Add claude-runner image (Claude Code self-hosted environments runner) - #38
Merged
Conversation
Mirror Anthropic's minimal runner Dockerfile from their deploy docs (pinned claude binary, minimal Debian base, system git identity) with a README that defers explicitly to their instructions for environment setup, deployment recipes, hardening, and version pinning. No environment secret or credentials are baked in; those mount at runtime per upstream guidance.
Image CI passedPre-commit validation passed. View the workflow run. |
xnoto
added a commit
that referenced
this pull request
Sep 5, 2026
xnoto
added a commit
that referenced
this pull request
Sep 5, 2026
14 tasks
xnoto
added a commit
that referenced
this pull request
Sep 5, 2026
… runner image" Reverts #38. Self-hosted environments — the only control plane the runner registers with — are public beta on Team and Enterprise organization plans only; claude.makeitwork.cloud is an individual account, so the image has no deployment path. No consumers ever referenced it (no chart, GitOps selection, or cluster wiring). Repo state restored to pre-#38. GHCR package ghcr.io/makeitworkcloud/claude-runner (latest + acf3805 sha) remains published; deletion is a manual owner action in GitHub package settings. Reintroduce from #38's record if a Team plan is adopted later.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
claude-runner/image: Anthropic's Claude Code self-hosted environments runner (claude self-hosted-runner), the Claude-native execution fleet for claude.makeitwork.cloud cloud sessions. Anthropic publishes no pre-built runner image — their docs instruct every organization to build its own around theclaudebinary — so this Containerfile mirrors their minimal runner Dockerfile from the deploy docs, and the image README explicitly defers to their instructions (quickstart, deploy recipes, hardening, configuration, testing, reference, identity, binary integrity) as the authoritative operational source.Context: Anthropic enforces OAuth client checks that block Claude subscription use in third-party harnesses (opencode), so headless Claude capacity moves to their sanctioned self-hosted runner surface, billed as org Claude Code usage rather than per-token API.
Type of change
Validation
buildahrun 33973658029 (jobs checks / detect / build) passed pre-commit (Gitleaks, detect-private-key, hadolint at error threshold, actionlint), changed-image detection (claude-runner), and the non-publishing image build;Push to registrywas correctly skipped in PR mode.Impact and rollout
Producer changed:
makeitworkcloud/images/claude-runneris the canonical runner-image source. An approved merge automatically publishesghcr.io/makeitworkcloud/claude-runner:{latest,<sha>}. No consumers yet: chart/Deployment wiring, the environment Secret, and egress policy for the fleet are a separate, not-yet-authored change (charts + kustomize-cluster ownership to follow). Anthropic-side prerequisites remain manual and organization-owned: Team/Enterprise plan with an Owner enabling self-hosted environments, environment key creation, and runner registration. Note: the root README image table was already missing anopencode-sms-bridge/row before this change; not addressed here to keep scope narrow.Safety and secrets
AI-assisted change: an OpenCode agent materially produced this change; the upstream Dockerfile it mirrors is quoted from Anthropic's public documentation, and reviewers should verify the two recorded deviations and CI results before merge.
No pull-request template exists in this repository; the organization default from
makeitworkcloud/.githubwas applied manually.