actions/sindri
actions/sindri
2
0
Fork 0
Code Issues 2 Pull requests Releases 16 Packages 1 Activity Actions
16 releases 18 tags
  • 26.43.0 71e36c7918

    26.43.0
    All checks were successful
    / docker-tag-ci (push) Successful in 4m11s
    Details
    / docker-tag-coder (push) Successful in 12m35s
    Details
    / docker-tag-coder-xfce-vnc (push) Successful in 23m21s
    Details
    Stable

    claude-bot released this 2026-10-23 10:23:26 +00:00 | 0 commits to master since this release

    What's new in 26.43.0

    Every variant now ships the Google Cloud CLI and Terraform, so CI jobs and
    workspaces can use gcloud and terraform without installing them first.

    Google Cloud CLI and Terraform in the base image (#34)

    Installs google-cloud-cli (gcloud, gsutil, bq) and terraform
    from Google's and HashiCorp's official APT repos in the base stage, so the
    ci, coder and coder-xfce-vnc variants all ship them. As with the other
    third-party repos, the build checks each signing key's fingerprint before
    trusting it, and checks that both tools run. Every build picks up the latest
    release of both (gcloud 590.0.0 and Terraform 1.17.0 today).

    • gcloud components: gcloud components install is disabled for APT
      installs. Add components with apt-get instead, for example
      sudo apt-get install google-cloud-cli-gke-gcloud-auth-plugin in a
      workspace.
    • Image size: every variant is about 440 MB larger, mostly the Python
      runtime bundled with google-cloud-cli.

    Full changelog: 26.42.1...26.43.0

    Downloads
  • 26.42.1 87e8c08bcb

    26.42.1
    All checks were successful
    / docker-tag-ci (push) Successful in 3m5s
    Details
    / docker-tag-coder (push) Successful in 4m7s
    Details
    / docker-tag-coder-xfce-vnc (push) Successful in 10m20s
    Details
    Stable

    claude-bot released this 2026-10-16 18:41:10 +00:00 | 1 commits to master since this release

    What's new in 26.42.1

    Every variant now ships kustomize, so CI jobs can render a kustomization
    and lint what Argo CD applies.

    kustomize in the base image (#32)

    Installs kustomize v5.8.2 as a pinned prebuilt binary in the base
    stage, next to kubeconform and kube-linter, so the ci, coder and
    coder-xfce-vnc variants all ship it. The build checks that it runs.

    Repositories that generate their ConfigMaps and Secrets with
    configMapGenerator/secretGenerator can now lint the rendered output:

    kustomize build . > /tmp/rendered.yaml
kubeconform -strict -ignore-missing-schemas -summary /tmp/rendered.yaml
kube-linter lint /tmp/rendered.yaml

    kubectl is still not in the image; update-k8s-tools installs it in a
    workspace as before.

    To upgrade, bump KUSTOMIZE_VERSION in the Dockerfile.

    Full changelog: 26.42.0...26.42.1

    Downloads
  • 26.42.0 781e3c04b6

    26.42.0
    All checks were successful
    / docker-tag-ci (push) Successful in 3m18s
    Details
    / docker-tag-coder (push) Successful in 4m12s
    Details
    / docker-tag-coder-xfce-vnc (push) Successful in 10m7s
    Details
    Stable

    claude-bot released this 2026-10-12 15:43:13 +00:00 | 2 commits to master since this release

    What's new in 26.42.0

    The desktop variant now ships the Nextcloud desktop client, which starts with the desktop and stays logged in across workspace restarts.

    Nextcloud desktop client in coder-xfce-vnc (#31)

    The desktop variant now includes the Nextcloud desktop client, installed from Nextcloud's official PPA (ppa:nextcloud-devs/client), so every build gets the current upstream release (34.0.5 today). Ubuntu's own package is stuck at 3.11 from late 2023. As with the other third-party repos, the build checks the signing key's fingerprint before trusting it.

    • First use: click the Nextcloud icon in the system tray, enter your server address, and log in through Firefox. Files sync to ~/Nextcloud on the PVC, so they count against its size. Use Choose what to sync to limit what gets downloaded.
    • Auto-start: coder-init-desktop turns it on once per home directory. To turn it off, untick Launch on system startup in the client's settings; it stays off.
    • Stays logged in: the client keeps its login in the system keyring and, unlike JetBrains Toolbox, has no fallback to a plain file. The image therefore ships KWallet, KDE's keyring, which runs without a KDE desktop and with nothing from GNOME. At session start, the new kwallet-unlock script creates and unlocks the wallet with an empty password, silently.

    ⚠️ What KWallet changes for you

    • Security: with an empty password, the wallet (~/.local/share/kwalletd/) is only as protected as the PVC it sits on. That's the same level as Toolbox's own .securestorage file. If you want a real password, set one on the wallet (for example with kwalletmanager5 after sudo apt install kwalletmanager). The session then leaves the wallet locked, and KWallet asks for the password the first time an app needs it.
    • Other apps can use it too: the session now offers a standard keyring (the freedesktop Secret Service) to every app, not just Nextcloud. Apps that look for one on XFCE may start keeping their secrets in KWallet. That includes Electron apps such as Claude Desktop and Freelens. Data they saved before should stay readable.
    • Image size: the desktop image is about 550 MB larger, mostly Qt 6 and the browser engine built into the Nextcloud client.
    • Two new stage-wide variables, QTWEBENGINE_DISABLE_SANDBOX=1 and QTWEBENGINE_CHROMIUM_FLAGS=--disable-dev-shm-usage, apply the same pod workarounds the Electron apps already get to the client's embedded browser engine.

    Full details are in the README's Nextcloud Desktop Client section.

    Full changelog: 26.37.0...26.42.0

    Downloads
  • 26.37.0 13272e2efd

    26.37.0
    All checks were successful
    / docker-tag-ci (push) Successful in 3m50s
    Details
    / docker-tag-coder (push) Successful in 4m29s
    Details
    / docker-tag-coder-xfce-vnc (push) Successful in 9m19s
    Details
    Stable

    claude-bot released this 2026-09-11 09:32:10 +00:00 | 3 commits to master since this release

    What's new in 26.37.0

    Freelens replaces Lens in the desktop variant, the images now install Ubuntu packages from the France mirror, python3 -m venv works out of the box, and two fixes for the coder-xfce-vnc build.

    ⚠️ Ubuntu packages now come from the France mirror (#29)

    This changes the published images. They now use http://fr.archive.ubuntu.com/ubuntu instead of archive.ubuntu.com and security.ubuntu.com, for both the regular archive and security updates. It applies at build time, to apt-get inside containers and workspaces, and to images built FROM Sindri.

    Why: on 2026-09-11 Canonical's main archive went down. Every apt-get stalled, the desktop build went from about 10 minutes to 48, and a release couldn't wait for it to recover. Country mirrors run on separate hosts and kept working.

    What it means for you:

    • Integrity is unchanged: APT still checks every package list against Ubuntu's archive signing key.
    • Security updates can arrive later: the mirror can lag security.ubuntu.com by a few hours.
    • Check which mirror an image uses: docker inspect label com.van-hemmen.sindri.ubuntu-mirror, or grep '^URIs:' /etc/apt/sources.list.d/ubuntu.sources.
    • Choose another mirror when building: --build-arg UBUNTU_MIRROR=http://<cc>.archive.ubuntu.com/ubuntu. An empty value (--build-arg UBUNTU_MIRROR=) keeps Ubuntu's stock sources.
    • Restore the stock sources in an existing image: Ubuntu's original file is kept at /usr/share/sindri/ubuntu.sources.orig.
      • In a derived image: cp /usr/share/sindri/ubuntu.sources.orig /etc/apt/sources.list.d/ubuntu.sources
      • In a workspace: the same command with sudo. /etc isn't on the PVC, so add it to a Coder startup_script to keep it across restarts.

    Full details are in the README's Ubuntu Package Mirror section.

    Freelens replaces Lens in coder-xfce-vnc (#23)

    The desktop variant now ships Freelens, the MIT-licensed community fork of OpenLens, instead of proprietary Lens. It installs from Freelens's official APT repository, and the build checks the signing key's fingerprint before trusting it. Every build picks up the latest Freelens release.

    Freelens launches the same way Lens did: through /usr/local/bin/freelens and a menu entry under Development, with the settings Electron apps need in an unprivileged pod (ELECTRON_DISABLE_SANDBOX=1, --disable-dev-shm-usage).

    If you used Lens in an existing workspace:

    • Freelens stores its data in ~/.config/Freelens/, not ~/.config/Lens/, so clusters added in Lens need to be added again. ~/.kube/config is read as usual.
    • lens-desktop and its wrapper are gone. coder-init-desktop no longer tidies stale Lens menu entries.

    python3-venv in every variant (#22)

    The base image now includes python3-venv, so python3 -m venv works in ci, coder and coder-xfce-vnc. Firebase Python deploys and CI jobs no longer need to apt-get install python3-venv themselves.

    Fixes

    • coder-xfce-vnc build (#25): Nimbalyst 0.36 renamed the files inside its AppImage (@nimbalystelectron → nimbalyst), which broke the build with no error message. The build uses the new names, and if a file goes missing it now says which one and lists the bundle's contents.
    • Image publishing (#27): CI now pushes images to Forgejo's in-cluster registry service instead of through the public ingress, which cut large layer uploads off after 60 seconds (502 Bad Gateway). This needs actions/kaniko 26.37.0 (new REGISTRY_INSECURE setting). Image names don't change: pull from git.van-hemmen.com/actions/sindri:<tag> as before.

    Full changelog: 26.30.0...26.37.0

    Downloads
  • 26.30.0 018739bd48

    26.30.0
    All checks were successful
    / docker-tag-ci (push) Successful in 5m39s
    Details
    / docker-tag-coder (push) Successful in 6m15s
    Details
    / docker-tag-coder-xfce-vnc (push) Successful in 24m15s
    Details
    Stable

    GuillaumeHemmen released this 2026-07-24 07:12:28 +00:00 | 8 commits to master since this release

    What's new in 26.30.0

    A build-breaking upstream package rename fixed by moving Claude Desktop to Anthropic's official APT repo, plus Kubernetes manifest QA tooling in every variant.

    Claude Desktop now installs from Anthropic's official APT repo (#19)

    Anthropic released an official Claude Desktop for Linux beta and took the claude-desktop package name with it. The community claude-desktop-debian repack this image used therefore renamed itself to claude-desktop-unofficial, leaving claude-desktop behind as a transitional dummy — so apt-get install claude-desktop kept succeeding while every path the build asserted had moved. This broke the coder-xfce-vnc build on every branch from 2026-07-22.

    The coder-xfce-vnc variant now installs Anthropic's official package — same upstream app at the same version (1.24012.0), one fewer third-party repo — with the published signing-key fingerprint asserted before the key is trusted.

    Because Anthropic's deb symlinks /usr/bin/claude-desktop straight to the bundled Electron binary, where the community repack shipped a shell launcher, /usr/local/bin/claude-desktop is now the only place the unprivileged-pod settings (ELECTRON_DISABLE_SANDBOX=1, --disable-dev-shm-usage) get applied. The desktop-entry override follows upstream's com.anthropic.Claude.desktop, and its New chat / New Claude Code session actions are wrapper-routed too.

    Workspaces on a long-lived PVC self-heal: coder-init-desktop.sh now parks stale user-local entries under all three known names (claude-desktop.desktop, claude-desktop-unofficial.desktop, com.anthropic.Claude.desktop).

    Linux support is an Anthropic-labelled beta: no Computer Use, no dictation, Debian-based distributions only.

    kubeconform + kube-linter in the base image (#18)

    Installs kubeconform (manifest schema validation) and kube-linter (lint) as pinned prebuilt binaries in the base stage, so the ci, coder, and coder-xfce-vnc variants all ship them. This replaces a per-job actions/setup-go + go install …@latest — a Go-toolchain download plus a from-source compile of each tool on every run — with binaries present at job start.

    Full changelog: 26.25.1...26.30.0

    Downloads
  • 26.25.1 80b73d32e7

    26.25.1
    All checks were successful
    / docker-tag-coder (push) Successful in 4m41s
    Details
    / docker-tag-ci (push) Successful in 5m58s
    Details
    / docker-tag-coder-xfce-vnc (push) Successful in 16m10s
    Details
    Stable

    GuillaumeHemmen released this 2026-06-21 18:57:28 +00:00 | 10 commits to master since this release

    What's new in 26.25.1

    The Firebase CLI is now available in every variant.

    Firebase CLI (#16)

    Installs firebase-tools (the standalone binary, which bundles its own Node runtime) in the base stage, so the ci, coder, and coder-xfce-vnc variants all ship the firebase command. Combined with the Azul Zulu JDK already in the base, this enables firebase deploy and the Firebase Emulator Suite (for example Firestore security-rules unit-testing) in CI — no separate image needed.

    Full changelog: 26.25.0...26.25.1

    Downloads
  • 26.25.0 8d7cc385f6

    26.25.0
    All checks were successful
    / docker-tag-coder (push) Successful in 3m9s
    Details
    / docker-tag-ci (push) Successful in 3m25s
    Details
    / docker-tag-coder-xfce-vnc (push) Successful in 8m44s
    Details
    Stable

    GuillaumeHemmen released this 2026-06-20 14:58:49 +00:00 | 11 commits to master since this release

    What's new in 26.25.0

    Two applications added to the coder-xfce-vnc desktop variant, plus an XFCE menu tidy-up.

    Nimbalyst (#13)

    Bundles Nimbalyst — a visual workspace for building with Codex, Claude Code, and more. Upstream ships only a Linux AppImage, which can't self-mount via FUSE in an unprivileged pod (no CAP_SYS_ADMIN), so the build pulls the always-latest release and pre-extracts it to /opt/nimbalyst, then routes every launch through /usr/local/bin/nimbalyst (applying ELECTRON_DISABLE_SANDBOX=1, --disable-dev-shm-usage, and APPDIR=/opt/nimbalyst).

    LibreOffice (#14)

    Installs the LibreOffice suite (Writer, Calc, Impress, Draw, Base, Math) plus libreoffice-gtk3 for native GTK rendering under XFCE, and the English (US + GB) and French Hunspell spell-check dictionaries.

    XFCE menu

    Lens, Claude Desktop, and Nimbalyst now appear under the Development category (previously Network / Office / Utility).

    Full changelog: 26.24.2...26.25.0

    Downloads
  • 26.24.2 eb65649f42

    26.24.2
    All checks were successful
    / docker-tag-ci (push) Successful in 3m36s
    Details
    / docker-tag-coder (push) Successful in 4m7s
    Details
    / docker-tag-coder-xfce-vnc (push) Successful in 8m15s
    Details
    Stable

    GuillaumeHemmen released this 2026-06-11 16:15:27 +00:00 | 13 commits to master since this release

    This release includes:

    • Claude Desktop pre-installed in the xcfe variant, from the community claude-desktop-debian APT repo, launched through a wrapper applying the flags Electron apps need in unprivileged Kubernetes pods — menu, terminal, and claude:// URL launches alike
    • coder-init-desktop now parks stale user-local Claude Desktop menu entries left by manual installs from before the image shipped it (#12)
    Downloads
  • 26.24.1 b5bb798bce

    26.24.1
    All checks were successful
    / docker-tag-ci (push) Successful in 3m47s
    Details
    / docker-tag-coder (push) Successful in 4m25s
    Details
    / docker-tag-coder-xfce-vnc (push) Successful in 8m31s
    Details
    Stable

    GuillaumeHemmen released this 2026-06-11 15:12:52 +00:00 | 14 commits to master since this release

    This release includes:

    • Fix: Electron apps (Lens, Claude Desktop, ...) now launch in the xcfe variant on unprivileged Kubernetes pods — the Chromium sandbox cannot work there (RuntimeDefault seccomp, no CAP_SYS_ADMIN), so it is disabled image-wide via ELECTRON_DISABLE_SANDBOX=1, and Lens is routed through a wrapper adding --disable-dev-shm-usage for the 64 MiB /dev/shm
    • Fix: dead jetbrains-toolbox symlink in /usr/local/bin (Toolbox 2.x keeps the binary under bin/)
    • coder-init-desktop now heals stale user-local Lens menu entries carried over on the PVC

    Full diagnosis in the README section "Electron & Chromium-based apps" (#11)

    Downloads
  • 26.24.0 c0b0a96921

    26.24.0
    All checks were successful
    / docker-tag-ci (push) Successful in 3m4s
    Details
    / docker-tag-coder (push) Successful in 3m33s
    Details
    / docker-tag-coder-xfce-vnc (push) Successful in 6m51s
    Details
    Stable

    GuillaumeHemmen released this 2026-06-08 19:47:18 +00:00 | 15 commits to master since this release

    This release includes:

    • k8s tooling for the coder variant
    • lens k8s IDE for the xcfe variant
    Downloads