feat: Add containerized Claude agent#92
Conversation
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (5)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughThis PR adds a UBI10-based Containerfile and entrypoint for running the pinned ChangesClaude Code OpenShift Container Deployment
Sequence Diagram(s)sequenceDiagram
participant User
participant OC_Build as "OpenShift Build/CLI"
participant Registry
participant Cluster as "Deployment / Pod"
User->>OC_Build: start build (Containerfile)
OC_Build->>Registry: push image -> ImageStream
Registry->>Cluster: deploy image to Deployment
Cluster->>Cluster: Pod starts -> entrypoint.sh configures claude
Cluster->>ExternalAPI: claude uses Anthropic/Vertex credentials
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2)
agents/claude/claude_agent/entrypoint.sh (1)
102-103: ⚡ Quick winArray serialized as space-joined string causes word-splitting fragility
MCP_ARGS="${mcp_args[*]:-}"flattens the array into a single space-delimited string. It is then re-expanded unquoted (args+=(${MCP_ARGS})) to recover the elements. This breaks silently if any element (e.g., a file path) contains a space. The same pattern repeats withCLAUDE_EXTRA_ARGS(lines 163, 191).Since all functions run in the same shell process, exporting through env vars is unnecessary. Using a global array avoids the serialization entirely:
♻️ Proposed refactor: use global arrays instead of exported strings
+# Global arrays shared across functions (avoids word-splitting via export) +MCP_ARGS_ARRAY=() +CLAUDE_EXTRA_ARGS_ARRAY=() + setup_mcp() { - local mcp_args=() + MCP_ARGS_ARRAY=() ... - mcp_args+=("--mcp-config" "${MCP_CONFIG_FILE}") + MCP_ARGS_ARRAY+=("--mcp-config" "${MCP_CONFIG_FILE}") ... - export MCP_ARGS="${mcp_args[*]:-}" } build_claude_args() { local args=() - if [[ -n "${MCP_ARGS:-}" ]]; then - # shellcheck disable=SC2206 - args+=(${MCP_ARGS}) - fi + if [[ ${`#MCP_ARGS_ARRAY`[@]} -gt 0 ]]; then + args+=("${MCP_ARGS_ARRAY[@]}") + fi ... - export CLAUDE_EXTRA_ARGS="${args[*]:-}" + CLAUDE_EXTRA_ARGS_ARRAY=("${args[@]}") } # In main(): - exec claude ${CLAUDE_EXTRA_ARGS} "$@" + exec claude "${CLAUDE_EXTRA_ARGS_ARRAY[@]}" "$@"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agents/claude/claude_agent/entrypoint.sh` around lines 102 - 103, The code flattens arrays into space-joined env strings (MCP_ARGS, CLAUDE_EXTRA_ARGS) and later re-expands them unquoted causing word-splitting; instead stop exporting those env vars and keep/use bash arrays directly: remove export MCP_ARGS and export CLAUDE_EXTRA_ARGS/claude_extra_args, retain the original arrays (mcp_args and claude_extra_args) in the shared shell and change all re-expansions to preserve elements with args+=("${mcp_args[@]}") and args+=("${claude_extra_args[@]}") (and any other places using args+=(${MCP_ARGS}) or args+=(${CLAUDE_EXTRA_ARGS}) ), ensuring elements with spaces are preserved.agents/claude/claude_agent/Containerfile (1)
37-38: ⚡ Quick win
NODE_VERSIONARG is defined but never used
ARG NODE_VERSION=22has no effect on themicrodnf install nodejsinvocation, so--build-arg NODE_VERSION=18(or any value) is silently ignored. The Node version installed is whatever UBI 10's repos provide.Either remove the ARG, or wire it into the install step (e.g., via a NodeSource/NVM setup or a
nodejs:${NODE_VERSION}module stream call withmicrodnf module enable).-# Node.js version (major version, installs latest in that series) -ARG NODE_VERSION=22 -🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agents/claude/claude_agent/Containerfile` around lines 37 - 38, ARG NODE_VERSION is declared but unused; either remove it or wire it into the install. To fix, either delete the ARG NODE_VERSION=22 from the Containerfile, or change the install sequence to use the argument (for example by running the module stream command that binds to the arg: use "microdnf module enable nodejs:${NODE_VERSION}" then "microdnf install nodejs" or otherwise source Node from NodeSource/NVM using NODE_VERSION). Update the Containerfile lines around the existing "ARG NODE_VERSION=22" and the "microdnf install nodejs" invocation to reflect the chosen approach so --build-arg NODE_VERSION takes effect.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@agents/claude/claude_agent/deployment.yaml`:
- Around line 122-123: The SKIP_PERMISSIONS environment variable is currently
hardcoded to "true", enabling --dangerously-skip-permissions by default; change
the default value to "false" for the SKIP_PERMISSIONS env var in the manifest(s)
(look for the SKIP_PERMISSIONS env entry in the deployment YAML and the
equivalent in the vertex deployment) so operators must explicitly opt-in to
dangerous behavior, and add a README note documenting that setting
SKIP_PERMISSIONS to "true" enables --dangerously-skip-permissions (risk:
filesystem write bypass) and must be used only in sandboxed environments.
In `@agents/claude/claude_agent/entrypoint.sh`:
- Around line 96-99: MCP_CONFIG_JSON is treated as inline JSON but is passed
directly to mcp_args as "--mcp-config" which expects a filesystem path; instead,
create a temporary file (e.g., via mktemp), write MCP_CONFIG_JSON into it, push
that temp path onto mcp_args (same place you currently append
"${MCP_CONFIG_JSON}"), and ensure the temp file is removed on exit (use trap to
unlink). Also preserve existing validation logic by checking the temp file
exists before appending and reference the symbols MCP_CONFIG_JSON, mcp_args,
--mcp-config, and MCP_CONFIG_FILE so the change mirrors the established
file-based flow.
In `@agents/claude/claude_agent/README.md`:
- Around line 281-291: Update the Cleanup section in README.md to include the
Vertex AI (Option B) resource names and commands in addition to the existing
Option A names; specifically add oc delete commands for the Vertex-specific
deployment, buildconfig, imagestream, secret(s), configmap(s) and PVC (e.g.,
names prefixed or suffixed with "vertex" such as claude-vertex-deployment,
claude-vertex-buildconfig, claude-vertex-imagestream, claude-vertex-credentials,
claude-vertex-mcp-config, claude-vertex-skills, claude-vertex-workspace) and
clarify which commands apply to Option A (claude-code, claude-credentials,
claude-mcp-config, claude-skills, claude-workspace) vs Option B so users run the
correct oc delete lines for their chosen option.
---
Nitpick comments:
In `@agents/claude/claude_agent/Containerfile`:
- Around line 37-38: ARG NODE_VERSION is declared but unused; either remove it
or wire it into the install. To fix, either delete the ARG NODE_VERSION=22 from
the Containerfile, or change the install sequence to use the argument (for
example by running the module stream command that binds to the arg: use
"microdnf module enable nodejs:${NODE_VERSION}" then "microdnf install nodejs"
or otherwise source Node from NodeSource/NVM using NODE_VERSION). Update the
Containerfile lines around the existing "ARG NODE_VERSION=22" and the "microdnf
install nodejs" invocation to reflect the chosen approach so --build-arg
NODE_VERSION takes effect.
In `@agents/claude/claude_agent/entrypoint.sh`:
- Around line 102-103: The code flattens arrays into space-joined env strings
(MCP_ARGS, CLAUDE_EXTRA_ARGS) and later re-expands them unquoted causing
word-splitting; instead stop exporting those env vars and keep/use bash arrays
directly: remove export MCP_ARGS and export CLAUDE_EXTRA_ARGS/claude_extra_args,
retain the original arrays (mcp_args and claude_extra_args) in the shared shell
and change all re-expansions to preserve elements with args+=("${mcp_args[@]}")
and args+=("${claude_extra_args[@]}") (and any other places using
args+=(${MCP_ARGS}) or args+=(${CLAUDE_EXTRA_ARGS}) ), ensuring elements with
spaces are preserved.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 959e1b61-76bd-418b-8cb3-6676b921c807
📒 Files selected for processing (5)
agents/claude/claude_agent/Containerfileagents/claude/claude_agent/README.mdagents/claude/claude_agent/deployment-vertex.yamlagents/claude/claude_agent/deployment.yamlagents/claude/claude_agent/entrypoint.sh
aakankshaduggal
left a comment
aakankshaduggal
left a comment
There was a problem hiding this comment.
Review by Claude with Aakanksha's manual approval
Tested this PR on ROSA using the Vertex AI path for RHAIENG-4739. Image builds cleanly, runs under restricted-v2 SCC, and Claude Code responds to prompts. Nice work on the Containerfile and entrypoint structure.
4 inline comments below with issues found during testing. OGX integration testing is blocked on RHAIENG-4743.
Test Results (RHAIENG-4739 partial)
| Criteria | Result |
|---|---|
| Image deployed as pod on OpenShift | PASS |
| Pod runs under restricted-v2 SCC | PASS |
| Claude Code starts and accepts input | PASS |
| No security policy violations in logs | PASS |
| Process spawning (bash) works | PASS |
| Non-root user (OpenShift random UID) | PASS |
| Workspace writable via PVC | PASS |
| OGX backend integration | BLOCKED (waiting on RHAIENG-4743) |
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
@aakankshaduggal Thanks for the review! I've pushed some fixes that should address everything. |
|
Could you also update the main directory README file and add reference to the claude agent? |
|
Licensing note: README should warn against distributing built images The Containerfile installs Claude Code at build time, so the resulting container image contains Anthropic's proprietary binary (the license is "All rights reserved," subject to their commercial terms). Users building the image themselves is fine, but the README should explicitly note that the built images should not be redistributed, since they contain proprietary closed-source software. npm install is no longer the recommended method Anthropic now recommends their native installer over npm. The CLI itself warns users to switch when launched from an npm install. They also publish a The Containerfile should replace: npm install -g @anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}with the native installer: curl -fsSL https://claude.ai/install.sh | bashThis also removes the need for npm as a build dependency. This comment was drafted by Claude Code under the supervision of Bill Murdock. |
…ng note. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
@jwm4 We now use the native installer. Also, I've added a licensing notice. Thanks for the review! |
jwm4
left a comment
jwm4
left a comment
There was a problem hiding this comment.
I haven't tested this myself, but all my concerns are addressed so it looks good to me.
4 participants
Description
Add containerized Claude agent. This is the first in a series of building blocks to enable Claude Code agent deployment and operation on RHOAI with vLLM/OGX interoperability. With this PR, a user can build, deploy, and run Claude on RHOAI. A user can also run locally with podman. Some additional notes:
cc @aakankshaduggal
Jira Ticket
RHAIENG-4737
Testing
After deploying Claude on RHOAI, testing can be done using oc exec (see README for full commands and instructions). Longer term, we need to investigate some type of UI on RHOAI.