sbx/claude-ollama-kit:latest

schemaVersion: "2"
kind: sandbox
name: claude-ollama
displayName: Claude Code (Ollama)
description: Claude Code wired to Ollama Anthropic-compatible API, with configurable model.
sandbox:
    image: docker.io/sbx/claude-image:latest
    entrypoint:
        - /home/agent/.local/bin/claude-ollama
agentInstructions:
    filename: CLAUDE.md
    content: |
        ## Sandbox environment

        You are running inside a Docker sandbox. All API calls are routed to a local
        Ollama instance on the host (http://host.docker.internal:11434) — Anthropic's
        API is not reachable. The workspace is mounted at its absolute host path.
        `sudo` is passwordless; use it for package installs.
permissions:
    network:
        allow:
            - host.docker.internal:11434
environment:
    variables:
        CLAUDE_OLLAMA_MODEL: gemma4:e4b-it-q4_K_M
setup:
    install:
        - command: |
            set -e
            ws="${WORKSPACE_DIR:-/}"
            esc=$(printf '%s' "$ws" | sed 's/\\/\\\\/g; s/"/\\"/g; s/\t/\\t/g; s/\r/\\r/g')
            projects="\"/\": { \"hasTrustDialogAccepted\": true }"
            [ "$ws" = "/" ] || projects="$projects, \"$esc\": { \"hasTrustDialogAccepted\": true }"
            printf '%s\n' "{
              \"bypassPermissionsModeAccepted\": true,
              \"hasCompletedOnboarding\": true,
              \"hasSeenAutoDefaultNudge\": true,
              \"projects\": { $projects }
            }" > /home/agent/.claude.json
            chown agent:agent /home/agent/.claude.json
          user: "0"
          description: Seed Claude bypass/trust flags (root; overwrites image-shipped file)
        - command: |
            set -e
            mkdir -p /home/agent/.claude
            if [ ! -f /home/agent/.claude/settings.json ]; then
              HELPER=''
              if [ "${SBX_CRED_ANTHROPIC_MODE:-none}" = apikey ]; then
                HELPER='  "apiKeyHelper": "echo proxy-managed",
            '
              fi
              printf '%s' "{
              \"themeId\": 1,
              \"alwaysThinkingEnabled\": true,
            ${HELPER}  \"permissions\": { \"defaultMode\": \"bypassPermissions\" },
              \"bypassPermissionsModeAccepted\": true,
              \"skipDangerousModePermissionPrompt\": true
            }
            " > /home/agent/.claude/settings.json
            fi
            # Enumerated, not recursive: ~/.claude holds runtime-managed content
            # this kit doesn't own, so `chown -R` on the parent would take
            # ownership of paths outside the kit's control.
            chown agent:agent /home/agent/.claude /home/agent/.claude/settings.json
          user: root
          description: Seed Claude settings.json (none path; no credential service)
    files:
        - path: /home/agent/.local/bin/claude-ollama
          content: |
            #!/usr/bin/env bash
            set -euo pipefail

            export ANTHROPIC_AUTH_TOKEN="ollama"
            unset ANTHROPIC_API_KEY
            export ANTHROPIC_BASE_URL="http://host.docker.internal:11434"

            export ANTHROPIC_DEFAULT_OPUS_MODEL="$CLAUDE_OLLAMA_MODEL"
            export ANTHROPIC_DEFAULT_SONNET_MODEL="$CLAUDE_OLLAMA_MODEL"
            export ANTHROPIC_DEFAULT_HAIKU_MODEL="$CLAUDE_OLLAMA_MODEL"
            export CLAUDE_CODE_SUBAGENT_MODEL="$CLAUDE_OLLAMA_MODEL"

            exec claude "$@"
          mode: "0755"
          description: Wrapper script that routes Claude Code to the local Ollama instance