JanWelker

Agent Mooring — DevOps skill for Claude Code

DevOps community

Container image and Helm chart for long-running Claude Code agents on Kubernetes, reachable over SSH and Remote Control.

How to install Agent Mooring

This entry records only its repository, not the path inside it, so there is no exact command to give. Open JanWelker/agent-mooring and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Agent Mooring does

Container image and Helm chart for long-running Claude Code agents on Kubernetes, reachable over SSH and Remote Control.

Alternatives in DevOps

Cheetahclaws — CheetahClaws: A Fast and Easy-to-Use Agent Harness Infrastructure for Long-Horizon, Multi-Model, and Tool-Usin 768 ★
Helm Conductor — Use the @helm-conductor agent to orchestrate the engineering cycle — sequence features, decide what to work on 523 ★
MCP SSH Manager — MCP SSH Server: 37 tools for remote SSH management Claude Code & OpenAI Codex DevOps automation, backups, data 460 ★

README

agent-mooring

A mooring keeps a boat where you left it. This one is for coding agents.

Laptops sleep, terminals close, and the agent that was halfway through a refactor goes down with them. Tie it up in your cluster instead: it stays afloat through restarts, keeps its conversation, and is still there in the morning, wherever you row out to it from. No knots required.

A container image and Helm chart that run [Claude Code](https://code.claude.com) as a long-running agent on Kubernetes. One release is one session: a pod with Claude Code in tmux, reachable over SSH through a Gateway API `TLSRoute` and from claude.ai/code through Remote Control.

ssh -> openssl s_client -> :443 Gateway (TLS passthrough, SNI .ssh.wlkr.ch)
    -> Service :2222 -> tls sidecar (socat, cert-manager certificate) -> sshd 127.0.0.1:2223

Artifact	Reference
Image	`ghcr.io/janwelker/agent-mooring:[-]` (amd64, arm64)
Chart	`oci://ghcr.io/janwelker/charts/agent-mooring`

A release workflow checks npm every hour. Each new Claude Code version gets an image tagged with that version and a chart whose `appVersion` is that version, so an instance only ever bumps the chart version. A change to `Dockerfile`, `rootfs/` or `chart/` merged to `main` is released at once as a new build of the current version, `-2`, `-3` and so on; no tag is ever pushed twice.

The image is pushed by digest and tagged only after a smoke test and a Trivy scan that fails on any fixable CRITICAL finding; fixable HIGH and CRITICAL findings are listed in the release notes. The image carries SLSA provenance and an SBOM, and image and chart are signed with cosign, keyless:

cosign verify ghcr.io/janwelker/agent-mooring: \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github.com/JanWelker/agent-mooring/\.github/workflows/release\.yml@'