feat: add kubernetes-agent-sandbox template to coder-labs

registry/coder-labs/templates/kubernetes-agent-sandbox/build/Dockerfile

@@ -0,0 +1,48 @@
+FROM codercom/enterprise-base:ubuntu
+
+ARG TARGETARCH=amd64
+ARG CODER_VERSION=
+ARG CODER_BINARY_URL=
+ARG INSTALL_CODE_SERVER=true
+ARG CODE_SERVER_VERSION=4.105.1
+ARG INSTALL_CLAUDE_CODE=true
+
+USER root
+
+# The Coder agent.
+RUN set -eu; \
+	if [ -n "${CODER_BINARY_URL}" ]; then \
+		curl -fsSL --retry 5 -o /usr/local/bin/coder "${CODER_BINARY_URL}"; \
+	elif [ -n "${CODER_VERSION}" ]; then \
+		v="${CODER_VERSION#v}"; \
+		curl -fsSL --retry 5 "https://github.com/coder/coder/releases/download/v${v}/coder_${v}_linux_${TARGETARCH}.tar.gz" \
+			| tar -xz -C /usr/local/bin ./coder; \
+	else \
+		echo "Set CODER_VERSION or CODER_BINARY_URL" >&2; exit 1; \
+	fi; \
+	chmod 755 /usr/local/bin/coder; \
+	/usr/local/bin/coder version
+
+# code-server, outside /home so a home volume does not hide it. The
+# code-server module uses it with offline = true.
+RUN set -eu; \
+	if [ "${INSTALL_CODE_SERVER}" = true ]; then \
+		curl -fsSL https://code-server.dev/install.sh \
+			| sh -s -- --method=standalone --prefix=/opt/code-server --version "${CODE_SERVER_VERSION}"; \
+	fi
+
+# Claude Code, outside /home for the same reason. The claude-code module
+# uses it with install_claude_code = false and claude_binary_path =
+# "/opt/claude/bin".
+RUN set -eu; \
+	if [ "${INSTALL_CLAUDE_CODE}" = true ]; then \
+		export HOME=/opt/claude; \
+		mkdir -p /opt/claude/bin; \
+		curl -fsSL https://claude.ai/install.sh | bash; \
+		ln -sf "$(readlink -f /opt/claude/.local/bin/claude)" /opt/claude/bin/claude; \
+		chmod -R a+rX /opt/claude; \
+		/opt/claude/bin/claude --version; \
+	fi
+
+USER coder
+WORKDIR /home/coder

registry/coder-labs/templates/kubernetes-agent-sandbox/cluster/example.tfvars

@@ -0,0 +1,31 @@
+# Copy this file to install.auto.tfvars and set your values. Terraform
+# loads *.auto.tfvars on its own, and `coder templates push` leaves it out.
+
+# The namespace for workspaces. Terraform creates it.
+namespace = "coder-workspaces"
+
+# The image you built from build/Dockerfile, with a fixed tag or a digest.
+workspace_image = "registry.example.com/coder/workspace:v2.30.0"
+
+# The Coder access URL. Optional: each workspace passes its own access URL
+# to the pool. Set it if Coder is not on port 443, or with coder_host_ip.
+# coder_access_url = "https://coder.example.com"
+
+# The IP ranges of the Coder server, as workspaces see it. Fully isolated
+# workspaces can reach only these. Use the IP of the load balancer or
+# ingress behind coder_access_url, for example the output of
+# `dig +short coder.example.com`, with /32 for one address.
+coder_egress_cidrs = ["203.0.113.10/32"]
+
+# Fully isolated blocks DNS. If coder_access_url uses a host name, set the
+# Coder server IP so the pools can resolve it.
+# coder_host_ip = "203.0.113.10"
+
+# Offer only the runtimes that your nodes have. See "Install the runtimes".
+# runtimes = ["gvisor", "kata-qemu", "kata-clh"]
+
+# A public repository that GitHub only pools clone while they wait.
+# git_repo_url = "https://github.com/coder/coder"
+
+# Amazon EKS with VPC CNI v1.21.1 or later only.
+# enable_guardrail = true