From 004010be3166babce58b113b72651ab902d98cf5 Mon Sep 17 00:00:00 2001 From: alexbelgium Date: Wed, 22 Jul 2026 11:51:01 +0200 Subject: [PATCH 1/7] feat(claude_desktop): add cowork virtualization stack (qemu, ovmf, docker, virtiofsd) Adds qemu-system-x86, ovmf, and docker.io (Bookworm main) plus virtiofsd for sharing the workspace into the sandbox microVM. virtiofsd has no Bookworm/backports package and its trixie .deb would GLIBC-mismatch the runtime, so it's built from the pinned crates.io release in a dedicated builder stage, mirroring the existing rtk/tokensave pattern. Also updates the repo versioning convention in CLAUDE.md: local patch counters should use a dot (X.Y.Z.N) instead of a hyphen (X.Y.Z-N), since the hyphen form parses as a semver pre-release and Supervisor won't offer the update. Co-Authored-By: Claude Opus 5 --- CLAUDE.md | 4 +++- claude_desktop/CHANGELOG.md | 3 +++ claude_desktop/Dockerfile | 34 ++++++++++++++++++++++++++++++++-- claude_desktop/config.yaml | 2 +- 4 files changed, 39 insertions(+), 4 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 556418252a..f390e1629c 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -92,11 +92,13 @@ The `env_vars` schema key enables the env-var passthrough mechanism. At runtime Add-on versions in `config.yaml` closely follow the upstream release tag and do not conform to a single fixed format. Common patterns include: - `X.Y.Z` – plain upstream semver (e.g. `0.137.0`) -- `X.Y.Z-N` – upstream version with a local patch counter (e.g. `0.6.26-2`) +- `X.Y.Z.N` – upstream version with a local patch counter (e.g. `0.6.26.2`) - LSIO-style tags (e.g. `1.43.1.10611-1e34174b1-ls301`) - Date-based versions (e.g. `2026.02.28`) - Nightly builds (e.g. `nightly-20260321-397`) +For the local patch counter, use a dot (`X.Y.Z.N`), not a hyphen. `X.Y.Z-N` parses as a semver pre-release tag, which Home Assistant Supervisor treats as *older* than plain `X.Y.Z` — it will not offer the update. New and updated add-ons should use `.N`; existing `-N` versions should be migrated to `.N` opportunistically (e.g. when that add-on is next touched), not as a standalone repo-wide sweep. + When an upstream version is bumped, update `version` in `config.yaml`. If the add-on's `Dockerfile` contains an `ARG BUILD_UPSTREAM` line, update that value too — it is the canonical place that records the upstream version at build time (it is **not** stored in `build.json`/`build.yaml`). Some add-ons do not use `BUILD_UPSTREAM` at all. The `updater.json` file tracks which upstream source/repo to monitor and records the last seen version. ## updater.json Format diff --git a/claude_desktop/CHANGELOG.md b/claude_desktop/CHANGELOG.md index 54fe544cf5..593e7b93a6 100644 --- a/claude_desktop/CHANGELOG.md +++ b/claude_desktop/CHANGELOG.md @@ -1,4 +1,7 @@ +## 1.33 (22-07-2026) +- Add cowork virtualization support: `qemu-system-x86`, `ovmf`, and `docker.io` (Bookworm main, installed via apt) plus `virtiofsd` for sharing the workspace into the sandbox microVM. `virtiofsd` is only packaged for Debian trixie/sid, not Bookworm or bookworm-backports, and its trixie `.deb` links a newer GLIBC than this add-on's Bookworm runtime — so it now gets built from the pinned crates.io release (`1.14.0`) in a dedicated `virtiofsd-builder` stage, the same GLIBC-safe pattern already used for `rtk` and `tokensave`. Its build deps (`libseccomp-dev`, `libcap-ng-dev`, `pkg-config`, `clang`, `libclang-dev`) live only in that builder stage; only the runtime shared libs (`libseccomp2`, `libcap-ng0`) ship in the final image. The built binary is validated with `--version` at build time alongside `rtk`/`tokensave`, so a GLIBC/ABI mismatch fails the image build instead of surfacing at container start. + ## ubunturesolute-version-8208e985 (2026-07-21) - Update to latest version from linuxserver/docker-baseimage-selkies (changelog : https://github.com/linuxserver/docker-baseimage-selkies/releases) diff --git a/claude_desktop/Dockerfile b/claude_desktop/Dockerfile index 3894c5acb9..32c3c5f4f1 100644 --- a/claude_desktop/Dockerfile +++ b/claude_desktop/Dockerfile @@ -12,6 +12,7 @@ ARG BUILD_VERSION ARG RTK_VERSION="v0.43.0" ARG RTK_COMMIT="5a7880d404db8364d602f2ecdc41dd790f64013f" ARG TOKENSAVE_VERSION="7.4.0" +ARG VIRTIOFSD_VERSION="1.14.0" # The upstream aarch64 release is cross-built on ubuntu-latest and requires # GLIBC 2.39. Build the pinned source on Bookworm instead so it is compatible @@ -33,6 +34,24 @@ ARG TOKENSAVE_VERSION RUN cargo install tokensave --version "${TOKENSAVE_VERSION}" --locked --root /out && \ /out/bin/tokensave --version +# virtiofsd is only packaged for Debian trixie/sid, not Bookworm or bookworm-backports; +# installing the trixie .deb on the Bookworm runtime would pull a binary linked against a +# newer GLIBC. Build the pinned crates.io release from source on Bookworm so the daemon's +# ABI matches the add-on runtime (same rationale as the rtk and tokensave builders above). +# Cowork shares the workspace into its qemu microVM through virtiofsd. +FROM rust:1.91-bookworm AS virtiofsd-builder +ARG VIRTIOFSD_VERSION +RUN apt-get update && \ + apt-get install -y --no-install-recommends \ + libseccomp-dev \ + libcap-ng-dev \ + pkg-config \ + clang \ + libclang-dev && \ + cargo install virtiofsd --version "${VIRTIOFSD_VERSION}" --locked --root /out && \ + /out/bin/virtiofsd --version && \ + rm -rf /var/lib/apt/lists/* + FROM ${BUILD_FROM} ARG BUILD_ARCH @@ -85,6 +104,9 @@ RUN if [ ! -f /bin/sh ] && [ -f /usr/bin/sh ]; then ln -s /usr/bin/sh /bin/sh; f # Install Claude Desktop, Claude Code, Python tooling, and lightweight local validators. # gnome-keyring provides the Secret Service backend Electron safeStorage needs to persist # sign-in and dispatch grants. +# The cowork virtualization stack (qemu-system-x86 + ovmf firmware + docker.io) lets Claude +# Code launch its sandbox microVM; libseccomp2 and libcap-ng0 are the shared libraries the +# source-built virtiofsd daemon links against at runtime. RUN install -d -m 0755 /etc/apt/keyrings && \ curl -fsSLo /usr/share/keyrings/claude-desktop-archive-keyring.asc https://downloads.claude.ai/claude-desktop/key.asc && \ curl -fsSLo /etc/apt/keyrings/claude-code.asc https://downloads.claude.ai/keys/claude-code.asc && \ @@ -102,7 +124,12 @@ RUN install -d -m 0755 /etc/apt/keyrings && \ ripgrep \ jq \ shellcheck \ - yamllint && \ + yamllint \ + qemu-system-x86 \ + ovmf \ + docker.io \ + libseccomp2 \ + libcap-ng0 && \ test -x /usr/bin/claude && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* @@ -134,7 +161,10 @@ RUN set -eux; \ # image. This makes an ABI mismatch fail the image build instead of surfacing at runtime. COPY --from=rtk-builder /out/rtk /usr/local/bin/rtk COPY --from=tokensave-builder /out/bin/tokensave /usr/local/bin/tokensave -RUN /usr/local/bin/rtk --version && /usr/local/bin/tokensave --version +COPY --from=virtiofsd-builder /out/bin/virtiofsd /usr/local/bin/virtiofsd +RUN /usr/local/bin/rtk --version && \ + /usr/local/bin/tokensave --version && \ + /usr/local/bin/virtiofsd --version # Install only the Headroom proxy, code-compression, and MCP features used by this add-on, # plus mcp-proxy (stdio->HTTP bridge for the Home Assistant MCP server) and uv (fast diff --git a/claude_desktop/config.yaml b/claude_desktop/config.yaml index 58700b5f22..7676f7b4d1 100644 --- a/claude_desktop/config.yaml +++ b/claude_desktop/config.yaml @@ -110,5 +110,5 @@ slug: claude_desktop tmpfs: true udev: true url: https://github.com/alexbelgium/hassio-addons -version: "ubunturesolute-version-8208e985" +version: "1.33" video: true From a7b2dbc5cb6e6bca3e64d251e15f1bd1ba244482 Mon Sep 17 00:00:00 2001 From: alexbelgium Date: Wed, 22 Jul 2026 11:57:10 +0200 Subject: [PATCH 2/7] fix(claude_desktop): drop docker.io, base image already has Docker-in-Docker MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI failed the build: apt refused to install docker.io because it pulls in Debian's containerd/runc, which Conflicts with the containerd.io already installed by the base image's own Docker-in-Docker support (docker-ce + containerd.io from Docker's apt repo, toggled by the pre-existing START_DOCKER env var — the reason that option existed before this PR). qemu-system-x86 and ovmf are unaffected and stay. Co-Authored-By: Claude Opus 5 --- claude_desktop/CHANGELOG.md | 2 +- claude_desktop/Dockerfile | 11 +++++++---- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/claude_desktop/CHANGELOG.md b/claude_desktop/CHANGELOG.md index 593e7b93a6..f7bbb06938 100644 --- a/claude_desktop/CHANGELOG.md +++ b/claude_desktop/CHANGELOG.md @@ -1,6 +1,6 @@ ## 1.33 (22-07-2026) -- Add cowork virtualization support: `qemu-system-x86`, `ovmf`, and `docker.io` (Bookworm main, installed via apt) plus `virtiofsd` for sharing the workspace into the sandbox microVM. `virtiofsd` is only packaged for Debian trixie/sid, not Bookworm or bookworm-backports, and its trixie `.deb` links a newer GLIBC than this add-on's Bookworm runtime — so it now gets built from the pinned crates.io release (`1.14.0`) in a dedicated `virtiofsd-builder` stage, the same GLIBC-safe pattern already used for `rtk` and `tokensave`. Its build deps (`libseccomp-dev`, `libcap-ng-dev`, `pkg-config`, `clang`, `libclang-dev`) live only in that builder stage; only the runtime shared libs (`libseccomp2`, `libcap-ng0`) ship in the final image. The built binary is validated with `--version` at build time alongside `rtk`/`tokensave`, so a GLIBC/ABI mismatch fails the image build instead of surfacing at container start. +- Add cowork virtualization support: `qemu-system-x86` and `ovmf` (Bookworm main, installed via apt) plus `virtiofsd` for sharing the workspace into the sandbox microVM. `virtiofsd` is only packaged for Debian trixie/sid, not Bookworm or bookworm-backports, and its trixie `.deb` links a newer GLIBC than this add-on's Bookworm runtime — so it now gets built from the pinned crates.io release (`1.14.0`) in a dedicated `virtiofsd-builder` stage, the same GLIBC-safe pattern already used for `rtk` and `tokensave`. Its build deps (`libseccomp-dev`, `libcap-ng-dev`, `pkg-config`, `clang`, `libclang-dev`) live only in that builder stage; only the runtime shared libs (`libseccomp2`, `libcap-ng0`) ship in the final image. The built binary is validated with `--version` at build time alongside `rtk`/`tokensave`, so a GLIBC/ABI mismatch fails the image build instead of surfacing at container start. Docker itself is deliberately not installed: this base image already ships Docker-in-Docker (`docker-ce`/`containerd.io` from Docker's own apt repo, started via the pre-existing `START_DOCKER` env var) — an initial attempt to also `apt-get install docker.io` broke the build, since Debian's package pulls in `containerd`/`runc`, which apt refuses to install alongside the base image's already-installed `containerd.io` (`Conflicts`). ## ubunturesolute-version-8208e985 (2026-07-21) - Update to latest version from linuxserver/docker-baseimage-selkies (changelog : https://github.com/linuxserver/docker-baseimage-selkies/releases) diff --git a/claude_desktop/Dockerfile b/claude_desktop/Dockerfile index 32c3c5f4f1..4874372a7c 100644 --- a/claude_desktop/Dockerfile +++ b/claude_desktop/Dockerfile @@ -104,9 +104,13 @@ RUN if [ ! -f /bin/sh ] && [ -f /usr/bin/sh ]; then ln -s /usr/bin/sh /bin/sh; f # Install Claude Desktop, Claude Code, Python tooling, and lightweight local validators. # gnome-keyring provides the Secret Service backend Electron safeStorage needs to persist # sign-in and dispatch grants. -# The cowork virtualization stack (qemu-system-x86 + ovmf firmware + docker.io) lets Claude -# Code launch its sandbox microVM; libseccomp2 and libcap-ng0 are the shared libraries the -# source-built virtiofsd daemon links against at runtime. +# The cowork virtualization stack (qemu-system-x86 + ovmf firmware) lets Claude Code launch +# its sandbox microVM; libseccomp2 and libcap-ng0 are the shared libraries the source-built +# virtiofsd daemon links against at runtime. Docker itself is NOT installed here: this base +# image already ships Docker-in-Docker (docker-ce + containerd.io from Docker's own apt repo, +# started via the pre-existing START_DOCKER env var) — installing Debian's docker.io package +# on top pulls in Debian's own containerd/runc, which apt refuses because they Conflict with +# the base image's already-installed containerd.io. RUN install -d -m 0755 /etc/apt/keyrings && \ curl -fsSLo /usr/share/keyrings/claude-desktop-archive-keyring.asc https://downloads.claude.ai/claude-desktop/key.asc && \ curl -fsSLo /etc/apt/keyrings/claude-code.asc https://downloads.claude.ai/keys/claude-code.asc && \ @@ -127,7 +131,6 @@ RUN install -d -m 0755 /etc/apt/keyrings && \ yamllint \ qemu-system-x86 \ ovmf \ - docker.io \ libseccomp2 \ libcap-ng0 && \ test -x /usr/bin/claude && \ From bbef5347f3f2f869535a61d5a63b872a3acdd5b4 Mon Sep 17 00:00:00 2001 From: alexbelgium Date: Wed, 22 Jul 2026 12:00:36 +0200 Subject: [PATCH 3/7] fix(claude_desktop): add blank line before 1.33 changelog list (MD022/MD032) Codacy flagged 2 new markdownlint issues against the repo's 0-max gate: the new heading and its following bullet list need a blank line between them, matching the spacing every other CHANGELOG entry already uses. Co-Authored-By: Claude Opus 5 --- claude_desktop/CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/claude_desktop/CHANGELOG.md b/claude_desktop/CHANGELOG.md index f7bbb06938..0d78ef8cc8 100644 --- a/claude_desktop/CHANGELOG.md +++ b/claude_desktop/CHANGELOG.md @@ -1,5 +1,6 @@ ## 1.33 (22-07-2026) + - Add cowork virtualization support: `qemu-system-x86` and `ovmf` (Bookworm main, installed via apt) plus `virtiofsd` for sharing the workspace into the sandbox microVM. `virtiofsd` is only packaged for Debian trixie/sid, not Bookworm or bookworm-backports, and its trixie `.deb` links a newer GLIBC than this add-on's Bookworm runtime — so it now gets built from the pinned crates.io release (`1.14.0`) in a dedicated `virtiofsd-builder` stage, the same GLIBC-safe pattern already used for `rtk` and `tokensave`. Its build deps (`libseccomp-dev`, `libcap-ng-dev`, `pkg-config`, `clang`, `libclang-dev`) live only in that builder stage; only the runtime shared libs (`libseccomp2`, `libcap-ng0`) ship in the final image. The built binary is validated with `--version` at build time alongside `rtk`/`tokensave`, so a GLIBC/ABI mismatch fails the image build instead of surfacing at container start. Docker itself is deliberately not installed: this base image already ships Docker-in-Docker (`docker-ce`/`containerd.io` from Docker's own apt repo, started via the pre-existing `START_DOCKER` env var) — an initial attempt to also `apt-get install docker.io` broke the build, since Debian's package pulls in `containerd`/`runc`, which apt refuses to install alongside the base image's already-installed `containerd.io` (`Conflicts`). ## ubunturesolute-version-8208e985 (2026-07-21) From 803006d1355b08adc8f34ced9419a7052a34d036 Mon Sep 17 00:00:00 2001 From: Alexandre <44178713+alexbelgium@users.noreply.github.com> Date: Wed, 22 Jul 2026 12:20:42 +0200 Subject: [PATCH 4/7] fix(claude_desktop): install virtiofsd in probed path --- claude_desktop/Dockerfile | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/claude_desktop/Dockerfile b/claude_desktop/Dockerfile index 4874372a7c..49e9d545a7 100644 --- a/claude_desktop/Dockerfile +++ b/claude_desktop/Dockerfile @@ -164,10 +164,10 @@ RUN set -eux; \ # image. This makes an ABI mismatch fail the image build instead of surfacing at runtime. COPY --from=rtk-builder /out/rtk /usr/local/bin/rtk COPY --from=tokensave-builder /out/bin/tokensave /usr/local/bin/tokensave -COPY --from=virtiofsd-builder /out/bin/virtiofsd /usr/local/bin/virtiofsd +COPY --from=virtiofsd-builder /out/bin/virtiofsd /usr/bin/virtiofsd RUN /usr/local/bin/rtk --version && \ /usr/local/bin/tokensave --version && \ - /usr/local/bin/virtiofsd --version + /usr/bin/virtiofsd --version # Install only the Headroom proxy, code-compression, and MCP features used by this add-on, # plus mcp-proxy (stdio->HTTP bridge for the Home Assistant MCP server) and uv (fast @@ -235,7 +235,6 @@ ENV BUILD_VERSION="${BUILD_VERSION}" LABEL \ io.hass.name="${BUILD_NAME}" \ io.hass.description="${BUILD_DESCRIPTION}" \ - io.hass.arch="${BUILD_ARCH}" \ io.hass.type="addon" \ io.hass.version=${BUILD_VERSION} \ maintainer="alexbelgium (https://github.com/alexbelgium)" \ From e217cdf02fcc7724e78df80cd83a4eaf3b2cc515 Mon Sep 17 00:00:00 2001 From: Alexandre <44178713+alexbelgium@users.noreply.github.com> Date: Wed, 22 Jul 2026 12:21:02 +0200 Subject: [PATCH 5/7] fix(claude_desktop): expose cowork VM devices --- claude_desktop/config.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/claude_desktop/config.yaml b/claude_desktop/config.yaml index 7676f7b4d1..c654baed35 100644 --- a/claude_desktop/config.yaml +++ b/claude_desktop/config.yaml @@ -9,6 +9,8 @@ devices: - /dev/dri/card1 - /dev/dri/renderD128 - /dev/fuse + - /dev/kvm + - /dev/vhost-vsock environment: AUTO_GPU: "1" FM_HOME: /data/data From 5356c02501af84a9cd2f23e5ffbfbd8da040eb93 Mon Sep 17 00:00:00 2001 From: Alexandre <44178713+alexbelgium@users.noreply.github.com> Date: Wed, 22 Jul 2026 12:22:12 +0200 Subject: [PATCH 6/7] fix(claude_desktop): restore architecture label --- claude_desktop/Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/claude_desktop/Dockerfile b/claude_desktop/Dockerfile index 49e9d545a7..d49f9131fc 100644 --- a/claude_desktop/Dockerfile +++ b/claude_desktop/Dockerfile @@ -235,6 +235,7 @@ ENV BUILD_VERSION="${BUILD_VERSION}" LABEL \ io.hass.name="${BUILD_NAME}" \ io.hass.description="${BUILD_DESCRIPTION}" \ + io.hass.arch="${BUILD_ARCH}" \ io.hass.type="addon" \ io.hass.version=${BUILD_VERSION} \ maintainer="alexbelgium (https://github.com/alexbelgium)" \ From c9169966602e4ce432708e0b37a8f63f6157408b Mon Sep 17 00:00:00 2001 From: Alexandre <44178713+alexbelgium@users.noreply.github.com> Date: Wed, 22 Jul 2026 12:30:22 +0200 Subject: [PATCH 7/7] fix(claude_desktop): use BuildKit target architecture in validators --- claude_desktop/Dockerfile | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/claude_desktop/Dockerfile b/claude_desktop/Dockerfile index d49f9131fc..684d727964 100644 --- a/claude_desktop/Dockerfile +++ b/claude_desktop/Dockerfile @@ -54,6 +54,7 @@ RUN apt-get update && \ FROM ${BUILD_FROM} ARG BUILD_ARCH +ARG TARGETARCH ################## # 2 Modify Image # @@ -142,10 +143,10 @@ ARG HADOLINT_VERSION=v2.14.0 ARG ACTIONLINT_VERSION=v1.7.12 RUN set -eux; \ - case "${BUILD_ARCH}" in \ + case "${TARGETARCH}" in \ amd64) hadolint_arch="x86_64"; actionlint_arch="amd64" ;; \ - aarch64) hadolint_arch="arm64"; actionlint_arch="arm64" ;; \ - *) echo "Unsupported validation-tools architecture: ${BUILD_ARCH}" >&2; exit 1 ;; \ + arm64) hadolint_arch="arm64"; actionlint_arch="arm64" ;; \ + *) echo "Unsupported validation-tools architecture: ${TARGETARCH}" >&2; exit 1 ;; \ esac; \ curl -fsSL --retry 3 --retry-delay 2 \ -o /usr/local/bin/hadolint \