Merge branch 'runner-base-without-claude-code'

1	1		# Rebuilds the base image of g1t's sandboxes (services/runner/base/Dockerfile:
2		−	# the OS, toolchains and the Claude Code CLI), pushes it to Cloudflare's
	2	+	# the OS and toolchains), pushes it to Cloudflare's
3	3		# registry, and opens a pull request that records it in
4	4		# services/runner/base.json. Merging that pull request is what rolls it out:
5	5		# the next deploy builds the runner's image on it, in seconds.

276	276
277	277		\| Image \| Built from \| Rebuilt \|
278	278		\| --- \| --- \| --- \|
279		−	\| The base \| `services/runner/base/Dockerfile`: Debian, Node, Python, Docker, Go, Rust, Java, .NET, Ruby and the Claude Code CLI \| When its folder changes, weekly by `runner-base.yml`, or by hand with `build-base` \|
	279	+	\| The base \| `services/runner/base/Dockerfile`: Debian, Node, Python, Docker, Go, Rust, Java, .NET and Ruby \| When its folder changes, weekly by `runner-base.yml`, or by hand with `build-base` \|
280	280		\| The runner \| `services/runner/Dockerfile`: the base plus the `g1t-runner` binary \| When the binary or the base changes \|
281	281
282	282		`services/runner/base.json` records the base that was pushed;

2	2		// (docs.g1t.sh/guides/deploy-to-cloudflare/#the-runners-images):
3	3		//
4	4		// base g1t-runner:base-<date>-<inputs> services/runner/base/Dockerfile:
5		−	// the OS, toolchains and the Claude Code CLI. Rebuilt only when
	5	+	// the OS and toolchains. Rebuilt only when
6	6		// its folder changes, or weekly (.g1t/workflows/runner-base.yml),
7	7		// and recorded in services/runner/base.json.
8	8		// runner g1t-runner:<content> services/runner/Dockerfile: the
⋯
221	221		'echo "dotnet=$(dotnet --version)"',
222	222		'echo "ruby=$(ruby --version \| cut -d" " -f2)"',
223	223		'echo "git=$(git --version \| cut -d" " -f3)"',
224		−	'echo "claude_code=$(claude --version \| cut -d" " -f1)"',
225	224		'echo "docker=$(dockerd --version \| cut -d" " -f3 \| tr -d ,)"',
226	225		'echo "debian=$(cat /etc/debian_version)"',
227	226		].join("; ");

1	1		{
2		−	"image": "registry.cloudflare.com/1e6f2cffa3f445920836e8ebe446bb58/g1t-runner:base-20261008-a314499af03b",
3		−	"digest": "sha256:db58aae3a4df6cb90f853c7abf83a0e612977667fa3d409e8b0a67800a849c94",
	2	+	"image": "registry.cloudflare.com/1e6f2cffa3f445920836e8ebe446bb58/g1t-runner:base-20261014-9cb0c1c3ba59",
	3	+	"digest": "sha256:ac4349507e453028275dd60e5020d577c0d1673e1eac9582e7fcf5e64527119f",
4	4		"pushed": true,
5		−	"inputs": "a314499af03bda6a12f906332827ba1b2c23ea781c32e69599050762e5c2ce05",
6		−	"built_at": "2026-10-08T19:56:49.397Z",
7		−	"size_bytes": 4521302378,
	5	+	"inputs": "9cb0c1c3ba5983ad9df9daa5a1b48d2e905a7f065f45cec2527edc30309f4488",
	6	+	"built_at": "2026-10-14T20:06:49.272Z",
	7	+	"size_bytes": 4155695227,
8	8		"versions": {
9	9		"node": "v24.21.0",
10	10		"npm": "11.19.0",
⋯
15	15		"dotnet": "8.0.425",
16	16		"ruby": "3.3.12",
17	17		"git": "2.39.5",
18		−	"claude_code": "2.1.291",
19	18		"docker": "29.8.2",
20	19		"debian": "12.15"
21	20		}

1	1		# syntax=docker/dockerfile:1.7
2	2		#
3	3		# g1t-runner-base: everything a g1t sandbox has apart from the g1t runner
4		−	# itself. Agents, checks, the merge queue, workflow jobs and g1t.page
	4	+	# itself. Checks, the merge queue, workflow jobs and g1t.page
5	5		# builds all run in it: git, Node, Python, Go, Rust (with the formatter,
6	6		# the linter, and the wasm32 and musl targets), Java (Temurin 21), .NET
7	7		# (SDK 8), Ruby (3.3), the usual build tools, Docker (Engine, Buildx,
8		−	# Compose), and the Claude Code CLI.
	8	+	# Compose).
9	9		#
10	10		# Built and pushed by `node scripts/deploy.mjs build-base` (by hand, or by
11	11		# .g1t/workflows/runner-base.yml), which records what it pushed in
12	12		# services/runner/base.json. The runner's own image
13	13		# (services/runner/Dockerfile) is this plus one file, so a change to the
14		−	# runner builds in seconds. docs/DEPLOYING.md explains the two.
	14	+	# runner builds in seconds. The deploy-to-cloudflare guide explains the two.
15	15		#
16	16		# Layers go from what changes least to what changes most: the system's
17		−	# packages, Docker, then Go, then Rust, then Java, .NET and Ruby, then the
18		−	# Claude Code CLI on top, so a new CLI version rebuilds and pushes one
19		−	# layer.
	17	+	# packages, Docker, then Go, then Rust, then Java, .NET and Ruby.
20	18		#
21	19		# Java and Ruby live in the runner's tool cache (RUNNER_TOOL_CACHE,
22	20		# /home/runner/_tool), laid out as the setup actions look for them, so
⋯
100	98		&& rm -rf /tmp/go.tgz /usr/local/go/test /usr/local/go/api /usr/local/go/doc \
101	99		&& ln -s /usr/local/go/bin/go /usr/local/go/bin/gofmt /usr/local/bin/
102	100
103		−	# Claude Code refuses to skip permission prompts as root.
	101	+	# Install the Rust toolchain for the unprivileged job user.
104	102		USER node
105	103		ENV HOME=/home/node
106	104		ENV PATH=/home/node/.cargo/bin:/home/node/go/bin:$PATH
⋯
191	189		&& touch "$prefix.complete" \
192	190		&& chown -R node:node "/home/runner/_tool/Ruby"
193	191		ENV PATH=${JAVA_HOME}/bin:/home/runner/_tool/Ruby/${RUBY_VERSION}/x64/bin:$PATH
194		−
195		−	USER node
196	192
197		−	# Commits are the g1t agent's; the harness does not sign them as its own.
198		−	RUN mkdir -p /home/node/.claude \
199		−	&& echo '{"includeCoAuthoredBy": false}' > /home/node/.claude/settings.json
200		−
201		−	# The Claude Code CLI, pinned, on top: it changes most often of anything
202		−	# here, and is one layer to rebuild and push.
203		−	ARG CLAUDE_CODE_VERSION=2.1.291
204		−	USER root
205		−	# npm's cache stays in BuildKit's cache, out of the image.
206		−	RUN --mount=type=cache,target=/tmp/npm-cache \
207		−	npm install --global --no-audit --no-fund --cache /tmp/npm-cache "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}" \
208		−	&& claude --version
209	193		USER node

flagon-io/g1t

Comments