Skip to content

⌘K

Explore Download Docs

flagon-io/g1t

public

Overview Code Issues Pull requests Workflows Deployments Insights

Files Commits Branches Tags Releases Compare

g1t/services/runner

syntaqxMerge branch 'worktree-agent-aef0bb4ceda89e542'ef55ddfyesterdayHistory

..
base
src
Dockerfile
base.json
package.json
tsconfig.json
wrangler.jsonc

Where your team and its coding agents ship code.

Product

Explore
Pricing
Download
Chat
Bring your own agent
Integrations

Developers

Documentation
API reference
MCP tools
llms.txt

Company

Flagon, Inc.
Support
Security
Status

Open source

Source on g1t
MIT license
Run g1t yourself

g1t is designed, built, and backed by Flagon, Inc., a small, independent software company founded by Chase Pierce.

Checking statusStatus
Support
Policies
Privacy
Security

·

Sign in
© 2026 Flagon, Inc. All rights reserved.

..
baseMerge runner image: Java 21, .NET 8, Ruby 3.35d ago
srcEvery sandbox whose traffic is intercepted trusts the egress certificate: once a sandbox has any outbound handler, Cloudflare passes all its traffic through the runner Worker and re-signs HTTPS, so an open sandbox with only the abuse-report host intercepted got SELF_SIGNED_CERT_IN_CHAIN on every HTTPS request after the network guardrails were removed (before, g1t's own sandboxes were restricted, and restricted ones were given the certificate).yesterday
DockerfileA deploy makes the runner's image in the registry, without Docker: it reads the base's manifest and config from Cloudflare's registry, uploads one gzipped layer holding the runner binary at /usr/local/bin/g1t-runner with mode 0755, and writes a config (the entrypoint g1t-runner, the base's command cleared, as the Dockerfile's ENTRYPOINT does) and a manifest that name the base's layers and that one, under the runner's tag, for linux/amd64 (scripts/deploy/registry.mjs, the registry's own upload calls with the credentials Wrangler gives). Deploy #256 ran out of disk because docker build pulled the 4.5 GB base into the job's own Docker Engine, compressed and unpacked, on a 20 GB sandbox whose own filesystem is that same base; now nothing of the base is downloaded and the job's Docker Engine is never started. Docker is asked for only when it is needed: a dry run (build, or image --no-push) still builds services/runner/Dockerfile with it, and so does a deploy whose registry step fails, logging df -h and docker system df before and after. The image job removes npm's downloads, which it only restores, once its install has read them, and logs the disk before and after the deploy. Tests cover the layer's tar, the config and manifest, the calls against a registry kept in memory (the base's layers are never fetched), the token flow, and that the Dockerfile says the same path, mode and entrypoint; the image was also checked against a local registry, where it runs and has the same config as a docker build of the Dockerfile.yesterday
base.jsonRunner base: published base-20261008-a314499af03b (Java 21, .NET 8, Ruby 3.3)5d ago
package.jsonMembers can read a private repository's pull request forks1w ago
tsconfig.jsonMerge brokered secrets: a secret a job uses only to call an API can be tied to the hosts it is for, and the job gets a stand-in in its place, which g1t fills in on the way out to those hosts and nowhere else, so the value never enters the sandbox; and a request to an allowed host that fails upstream is retried when it can be, or answered with a 502 that says why, rather than reset.yesterday
wrangler.jsoncMerge branch 'main' into ask-integrationyesterday