add ccwrapper

Author: actualben

.github/workflows/docker.yml

@@ -42,6 +42,7 @@ jobs:
           - audiosprite
           - bind
           - bpython
+          - ccwrapper
           - chardet
           - checkmake
           - chromium

README.md

@@ -22,6 +22,7 @@ Name | Description | Dockerfile Link | Image Link
 [audiosprite](audiosprite) | [`alpine:edge`](https://hub.docker.com/_/alpine/)-based dockerization of [audiosprite](https://github.com/tonistiigi/audiosprite), the "ffmpeg wrapper that will take in multiple audio files and combines them into a single file" | [Dockerfile](audiosprite/Dockerfile) | [backplane/audiosprite](https://hub.docker.com/r/backplane/audiosprite)
 [bind](bind) | [`alpine:edge`](https://hub.docker.com/_/alpine/)-based dockerization of [bind](https://www.isc.org/bind/), the DNS server software | [Dockerfile](bind/Dockerfile) | [backplane/bind](https://hub.docker.com/r/backplane/bind)
 [bpython](bpython) | [`python:3-alpine`](https://hub.docker.com/_/python/)-based dockerization of [the bpython interpreter](https://bpython-interpreter.org/) | [Dockerfile](bpython/Dockerfile) | [backplane/bpython](https://hub.docker.com/r/backplane/bpython)
+[ccwrapper](ccwrapper) | [`alpine:3.23`](https://hub.docker.com/_/alpine/)-based dockerization of [Claude Code](https://code.claude.com/docs/en/overview), the agentic coding tool | [Dockerfile](ccwrapper/Dockerfile) | [backplane/ccwrapper](https://hub.docker.com/r/backplane/ccwrapper)
 [chardet](chardet) | [`python:3-alpine`](https://hub.docker.com/_/python/)-based dockerization of [chardet](https://github.com/chardet/chardet), The Universal Character Encoding Detector | [Dockerfile](chardet/Dockerfile) | [backplane/chardet](https://hub.docker.com/r/backplane/chardet)
 [checkmake](checkmake) | [`scratch`](https://hub.docker.com/_/scratch/)-based single-binary dockerization of [checkmake](https://github.com/mrtazz/checkmake/), the `Makefile` linter | [Dockerfile](checkmake/Dockerfile) | [backplane/checkmake](https://hub.docker.com/r/backplane/checkmake)
 [chromium](chromium) | [`debian:unstable-slim`](https://hub.docker.com/_/debian/)-based dockerization of the Google Chromium web browser | [Dockerfile](chromium/Dockerfile) | [backplane/chromium](https://hub.docker.com/r/backplane/chromium)

ccwrapper/.dockerignore

@@ -0,0 +1,3 @@
+CLAUDE.md
+README.md
+docs.md

ccwrapper/Dockerfile

@@ -0,0 +1,88 @@
+FROM alpine:3.23
+LABEL maintainer="Backplane BV <backplane@users.noreply.github.com>"
+
+RUN apk add --no-cache \
+    bash \
+    ca-certificates \
+    cargo \
+    curl \
+    deno \
+    docker-cli \
+    docker-cli-compose \
+    gcc \
+    git \
+    go \
+    gpg \
+    jq \
+    libgcc \
+    libstdc++ \
+    libxml2-utils \
+    musl \
+    openssh-client \
+    patch \
+    perl \
+    pnpm \
+    rage \
+    ripgrep \
+    rsync \
+    shellcheck \
+    uv \
+    yq-go \
+    zstd \
+  ;
+
+# get the first stage installer script, make some light edits
+ARG INSTALLER=/var/claude-install.sh
+RUN set -eux; \
+  curl -fsSL -o "${INSTALLER}" https://claude.ai/install.sh; \
+  chmod a=r "${INSTALLER}"; \
+  perl -i \
+    -e 's/^set -e$/set -ex/;' \
+    -e 's/^(\s*rm -f) /\1 -v /;' \
+    "${INSTALLER}";
+
+# create a non-root user
+ARG NONROOT_GID=65532
+ARG NONROOT_UID=65532
+ARG NONROOT_HOME="/home/nonroot"
+ARG NONROOT_SKEL="/.nonroot_skeleton"
+
+RUN set -eux; \
+  addgroup -g "${NONROOT_GID}"    nonroot; \
+  adduser  -u "${NONROOT_UID}" -G nonroot \
+    -s "/bin/bash" \
+    -h "${NONROOT_HOME}" \
+    -D \
+    nonroot; \
+  for d in \
+    "/work" \
+    "${NONROOT_HOME}/.claude" \
+    "${NONROOT_SKEL}" \
+  ; do \
+    mkdir -m "0770" -p "$d"; \
+    chown "nonroot:nonroot" "$d"; \
+  done;
+USER nonroot
+WORKDIR /work
+
+# add ~nonroot/.local/bin to the search path
+ENV PATH="${NONROOT_HOME}/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+
+# install claude (as non-root)
+ARG INSTALL_LOG="${NONROOT_HOME}/.claude-install-log.txt"
+RUN set -eux; \
+  bash "$INSTALLER" 2>&1 | tee "$INSTALL_LOG"; \
+  gzip -9 "$INSTALL_LOG";
+
+  
+# see https://code.claude.com/docs/en/memory#claude-md-files
+# this one advises about the tools that are locally installed
+COPY --chown=nonroot:nonroot skel-CLAUDE.md "${NONROOT_HOME}/.claude/CLAUDE.md"
+
+# copy (via hard link) the nonroot homedir to a skeleton dir, so that if a volume
+# is placed over the nonroot homedir, that volume gets a copy of the contents of
+# the skeleton
+RUN cp -al "${NONROOT_HOME}/." "${NONROOT_SKEL}/";
+
+COPY --chown=root:root entrypoint.sh /
+ENTRYPOINT [ "/entrypoint.sh" ]

ccwrapper/README.md

@@ -0,0 +1,62 @@
+# ccwrapper
+
+[`alpine:3.23`](https://hub.docker.com/_/alpine/)-based dockerization of [Claude Code](https://code.claude.com/docs/en/overview), the agentic coding tool
+
+As the site says:
+
+> Claude Code is an agentic coding tool that reads your codebase, edits files, runs commands, and integrates with your development tools. Available in your terminal, IDE, desktop app, and browser. ... [It] helps you build features, fix bugs, and automate development tasks.
+
+## Repositories
+
+| Repo         | URL                                                      |
+| ------------ | -------------------------------------------------------- |
+| Docker File  | <https://github.com/backplane/conex/tree/main/ccwrapper> |
+| Docker Image | <https://hub.docker.com/r/backplane/ccwrapper>           |
+
+## Included Utils
+
+In addition to claude-code the following utils are included
+
+| Package             | Commands              | Description                                                                      |
+| ------------------- | --------------------- | -------------------------------------------------------------------------------- |
+| cargo 1.94          | `cargo`               | The Rust package manager                                                         |
+| curl 8.19           | `curl`; `wcurl`       | URL retrival utility and library                                                 |
+| deno 2.7            | `deno`                | A modern runtime for JavaScript and TypeScript                                   |
+| docker-cli 29.3     | `docker`              | Docker CLI (the plugin for `docker compose` is also included)                    |
+| gcc 15.2            | `gcc`                 | The GNU Compiler Collection                                                      |
+| git 2.53            | `git`                 | Distributed version control system                                               |
+| go 1.26             | `go`; `gofmt`         | Go programming language compiler                                                 |
+| gpg 2.4             | `gpg`                 | GNU Privacy Guard 2 - public key operations only                                 |
+| jq 1.8              | `jq`                  | A lightweight and flexible command-line JSON processor                           |
+| nodejs 24.14        | `node`                | JavaScript runtime built on V8 engine - LTS version                              |
+| openssh-client 10.2 | `scp`; `sftp`; `ssh`  | OpenBSD's SSH client common files                                                |
+| patch 2.8           | `patch`               | Utility to apply diffs to files                                                  |
+| perl 5.42           | `perl`                | Larry Wall's Practical Extraction and Report Language                            |
+| pnpm 10.32          | `pnpm`; `pnpx`        | Fast, disk space efficient package manager                                       |
+| rage 0.11           | `rage`; `rage-keygen` | Simple, modern and secure encryption tool                                        |
+| ripgrep 15.1        | `rg`                  | ripgrep combines the usability of The Silver Searcher with the raw speed of grep |
+| rsync 3.4           | `rsync`; `rsync-ssl`  | A file transfer program to keep remote files in sync                             |
+| rust 1.94           | `rustc`; `rustdoc`    | Rust Programming Language toolchain                                              |
+| shellcheck 0.11     | `shellcheck`          | a static analysis tool for shell scripts                                         |
+| ssl_client 1.37     | `ssl_client`          | External ssl_client for busybox wget                                             |
+| uv 0.10             | `uv`; `uvx`           | Extremely fast Python package installer and resolver, written in Rust            |
+| yq-go 4.52          | `yq`                  | Portable command-line YAML processor written in Go                               |
+| zstd 1.5            | `unzstd`; `zstd`      | Zstandard - Fast real-time compression algorithm                                 |
+
+## Usage
+
+This image runs as the user nonroot (`65532:65532`), in the directory `/work`, with the entrypoint `claude`.
+
+Mount points:
+
+- `/work` - the current working directory, where the codebase should be mounted
+- `/home/nonroot` - the directory where claude and related state lives
+
+Example:
+
+```sh
+docker run -it --init --rm \
+  --volume "$(pwd):/work:rw" \
+  --volume "${HOME}/.ccwrapper/$(pwd | tr -C 'A-Za-z0-9\n' '_'):/home/nonroot:rw" \
+  backplane/ccwrapper
+```

ccwrapper/docs.md

@@ -0,0 +1,28 @@
+# package index
+
+This command line (or something like it) can be used to build up some of the info in the README.md
+
+```sh
+apk list -I -q \
+| xargs apk info --all --format json \
+| jq -r --arg path "$PATH" '
+  def on_path($dirs):
+    . as $f
+    | ($f | split("/")[:-1] | join("/")) as $dir
+    | ($dirs | index($dir)) != null;
+
+  ($path | split(":")) as $pathdirs
+  | .[]
+  | {
+      package: .name,
+      version: .version,
+      executables: (
+        .contents
+        | map("/" + .)
+        | map(select(on_path($pathdirs)))
+      ),
+      description: .description
+    }
+  | select(.executables | length > 0)
+'
+```

ccwrapper/entrypoint.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+# entrypoint for claude code wrapper, which allows the nonroot homedir to be a volume
+set -eu
+SELF=$(basename "$0" '.sh')
+
+NR_HOME="${NR_HOME:-/home/nonroot}"
+NR_SKEL="${NR_SKEL:-/.nonroot_skeleton}"
+
+log() {
+  printf '%s %s %s\n' "$(date '+%FT%T%z')" "$SELF" "$*" >&2
+}
+
+die() {
+  log "FATAL:" "$@"
+  exit 1
+}
+
+main() {
+  if find "$NR_HOME" -maxdepth 0 -empty | grep -q .; then
+    log "populating ${NR_HOME} from ${NR_SKEL}"
+    rsync -avHP8 "${NR_SKEL}/." "${NR_HOME}/." || die "failed to rsync home directory from skeleton"
+  fi
+
+  exec "${NR_HOME}/.local/bin/claude" "$@"
+}
+
+main "$@"
+# shellcheck disable=SC2317
+exit

ccwrapper/skel-CLAUDE.md

@@ -0,0 +1,27 @@
+# Environment
+
+Alpine Linux container. Running as `nonroot` (65532:65532) in `/work`.
+
+# Available Tools
+
+- **cargo**, **rustc**, **rustdoc** — Rust toolchain
+- **curl**, **wcurl** — HTTP/URL retrieval
+- **deno** — JavaScript/TypeScript runtime
+- **docker**, **docker compose** — Docker CLI
+- **gcc** — GNU C compiler
+- **git** — version control
+- **go**, **gofmt** — Go toolchain
+- **gpg** — public key operations
+- **jq** — JSON processor
+- **node**, **pnpm**, **pnpx** — Node.js + package manager
+- **patch** — apply diffs
+- **perl** — Perl interpreter
+- **rage**, **rage-keygen** — modern file encryption
+- **rg** (ripgrep) — fast recursive search
+- **rsync** — file sync/transfer
+- **scp**, **sftp**, **ssh** — OpenSSH client
+- **shellcheck** — shell script linter
+- **uv**, **uvx** — fast Python package manager
+- **xmllint** — XML processor (libxml2-utils)
+- **yq** — YAML processor
+- **zstd**, **unzstd** — Zstandard compression