Repository navigation
feat(harness): mount tool images read-only into the runtime - #3192
Open
QuentinBisson wants to merge 1 commit into
Open
QuentinBisson wants to merge 1 commit into
QuentinBisson wants to merge 1 commit into
Conversation
QuentinBisson
force-pushed
the
feat/harness-tool-images
branch
from
October 13, 2026 22:37
e86d376 to
7c8e5d9
Compare
github-actions
Bot
added
enhancement
Harness.spec.workload.toolImages lists digest-pinned OCI images. The controller adds one Substrate image volume per entry to the ActorTemplate, mounted read-only at /opt/kagent/tools/<name> for every runtime, and sets KAGENT_TOOL_PATHS to the colon-joined bin directories. Each managed runtime appends them to its own PATH after the image's binaries; the variable is reserved in Harness.spec.env. The Harness edit form keeps the field it does not author. Closes kagent-dev#3190 Signed-off-by: QuentinBisson <quentin@giantswarm.io>
QuentinBisson
force-pushed
the
feat/harness-tool-images
branch
from
October 13, 2026 22:48
7c8e5d9 to
5c3df66
Compare
QuentinBisson
marked this pull request as ready for review
October 13, 2026 23:14
QuentinBisson
requested review from
a team,
Charlesthebird and
supreme-gg-gg
as code owners
October 13, 2026 23:14
1 task done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Agents need CLIs their harness image does not ship (
go,kubectl,helm). Today that means an image builtFROMthe harness image, rebuilt for every release, or skills and plugins, which are capped at 100 MiB, never reachPATH, and land in every snapshot. #3190 has the full motivation.Change
Harness.spec.workload.toolImages[]lists digest-pinned OCI images. The controller adds one Substrate image volume per entry to the ActorTemplate, mounted read-only at/opt/kagent/tools/<name>, for every runtime. It setsKAGENT_TOOL_PATHSto the colon-joinedbin/directories instead ofPATH, since a templatePATHwould replace the image's; the Claude and Codex harnesses, the Go ADK and the Python ADK each append it to their ownPATHat start, so the image's binaries always win. The variable is reserved inspec.env, the list is capped at 16 entries and is part of revision identity, volume names carry atool-prefix so they cannot collide with the built-in volumes, and the Harness edit form in the UI keeps the field it does not author. Sandbox guests run in their own tools image and do not see the mounts. Docs describe the tool image contract (files under one prefix withbin/, static or musl-compatible binaries).This is a typed, digest-pinned list with a controller-fixed mount and environment contract, not a volume or container passthrough. Names, the mount path and the variable name are open to maintainer preference.
Closes #3190