tool-containers
Search docs…Ctrl K
Menu
GitHub (opens in new tab)

Run Claude Code with Kubernetes

job.yaml runs Claude Code once as a Job with claude -p "review the workspace", prints the answer to the pod log, and exits.

Images
  • GHCRghcr.io/hambn/claude-code
  • Docker Hubdocker.io/hambn/claude-code
Use case
One-shot review in a cluster from plain manifests
Upstream
github.com/anthropics/claude-code (opens in new tab)
Source
tools/ai/claude-code/docs/kubernetes (opens in new tab)
On this page

Prerequisites

  • A Kubernetes cluster and kubectl configured for it.
  • An Anthropic API key.

Run the Job

Shell
kubectl create secret generic claude-code --from-literal=ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY"
kubectl apply -f job.yaml
kubectl logs -f job/claude-code

Edit args in job.yaml to change the prompt or flags. The Job uses ghcr.io/hambn/claude-code:ubuntu-browser; replace the tag with @sha256:<digest> to pin one build.

Variables

Name Where Purpose
ANTHROPIC_API_KEY Secret claude-code Read through secretKeyRef, so the key is not in the manifest.

Workspace

As shipped, /workspace is an empty emptyDir, so the default prompt has nothing to review. Replace the volume with a PersistentVolumeClaim that holds your code, or add an init container that clones your repository into it.

Files

  • job.yaml is a non-root Job with all capabilities dropped, backoffLimit: 0, and CPU and memory limits.

Cleanup

Shell
kubectl delete -f job.yaml
kubectl delete secret claude-code

A finished Job stays until you delete it. Delete it before applying the manifest again to start a new run.

File contents

job.yaml46 lines
# One-shot Claude Code run. Create the secret first:
#   kubectl create secret generic claude-code --from-literal=ANTHROPIC_API_KEY=sk-...
apiVersion: batch/v1
kind: Job
metadata:
  name: claude-code
spec:
  backoffLimit: 0
  template:
    spec:
      restartPolicy: Never
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: claude
          image: ghcr.io/hambn/claude-code:ubuntu-browser
          imagePullPolicy: Always
          args: ["-p", "review the workspace"]
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              cpu: "1"
              memory: 1Gi
          env:
            - name: ANTHROPIC_API_KEY
              valueFrom:
                secretKeyRef:
                  name: claude-code
                  key: ANTHROPIC_API_KEY
          volumeMounts:
            - name: workspace
              mountPath: /workspace
      volumes:
        - name: workspace
          emptyDir: {}

Topics