From 749a9e816dccd2e1b8c57cc887ad2c58202d4823 Mon Sep 17 00:00:00 2001
From: Ian Tangney <ian.tangney@kasm.com>
Date: Thu, 30 Apr 2026 23:26:28 +0000
Subject: [PATCH 01/10] KASM-8210 ci: pin BASE_TAG to KASM-8210 core feature
 branch + USE_PRIVATE_IMAGES=1 for 1.19.0

---
 .gitlab-ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 047a28d..b591677 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -8,8 +8,8 @@ stages:
   - template
   - run
 variables:
-  BASE_TAG: "develop"
-  USE_PRIVATE_IMAGES: 0
+  BASE_TAG: "feature_KASM-8210_bump_dep_versions_for_1_19_0"
+  USE_PRIVATE_IMAGES: 1
   KASM_RELEASE: "1.18.0"
   TEST_INSTALLER: "https://kasm-static-content.s3.amazonaws.com/kasm_release_1.18.0.09f70a.tar.gz"
   MIRROR_ORG_NAME: "kasmtech"

From cf46ee4c89e79ede2bf771456e5bc5d160ec7f12 Mon Sep 17 00:00:00 2001
From: Ian Tangney <ian.tangney@kasm.com>
Date: Mon, 4 May 2026 14:02:00 +0000
Subject: [PATCH 02/10] KASM-8210 add CLAUDE.md for workspaces-images

---
 CLAUDE.md | 87 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 87 insertions(+)
 create mode 100644 CLAUDE.md

diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..f991155
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,87 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+Workspaces Images is the catalog of pre-built Kasm workspace images (applications and full desktops) published to DockerHub and Quay. Each image layers application-specific install scripts on top of a base image from [workspaces-core-images](https://gitlab.com/kasm-technologies/internal/workspaces-core-images).
+
+## Repository Layout
+
+```
+dockerfile-kasm-<name>      # Flat Dockerfile per image at repo root
+src/
+  ubuntu/install/<app>/     # Install scripts for Ubuntu-based images
+  common/                   # Shared scripts used across distros
+  alpine/, opensuse/, ...   # Distro-specific install scripts
+ci-scripts/
+  template-vars.yaml        # Image manifest: name, base, dockerfile, changeFiles, runset
+  template-gitlab.py        # Generates gitlab-ci.yml from template-vars.yaml
+  build.sh                  # Builds + pushes to cache registry
+  test.sh                   # Runs post-build smoke tests via AWS/curl
+  manifest.sh               # Creates and pushes multi-arch manifests
+  weekly-manifest.sh        # Scheduled rolling-tag manifest updates
+```
+
+## Building Images Locally
+
+```bash
+# Build a single image (run from repo root)
+sudo docker build -t kasmweb/firefox:dev -f dockerfile-kasm-firefox .
+
+# Run it locally
+sudo docker run --rm -it --shm-size=512m -p 6901:6901 -e VNC_PW=password kasmweb/firefox:dev
+# Access via browser: https://<IP>:6901  (user: kasm_user, password: password)
+```
+
+The `BASE_TAG` build arg controls which core image tag is pulled (default: `develop`). Override with `--build-arg BASE_TAG=<tag>` to build against a specific core release.
+
+## Adding a New Image
+
+1. Create `dockerfile-kasm-<name>` at the repo root. Use an existing dockerfile as a template — the pattern is:
+   - Set `ARG BASE_IMAGE` / `ARG BASE_TAG` and `FROM kasmweb/$BASE_IMAGE:$BASE_TAG`
+   - Add install scripts under `src/<distro>/install/<name>/`
+   - Copy scripts into `$INST_SCRIPTS`, run them, then delete them
+   - Fix ownership with `chown 1000:0 $HOME` and run `set_user_permission.sh`
+   - End with `USER 1000`
+
+2. Add an entry to `ci-scripts/template-vars.yaml`:
+   ```yaml
+   - name: <name>
+     runset: set-a          # or set-b — distributes load across CI run sets
+     singleapp: true        # false for full desktop images
+     base: core-ubuntu-jammy  # or core-ubuntu-noble, core-debian-bookworm, etc.
+     dockerfile: dockerfile-kasm-<name>
+     changeFiles:
+       - dockerfile-kasm-<name>
+       - src/ubuntu/install/<name>/**
+   ```
+
+3. The CI pipeline is generated — do **not** edit `gitlab-ci.yml` directly; edit `template-vars.yaml` and `template-gitlab.py` instead.
+
+## CI/CD
+
+The pipeline runs in two stages:
+
+1. **template** — `template-gitlab.py` reads `template-vars.yaml` and generates `gitlab-ci.yml` as a CI artifact.
+2. **run** — triggers a child pipeline from the generated `gitlab-ci.yml`.
+
+Key CI variables (set in GitLab or pipeline triggers):
+- `BASE_TAG` — core image tag to build against (default: `develop`)
+- `USE_PRIVATE_IMAGES` — set to `1` to pull from private registry
+- `KASM_RELEASE` — release version string for test installer
+- `RUN_SET` — restrict CI to `set-a` or `set-b` image subsets
+- `MIRROR_ORG_NAME` — DockerHub org for mirror pushes (default: `kasmtech`)
+
+On `develop` and `release/*` branches, images are pushed publicly to DockerHub and Quay. Feature branches push only to an internal cache registry tagged `<arch>-<name>-<branch>-<pipeline_id>`.
+
+## Image Naming Conventions
+
+- Single-app images use `singleapp: true` and strip the XFCE panel for a focused UI.
+- Desktop images (`singleapp: false`) ship the full XFCE desktop environment.
+- Base image names follow `core-<distro>-<codename>` (e.g. `core-ubuntu-jammy`, `core-ubuntu-noble`, `core-debian-bookworm`).
+- Published tags: `kasmweb/<name>:<branch>` for branch builds, `kasmweb/<name>:<version>` for releases.
+
+## Distro Support
+
+Install scripts are organized under `src/<distro>/install/<app>/`. Ubuntu scripts (jammy/noble) are the most common. When adding support for a new distro, add scripts under the appropriate `src/<distro>/` subtree and reference them in the dockerfile.

From d637c490aa3dc186cfd3760caa2da3d6051c48ae Mon Sep 17 00:00:00 2001
From: Ian Tangney <ian.tangney@kasm.com>
Date: Wed, 13 May 2026 19:58:39 +0000
Subject: [PATCH 03/10] KASM-8210 bump CI image to docker:29.4.3

---
 .gitlab-ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b591677..8280c4b 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,9 +1,9 @@
 ############
 # Settings #
 ############
-image: docker:24.0.6
+image: docker:29.4.3
 services:
-  - docker:24.0.6-dind
+  - docker:29.4.3-dind
 stages:
   - template
   - run

From b3aac3cc6e4e4e34011635e07522827c51b29d8a Mon Sep 17 00:00:00 2001
From: Huan Truong <huan.truong@kasmweb.com>
Date: Wed, 13 May 2026 19:26:49 -0500
Subject: [PATCH 04/10] KASM-8210 add dockerignore and fix redroid

---
 .dockerignore                                 | 4 ++++
 src/ubuntu/install/redroid/install_redroid.sh | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)
 create mode 100644 .dockerignore

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..9943d20
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,4 @@
+# Claude Code AI data files — excluded from Docker builds
+.claude/
+claude_files/
+CLAUDE.md
\ No newline at end of file
diff --git a/src/ubuntu/install/redroid/install_redroid.sh b/src/ubuntu/install/redroid/install_redroid.sh
index 198cf36..dcecc2b 100644
--- a/src/ubuntu/install/redroid/install_redroid.sh
+++ b/src/ubuntu/install/redroid/install_redroid.sh
@@ -13,6 +13,6 @@ apt-get install -y  android-tools-adb android-tools-fastboot \
 
 mkdir -p /opt/
 cd /opt/
-git clone https://github.com/Genymobile/scrcpy
+git clone --depth 1 --branch v3.3.4 https://github.com/Genymobile/scrcpy
 cd scrcpy
 ./install_release.sh
\ No newline at end of file

From 20cf4ebc56b378926639d107bea479cad42f04a2 Mon Sep 17 00:00:00 2001
From: Ian Tangney <ian.tangney@kasm.com>
Date: Thu, 14 May 2026 17:33:45 +0000
Subject: [PATCH 05/10] KASM-8210 add DOCKER_AUTH_CONFIG to CI variables

---
 .gitlab-ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 8280c4b..c8d4a06 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -13,6 +13,7 @@ variables:
   KASM_RELEASE: "1.18.0"
   TEST_INSTALLER: "https://kasm-static-content.s3.amazonaws.com/kasm_release_1.18.0.09f70a.tar.gz"
   MIRROR_ORG_NAME: "kasmtech"
+  DOCKER_AUTH_CONFIG: ${_DOCKER_AUTH_CONFIG}
 default:
   retry: 2
 before_script:

From dbc5fe8130a02bea465b56ede6ac153c9137a406 Mon Sep 17 00:00:00 2001
From: Ian Tangney <ian.tangney@kasm.com>
Date: Thu, 14 May 2026 20:54:57 +0000
Subject: [PATCH 06/10] KASM-8210 fix aarch64 manifest pull on amd64 runner
 with docker 29.x

Docker 29.x enforces platform matching on pull; add --platform linux/arm64
when pulling the aarch64 image from an amd64 runner in manifest.sh.
---
 ci-scripts/manifest.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ci-scripts/manifest.sh b/ci-scripts/manifest.sh
index 2938eab..32c30cc 100755
--- a/ci-scripts/manifest.sh
+++ b/ci-scripts/manifest.sh
@@ -79,7 +79,7 @@ if [[ "${TYPE}" == "multi" ]]; then
 
   # Pull images from cache repo
   docker pull ${ORG_NAME}/image-cache-private:x86_64-${NAME}-${PULL_BRANCH}-${CI_PIPELINE_ID}
-  docker pull ${ORG_NAME}/image-cache-private:aarch64-${NAME}-${PULL_BRANCH}-${CI_PIPELINE_ID}
+  docker pull --platform linux/arm64 ${ORG_NAME}/image-cache-private:aarch64-${NAME}-${PULL_BRANCH}-${CI_PIPELINE_ID}
 
   # Tag images to live repo
   docker tag \

From 12ff1b9d57f40c4e13876f9b0d1fb598946b4a19 Mon Sep 17 00:00:00 2001
From: Ian Tangney <ian.tangney@kasm.com>
Date: Thu, 14 May 2026 21:47:24 +0000
Subject: [PATCH 07/10] KASM-8210 bump docker image to 29.4.3 in CI template

---
 ci-scripts/gitlab-ci.template | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/ci-scripts/gitlab-ci.template b/ci-scripts/gitlab-ci.template
index ec01db2..3559af8 100644
--- a/ci-scripts/gitlab-ci.template
+++ b/ci-scripts/gitlab-ci.template
@@ -1,9 +1,9 @@
 ############
 # Settings #
 ############
-image: docker:29.4.0
+image: docker:29.4.3
 services:
-  - docker:29.4.0-dind
+  - docker:29.4.3-dind
 stages:
   - readme
   - revert
@@ -45,9 +45,9 @@ include:
 {% for IMAGE in multiImages %}
 build_{{ IMAGE.name }}:
   stage: build
-  image: docker:28.2.2
+  image: docker:29.4.3
   services:
-    - docker:28.2.2-dind
+    - docker:29.4.3-dind
   extends:
     - .run_rules
     - .monitor-in-grafana
@@ -78,9 +78,9 @@ build_{{ IMAGE.name }}:
 {% for IMAGE in singleImages %}
 build_{{ IMAGE.name }}:
   stage: build
-  image: docker:28.2.2
+  image: docker:29.4.3
   services:
-    - docker:28.2.2-dind
+    - docker:29.4.3-dind
   extends:
     - .run_rules
     - .monitor-in-grafana
@@ -173,9 +173,9 @@ test_{{ IMAGE.name }}:
 {% for IMAGE in multiImages %}
 manifest_{{ IMAGE.name }}:
   stage: manifest
-  image: docker:28.2.2
+  image: docker:29.4.3
   services:
-    - docker:28.2.2-dind
+    - docker:29.4.3-dind
   extends:
     - .run_rules
     - .monitor-in-grafana
@@ -210,9 +210,9 @@ manifest_{{ IMAGE.name }}:
 {% for IMAGE in singleImages %}
 manifest_{{ IMAGE.name }}:
   stage: manifest
-  image: docker:28.2.2
+  image: docker:29.4.3
   services:
-    - docker:28.2.2-dind
+    - docker:29.4.3-dind
   extends:
     - .run_rules
     - .monitor-in-grafana
@@ -251,9 +251,9 @@ manifest_{{ IMAGE.name }}:
 {% for IMAGE in multiImages %}
 weekly_manifest_{{ IMAGE.name }}:
   stage: manifest
-  image: docker:28.2.2
+  image: docker:29.4.3
   services:
-    - docker:28.2.2-dind
+    - docker:29.4.3-dind
   extends:
     - .run_rules
     - .monitor-in-grafana
@@ -273,9 +273,9 @@ weekly_manifest_{{ IMAGE.name }}:
 {% for IMAGE in singleImages %}
 weekly_manifest_{{ IMAGE.name }}:
   stage: manifest
-  image: docker:28.2.2
+  image: docker:29.4.3
   services:
-    - docker:28.2.2-dind
+    - docker:29.4.3-dind
   extends:
     - .run_rules
     - .monitor-in-grafana

From e9b53cc630f4e1de0c65f22ef46eb82cb11e55c5 Mon Sep 17 00:00:00 2001
From: Ian Tangney <ian.tangney@kasm.com>
Date: Thu, 14 May 2026 21:48:58 +0000
Subject: [PATCH 08/10] KASM-8210 add --provenance=false to docker build to fix
 manifest list error with Docker 29.x

---
 ci-scripts/build.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ci-scripts/build.sh b/ci-scripts/build.sh
index 0d4c15d..4fb3398 100755
--- a/ci-scripts/build.sh
+++ b/ci-scripts/build.sh
@@ -11,7 +11,7 @@ if [[ ${USE_PRIVATE_IMAGES} -eq 1 ]]; then
 fi
 
 ## Build/Push image to cache endpoint by pipeline ID ##
-docker build \
+docker build --provenance=false \
   -t ${ORG_NAME}/image-cache-private:$(arch)-${NAME}-${SANITIZED_BRANCH}-${CI_PIPELINE_ID} \
   --build-arg BASE_IMAGE="${BASE}" \
   --build-arg BASE_TAG="${BASE_TAG}" \

From d3b472cf8328de6dabea719cc01e8fe816d3ecdc Mon Sep 17 00:00:00 2001
From: Ian Tangney <ian.tangney@kasm.com>
Date: Thu, 14 May 2026 22:41:28 +0000
Subject: [PATCH 09/10] KASM-8210 test.sh: materialize docker config.json from
 DOCKER_AUTH_CONFIG before scp

---
 ci-scripts/test.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/ci-scripts/test.sh b/ci-scripts/test.sh
index 85ac179..ee7e73e 100755
--- a/ci-scripts/test.sh
+++ b/ci-scripts/test.sh
@@ -164,6 +164,12 @@ for IP in "${IPS[@]}"; do
   done
 done
 
+# Materialize docker config from env var if docker login was not run
+if [ ! -f /root/.docker/config.json ] && [ -n "${DOCKER_AUTH_CONFIG:-}" ]; then
+  mkdir -p /root/.docker
+  printf '%s' "${DOCKER_AUTH_CONFIG}" > /root/.docker/config.json
+fi
+
 # Copy over docker auth
 for IP in "${IPS[@]}"; do
   scp \

From fa7471dba7a9109acf27ae0495a4764834e7788a Mon Sep 17 00:00:00 2001
From: Ian Tangney <ian.tangney@kasm.com>
Date: Mon, 18 May 2026 16:49:09 +0000
Subject: [PATCH 10/10] KASM-8210 revert BASE_TAG and USE_PRIVATE_IMAGES to
 develop defaults

---
 .gitlab-ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index c8d4a06..649cfc6 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -8,8 +8,8 @@ stages:
   - template
   - run
 variables:
-  BASE_TAG: "feature_KASM-8210_bump_dep_versions_for_1_19_0"
-  USE_PRIVATE_IMAGES: 1
+  BASE_TAG: "develop"
+  USE_PRIVATE_IMAGES: 0
   KASM_RELEASE: "1.18.0"
   TEST_INSTALLER: "https://kasm-static-content.s3.amazonaws.com/kasm_release_1.18.0.09f70a.tar.gz"
   MIRROR_ORG_NAME: "kasmtech"