Agentbox — Development skill for Claude Code

agentbox

A **confined** Ubuntu container for running **Claude Code**, **Codex**, and **GitHub CLI** (`gh`), with the tooling an agent needs: `git`, `jj`, `ssh`, `uv`, `just`, `ripgrep`, `jq`, `tmux`, `rustup` (stable toolchain) + `cargo-sweep`, and **nested Docker** for running CI tooling. There is deliberately **no system python** — use `uv run python`.

This README is mounted read-only at `~/README.md` inside containers started by `ab`. Software running in the outer container can identify it by checking the root-owned `/etc/agentbox/identity` file, whose contents include `agentbox=1` and the image version.

Nested Docker is provided by **[Sysbox]**: the container is launched with `docker run --runtime=sysbox-runc`, and the inner Docker daemon runs **rootful inside the container** while Sysbox isolates it from the host.

Confinement model

This container is a security boundary, so nested Docker runs under **Sysbox** rather than privileged DinD:

• No --privileged. The outer container carries zero capabilities — Sysbox needs no caps, no seccomp relaxation, no devices. The run flags are just --runtime=sysbox-runc and --init (the latter inserts docker's bundled tini as PID 1 purely to reap the entrypoint's backgrounded children — it grants no capability, so the confinement is unchanged).
• The inner dockerd runs as root inside the container, but Sysbox confines it (container-root ≠ host-root), so a breakout — or the nested containers themselves — never reaches the host.
• No host Docker socket is mounted; nested Docker is fully self-contained.
• Tooling (claude/codex/bash) runs as the unprivileged agentbox user (uid matching your host uid); only the inner dockerd (and the tini init that --init runs as PID 1) run as root-in-container.

Host prerequisite: install Sysbox

Sysbox must be installed and registered as a docker runtime on the host. It needs a root syst