From 7b6e3d0c94cea3ea91d1f9ab7fbbbd0fd8769311 Mon Sep 17 00:00:00 2001 From: Martin Othamar Date: Mon, 26 Oct 2026 00:33:50 +0000 Subject: [PATCH 1/2] chore(agents): move the dev Agent onto agentctl 0.1.0-preview.13 Rebase the image on the agentctl desktop base that keeps /tmp on the Sandbox disk (digdir/digdir-agents#329), drop the manifests' /tmp tmpfs mounts, and copy agentctl and agentd from the 0.1.0-preview.13 release image instead of main. --- agents/dev/Dockerfile | 12 ++++++------ agents/dev/README.md | 6 ++---- agents/dev/agent.nested.yaml | 4 ---- agents/dev/agent.yaml | 4 ---- 4 files changed, 8 insertions(+), 18 deletions(-) diff --git a/agents/dev/Dockerfile b/agents/dev/Dockerfile index cff32e0b11b1b..07dd94cb5e3e6 100644 --- a/agents/dev/Dockerfile +++ b/agents/dev/Dockerfile @@ -3,7 +3,7 @@ # desktop with VNC access, the `desktop` helper and the computer-use skill. This image adds what # developing T3 Code needs. -FROM ghcr.io/digdir/agentctl-base:ubuntu-26.04-desktop@sha256:ec5ce4ba36f5f8a71078fb02703d4604d28411fc3a035f2ee2c24d1febb3839e +FROM ghcr.io/digdir/agentctl-base:ubuntu-26.04-desktop@sha256:762a7fd2fc929cddcd1ee8ab90a203c963518719e904fca7a6802111796e2cc7 # The base ends as the unprivileged Agent user; installing packages needs root again. USER root @@ -73,11 +73,11 @@ RUN case "${TARGETARCH}" in \ && chmod -R a+rX "${PLAYWRIGHT_BROWSERS_PATH}" \ && rm -rf "${HOME}" /root/.npm -# agentctl and agentd from digdir-agents main, which the Agent needs until a release ships what it -# relies on: nested Sandboxes, agentd's /dev/kvm and Podman setup, the SSH OOM policy, and the -# Agent sandbox section, agentctl skill and flagless logins it gives nested Agents. The host runs -# the same build, and nested Agents run on this one. agentd downloads its runtime on first use. -COPY --from=ghcr.io/digdir/agentctl:main@sha256:20419bf3c63d835318d6815949741ea272b4d8eaff49e3ff6c759080858a0f38 /agentctl /agentd /usr/local/bin/ +# agentctl and agentd from 0.1.0-preview.13, the first release with what the Agent relies on: +# nested Sandboxes, agentd's /dev/kvm and Podman setup, the SSH OOM policy, and the Agent sandbox +# section, agentctl skill and flagless logins it gives nested Agents. The host needs that release +# or later, and nested Agents run on this one. agentd downloads its runtime on first use. +COPY --from=ghcr.io/digdir/agentctl:v0.1.0-preview.13@sha256:2374c65d96d61d91df1a6416e444a067d825f9650151d933b8563cad77e02d2a /agentctl /agentd /usr/local/bin/ RUN agentctl --version COPY rootfs/ / diff --git a/agents/dev/README.md b/agents/dev/README.md index f4ef4151d4dc4..b1012cf902d63 100644 --- a/agents/dev/README.md +++ b/agents/dev/README.md @@ -12,10 +12,8 @@ The `demo-video` skill films that desktop into captioned demo videos with fframe | default | Fresh clone of `martinothamar/t3code`, `upstream` added | | `nested` | Fresh clone, reduced to fit inside the default Agent | -The manifest needs an agentctl built from digdir-agents `main`, at least the build the -Dockerfile copies from the `ghcr.io/digdir/agentctl` image, until a release includes -`nestedSandboxes`: `make user-install` in a digdir-agents checkout installs one. -`0.1.0-preview.12` and earlier refuse it. +The manifest needs agentctl `0.1.0-preview.13` or later; earlier releases refuse its +`nestedSandboxes`. ```sh cp agents/dev/.env.sample agents/dev/.env # fill in GITHUB_TOKEN and Git identity diff --git a/agents/dev/agent.nested.yaml b/agents/dev/agent.nested.yaml index b072450282915..7730f4799c2cd 100644 --- a/agents/dev/agent.nested.yaml +++ b/agents/dev/agent.nested.yaml @@ -21,7 +21,3 @@ spec: mode: direct # Nested Agents of its own would need virtualization two levels down. nestedSandboxes: null - mounts: - - type: tmpfs - target: /tmp - capacity: "2Gi" diff --git a/agents/dev/agent.yaml b/agents/dev/agent.yaml index 7882bc1579c2e..155cbdba79ebe 100644 --- a/agents/dev/agent.yaml +++ b/agents/dev/agent.yaml @@ -19,10 +19,6 @@ spec: # leaves the Agent without them, as its NestedSandboxes condition says. nestedSandboxes: preferred initSystem: image - mounts: - - type: tmpfs - target: /tmp - capacity: "4Gi" home: source: home instructions: From f831e1c9f868c582f7ba8c82885309cd4d471506 Mon Sep 17 00:00:00 2001 From: Martin Othamar Date: Mon, 26 Oct 2026 01:07:49 +0000 Subject: [PATCH 2/2] chore(agents): pin the published agentctl 0.1.0-preview.13 image --- agents/dev/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/agents/dev/Dockerfile b/agents/dev/Dockerfile index 07dd94cb5e3e6..03a0472f00bef 100644 --- a/agents/dev/Dockerfile +++ b/agents/dev/Dockerfile @@ -77,7 +77,7 @@ RUN case "${TARGETARCH}" in \ # nested Sandboxes, agentd's /dev/kvm and Podman setup, the SSH OOM policy, and the Agent sandbox # section, agentctl skill and flagless logins it gives nested Agents. The host needs that release # or later, and nested Agents run on this one. agentd downloads its runtime on first use. -COPY --from=ghcr.io/digdir/agentctl:v0.1.0-preview.13@sha256:2374c65d96d61d91df1a6416e444a067d825f9650151d933b8563cad77e02d2a /agentctl /agentd /usr/local/bin/ +COPY --from=ghcr.io/digdir/agentctl:v0.1.0-preview.13@sha256:5451dd5e912865d7ed4544f0bf2e6d0912cd274b878515224cd05896a286b28f /agentctl /agentd /usr/local/bin/ RUN agentctl --version COPY rootfs/ /