From a7b2dbc5cb6e6bca3e64d251e15f1bd1ba244482 Mon Sep 17 00:00:00 2001 From: alexbelgium Date: Wed, 22 Jul 2026 11:57:10 +0200 Subject: [PATCH] fix(claude_desktop): drop docker.io, base image already has Docker-in-Docker MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI failed the build: apt refused to install docker.io because it pulls in Debian's containerd/runc, which Conflicts with the containerd.io already installed by the base image's own Docker-in-Docker support (docker-ce + containerd.io from Docker's apt repo, toggled by the pre-existing START_DOCKER env var — the reason that option existed before this PR). qemu-system-x86 and ovmf are unaffected and stay. Co-Authored-By: Claude Opus 5 --- claude_desktop/CHANGELOG.md | 2 +- claude_desktop/Dockerfile | 11 +++++++---- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/claude_desktop/CHANGELOG.md b/claude_desktop/CHANGELOG.md index 593e7b93a6..f7bbb06938 100644 --- a/claude_desktop/CHANGELOG.md +++ b/claude_desktop/CHANGELOG.md @@ -1,6 +1,6 @@ ## 1.33 (22-07-2026) -- Add cowork virtualization support: `qemu-system-x86`, `ovmf`, and `docker.io` (Bookworm main, installed via apt) plus `virtiofsd` for sharing the workspace into the sandbox microVM. `virtiofsd` is only packaged for Debian trixie/sid, not Bookworm or bookworm-backports, and its trixie `.deb` links a newer GLIBC than this add-on's Bookworm runtime — so it now gets built from the pinned crates.io release (`1.14.0`) in a dedicated `virtiofsd-builder` stage, the same GLIBC-safe pattern already used for `rtk` and `tokensave`. Its build deps (`libseccomp-dev`, `libcap-ng-dev`, `pkg-config`, `clang`, `libclang-dev`) live only in that builder stage; only the runtime shared libs (`libseccomp2`, `libcap-ng0`) ship in the final image. The built binary is validated with `--version` at build time alongside `rtk`/`tokensave`, so a GLIBC/ABI mismatch fails the image build instead of surfacing at container start. +- Add cowork virtualization support: `qemu-system-x86` and `ovmf` (Bookworm main, installed via apt) plus `virtiofsd` for sharing the workspace into the sandbox microVM. `virtiofsd` is only packaged for Debian trixie/sid, not Bookworm or bookworm-backports, and its trixie `.deb` links a newer GLIBC than this add-on's Bookworm runtime — so it now gets built from the pinned crates.io release (`1.14.0`) in a dedicated `virtiofsd-builder` stage, the same GLIBC-safe pattern already used for `rtk` and `tokensave`. Its build deps (`libseccomp-dev`, `libcap-ng-dev`, `pkg-config`, `clang`, `libclang-dev`) live only in that builder stage; only the runtime shared libs (`libseccomp2`, `libcap-ng0`) ship in the final image. The built binary is validated with `--version` at build time alongside `rtk`/`tokensave`, so a GLIBC/ABI mismatch fails the image build instead of surfacing at container start. Docker itself is deliberately not installed: this base image already ships Docker-in-Docker (`docker-ce`/`containerd.io` from Docker's own apt repo, started via the pre-existing `START_DOCKER` env var) — an initial attempt to also `apt-get install docker.io` broke the build, since Debian's package pulls in `containerd`/`runc`, which apt refuses to install alongside the base image's already-installed `containerd.io` (`Conflicts`). ## ubunturesolute-version-8208e985 (2026-07-21) - Update to latest version from linuxserver/docker-baseimage-selkies (changelog : https://github.com/linuxserver/docker-baseimage-selkies/releases) diff --git a/claude_desktop/Dockerfile b/claude_desktop/Dockerfile index 32c3c5f4f1..4874372a7c 100644 --- a/claude_desktop/Dockerfile +++ b/claude_desktop/Dockerfile @@ -104,9 +104,13 @@ RUN if [ ! -f /bin/sh ] && [ -f /usr/bin/sh ]; then ln -s /usr/bin/sh /bin/sh; f # Install Claude Desktop, Claude Code, Python tooling, and lightweight local validators. # gnome-keyring provides the Secret Service backend Electron safeStorage needs to persist # sign-in and dispatch grants. -# The cowork virtualization stack (qemu-system-x86 + ovmf firmware + docker.io) lets Claude -# Code launch its sandbox microVM; libseccomp2 and libcap-ng0 are the shared libraries the -# source-built virtiofsd daemon links against at runtime. +# The cowork virtualization stack (qemu-system-x86 + ovmf firmware) lets Claude Code launch +# its sandbox microVM; libseccomp2 and libcap-ng0 are the shared libraries the source-built +# virtiofsd daemon links against at runtime. Docker itself is NOT installed here: this base +# image already ships Docker-in-Docker (docker-ce + containerd.io from Docker's own apt repo, +# started via the pre-existing START_DOCKER env var) — installing Debian's docker.io package +# on top pulls in Debian's own containerd/runc, which apt refuses because they Conflict with +# the base image's already-installed containerd.io. RUN install -d -m 0755 /etc/apt/keyrings && \ curl -fsSLo /usr/share/keyrings/claude-desktop-archive-keyring.asc https://downloads.claude.ai/claude-desktop/key.asc && \ curl -fsSLo /etc/apt/keyrings/claude-code.asc https://downloads.claude.ai/keys/claude-code.asc && \ @@ -127,7 +131,6 @@ RUN install -d -m 0755 /etc/apt/keyrings && \ yamllint \ qemu-system-x86 \ ovmf \ - docker.io \ libseccomp2 \ libcap-ng0 && \ test -x /usr/bin/claude && \