clawk-dev-plus: clawk-dev + docker/compose/glab/firecrawl-cli

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Trixie

.github/workflows/publish.yml

@@ -0,0 +1,37 @@
+name: publish
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - Dockerfile
+      - .github/workflows/publish.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build (linux/arm64, native)
+        run: |
+          docker build \
+            -t ghcr.io/gitthass/clawk-dev-plus:v0 \
+            -t ghcr.io/gitthass/clawk-dev-plus:latest \
+            .
+
+      - name: Push
+        run: |
+          docker push ghcr.io/gitthass/clawk-dev-plus:v0
+          docker push ghcr.io/gitthass/clawk-dev-plus:latest

Dockerfile

@@ -0,0 +1,28 @@
+# clawk-dev-plus — ghcr.io/clawkwork/clawk-dev + the system tools our
+# sandboxes need present after EVERY boot (clawk re-clones the rootfs
+# from this image at each `up`; only mounts persist).
+#
+# Contract inherited from the base (see its Dockerfile): no user is
+# created here (clawk-init creates `agent` at boot with the host
+# uid/gid), no init/sshd, CMD/ENTRYPOINT ignored. Filesystem + Env only.
+FROM ghcr.io/clawkwork/clawk-dev:v0
+
+# Docker engine + CLI. dockerd is started per-boot by clawk.mod's on-up
+# hook (guest init is clawk-init, not systemd — no service units run).
+RUN apt-get update && apt-get install -y --no-install-recommends docker.io \
+    && rm -rf /var/lib/apt/lists/*
+
+# Compose v2 plugin (static binary; bump ARG to update)
+ARG COMPOSE_VERSION=v2.39.1
+RUN mkdir -p /usr/local/lib/docker/cli-plugins \
+    && curl -fsSL https://github.com/docker/compose/releases/download/${COMPOSE_VERSION}/docker-compose-linux-aarch64 \
+       -o /usr/local/lib/docker/cli-plugins/docker-compose \
+    && chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
+
+# GitLab CLI (arm64 — the guest is an Apple-silicon arm64 VM)
+ARG GLAB_VERSION=1.109.0
+RUN curl -fsSL https://gitlab.com/gitlab-org/cli/-/releases/v${GLAB_VERSION}/downloads/glab_${GLAB_VERSION}_linux_arm64.deb \
+       -o /tmp/glab.deb && dpkg -i /tmp/glab.deb && rm /tmp/glab.deb
+
+# Firecrawl CLI (the firecrawl plugin skill drives it; reads FIRECRAWL_API_KEY)
+RUN npm install -g firecrawl-cli@1.8.0

README.md

@@ -0,0 +1,31 @@
+# clawk-dev-plus
+
+Custom rootfs image for [clawk](https://github.com/clawkwork/clawk)
+sandboxes: the official `clawk-dev` base plus the system tools we want
+present after **every** boot — clawk re-clones the rootfs from the image
+at each `up`, so anything not baked here (or on a mount) vanishes at
+reboot.
+
+Adds on top of `ghcr.io/clawkwork/clawk-dev:v0`:
+
+- `docker.io` (engine + CLI; dockerd is started per-boot by the
+  `clawk.mod` `on up` hook)
+- Docker Compose v2 plugin
+- `glab` (GitLab CLI, arm64)
+- `firecrawl-cli`
+
+## Use
+
+    vm (
+        image ghcr.io/gitthass/clawk-dev-plus:v0
+    )
+
+## Update flow
+
+Edit the `Dockerfile` (bump an ARG, add a tool), push to `main` — the
+workflow builds on GitHub's native arm64 runner and republishes `:v0` +
+`:latest`. clawk re-resolves the tag at every sandbox boot, so the change
+reaches all sandboxes on their next `up`. Pin a digest in `clawk.mod` if a
+sandbox must stay frozen.
+
+Companion docs: `SANDBOX-SETUP.md` in gitthass/clawkvscodium.