contents

deployment.yaml44 lines
# kubectl apply -f deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: agentbloat
spec:
  replicas: 1
  selector:
    matchLabels:
      app: agentbloat
  template:
    metadata:
      labels:
        app: agentbloat
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: agentbloat
          image: ghcr.io/hambn/agentbloat:ubuntu-browser
          imagePullPolicy: Always
          command: ["sleep", "infinity"]
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          resources:
            requests:
              cpu: 250m
              memory: 512Mi
            limits:
              cpu: "2"
              memory: 4Gi
          volumeMounts:
            - name: workspace
              mountPath: /workspace
      volumes:
        - name: workspace
          emptyDir: {}

Topics