docker-customize

Docker Customize

Land a container change in the first channel that can carry it, in the order below. Files sit on the project bind mount, so this skill runs from inside the container or on the host. Rebuild, restart, and compose validation are host-only (the image has no Docker CLI): name the command for the operator, do not run it from inside the container.

1. Apt package

The container runs as USER claude with cap_drop: ALL and no-new-privileges, so nothing installs a package at runtime. It has to be in the image.

Add it inside the operator block of Dockerfile.hermit (between # --- operator: and # --- end operator ---):

RUN apt-get update && apt-get install -y --no-install-recommends \
      <pkg> <pkg> && \
    rm -rf /var/lib/apt/lists/*

A Dockerfile rendered before the operator block existed has no such markers. Add the block yourself, between the gh install layer and the # Match host UID comment, then put the RUN inside it:

# --- operator: root-context installs go here; upgrades merge around this block ---
#
# --- end operator ---

Then rebuild on the host: .claude-code-hermit/bin/hermit-docker restart --build (it needs the container running; from stopped, .claude-code-hermit/bin/hermit-docker up --build).

Tell the operator: docker.packages in config.json is read only when the templates are rendered, so setting it installs nothing on its own. Re-check the file after an upgrade.

2. Boot-time shell

If a shell can do it at boot, put it in <project-root>/docker-entrypoint.hermit-local.sh. Persist files under .claude.local/ (bind-mounted, gitignored). Upgrades never touch the sidecar.

The managed entrypoint sources the sidecar twice, with HERMIT_ENTRY_PHASE naming which:

• pre-boot: channel dirs exist, env resolved, before plugins install. Env, directories, downloads, pip / npm -g, pre-session checks.
• pre-launch: immediately before hermit-start. Side services, last-second overrides.