From claudeclaw
Switches ClaudeClaw container runtime from Docker to Apple Container for macOS-native isolation. Merges git branch with runtime binary, mount syntax, and test updates.
npx claudepluginhub sbusso/claudeclawThis skill uses the workspace's default tool permissions.
This skill switches ClaudeClaw's container runtime from Docker to Apple Container (macOS-only). It uses the skills engine for deterministic code changes, then walks through verification.
Conducts multi-round deep research on GitHub repos via API and web searches, generating markdown reports with executive summaries, timelines, metrics, and Mermaid diagrams.
Dynamically discovers and combines enabled skills into cohesive, unexpected delightful experiences like interactive HTML or themed artifacts. Activates on 'surprise me', inspiration, or boredom cues.
Generates images from structured JSON prompts via Python script execution. Supports reference images and aspect ratios for characters, scenes, products, visuals.
This skill switches ClaudeClaw's container runtime from Docker to Apple Container (macOS-only). It uses the skills engine for deterministic code changes, then walks through verification.
What this changes:
docker → container-v path:path:ro → --mount type=bind,source=...,target=...,readonlydocker info → container system status (with auto-start)docker ps --filter → container ls --format jsondocker → container.env shadowing via mount --bind inside the container (Apple Container only supports directory mounts, not file mounts like Docker's /dev/null overlay)mount --bind, then drop privileges via setprivWhat stays the same:
--user flag)Verify Apple Container is installed:
container --version && echo "Apple Container ready" || echo "Install Apple Container first"
If not installed:
.pkg filecontainer --versionApple Container requires macOS. It does not work on Linux.
grep "CONTAINER_RUNTIME_BIN" src/orchestrator/container-runtime.ts
If it already shows 'container', the runtime is already Apple Container. Skip to Phase 3.
git remote -v
If upstream is missing, add it:
git remote add upstream https://github.com/sbusso/claudeclaw.git
git fetch upstream skill/apple-container
git merge upstream/skill/apple-container
This merges in:
src/orchestrator/container-runtime.ts — Apple Container implementation (replaces Docker)src/container-runtime.test.ts — Apple Container-specific testssrc/orchestrator/container-runner.ts — .env shadow mount fix and privilege droppingsrc/runtimes/docker/Dockerfile — entrypoint that shadows .env via mount --bindsrc/runtimes/docker/build.sh — default runtime set to containerIf the merge reports conflicts, resolve them by reading the conflicted files and understanding the intent of both sides.
npm test
npm run build
All tests must pass and build must be clean before proceeding.
container system status || container system start
./src/runtimes/docker/build.sh
echo '{}' | container run -i --entrypoint /bin/echo claudeclaw-agent:latest "Container OK"
mkdir -p /tmp/test-ro && echo "test" > /tmp/test-ro/file.txt
container run --rm --entrypoint /bin/bash \
--mount type=bind,source=/tmp/test-ro,target=/test,readonly \
claudeclaw-agent:latest \
-c "cat /test/file.txt && touch /test/new.txt 2>&1 || echo 'Write blocked (expected)'"
rm -rf /tmp/test-ro
Expected: Read succeeds, write fails with "Read-only file system".
mkdir -p /tmp/test-rw
container run --rm --entrypoint /bin/bash \
-v /tmp/test-rw:/test \
claudeclaw-agent:latest \
-c "echo 'test write' > /test/new.txt && cat /test/new.txt"
cat /tmp/test-rw/new.txt && rm -rf /tmp/test-rw
Expected: Both operations succeed.
Service name: Derived from the directory name:
com.claudeclaw.<dirname>(macOS) /claudeclaw-<dirname>(Linux). For example, if cwd ismy-assistant, the service iscom.claudeclaw.my-assistant. Determine the correct service name before running service commands below.
npm run build
launchctl kickstart -k gui/$(id -u)/com.claudeclaw
Send a message via WhatsApp and verify the agent responds.
Apple Container not found:
.pkg filecontainer --versionRuntime won't start:
container system start
container system status
Image build fails:
# Clean rebuild — Apple Container caches aggressively
container builder stop && container builder rm && container builder start
./src/runtimes/docker/build.sh
Container can't write to mounted directories: Check directory permissions on the host. The container runs as uid 1000.
| File | Type of Change |
|---|---|
src/orchestrator/container-runtime.ts | Full replacement — Docker → Apple Container API |
src/container-runtime.test.ts | Full replacement — tests for Apple Container behavior |
src/orchestrator/container-runner.ts | .env shadow mount removed, main containers start as root with privilege drop |
src/runtimes/docker/Dockerfile | Entrypoint: mount --bind for .env shadowing, setpriv privilege drop |
src/runtimes/docker/build.sh | Default runtime: docker → container |