software-development images

Open container images for software development.

Every downloaded tool, including Clor, is pinned to an explicit version and overridable at build time. Images are built for linux/amd64 and linux/arm64 and published to ghcr.io/clorhq.

Images

Each language image is FROM software-development-base, so the agents, OS tooling, and the base toolchains are present in every image. The language images override the managed entrypoint with an unprivileged Bash default, making them suitable as custom space images.

The Data and DevOps images are intentionally pull-on-demand variants. Their services and terminal helpers only open local interactive interfaces: image startup never authenticates to a provider, selects a deployment target, or changes external infrastructure. Provider credentials remain runtime state, supplied interactively or through Clor secrets.

Base image tools

software-development-base includes the practical tools below. Exact versions are pinned in images/base/Dockerfile.

• Agents and workspace: Clor, Claude Code, Codex, code-server, and VS Code extensions for GitHub pull requests and Actions, Python, Go, and YAML.
• Languages and package managers: Node.js and npm, Bun, Deno, Go, Python, pip, pipx, uv, pnpm, and Yarn.
• Editors and terminal workflow: Neovim, Vim, Nano, tmux, screen, Lazygit, Yazi, fzf, Glow, bat, eza, fd, zoxide, tree, ncdu, htop, and btop.
• Source control and code quality: Git, Git LFS, GitHub CLI (gh), gh-dash, delta, difftastic, ESLint, Prettier, ShellCheck, shfmt, golangci-lint, actionlint, ast-grep, typos, Vale, and lychee.
• Development and automation: TypeScript, tsx, Tailwind CSS, gopls, Delve, mise, direnv, just, watchexec, Redocly CLI, and the Remotion space helper.
• APIs, networking, and security: Posting, the Stripe CLI, xh, Hurl, grpcurl, grpcui, websocat, oha, yq, gitleaks, OSV-Scanner, curl, wget, OpenSSH, rsync, rclone, Tailscale (tailscale and tailscaled, not started by the image), ping, traceroute, mtr, netcat, socat, tcpdump, DNS tools, and whois.
• Container tooling: Docker Engine, Docker CLI, containerd, runc, Buildx, and Compose. Clor starts the rootful daemon only for a space with docker_access = true, using private persistent state mounted at /var/lib/docker. Package installation never starts the daemon.
• Data, documents, and media: DuckDB, SQLite, jq, lnav, Pandoc, Typst, Presenterm, ffmpeg, SoX, ImageMagick, ExifTool, Poppler tools, and common archive utilities including zip, 7-Zip, xz, and zstd.
• Local development services: PostgreSQL, MariaDB/MySQL, and Redis servers and clients, supervised as the space user and disabled by default.
• Browser automation: Playwright with Chromium and Firefox. WebKit is not preinstalled; add it when needed with playwright install webkit.

Local development services

PostgreSQL, MariaDB (available under the mysql service name), and Redis are preconfigured for local development. They bind only to loopback, use passwordless development authentication, and do not start with the space.

sv start postgres
sv start mysql
sv start redis

sv status postgres mysql redis
sv stop postgres mysql redis

The first start initializes each database. PostgreSQL creates the user superuser, MariaDB creates a passwordless local root account, and Redis does not require a password. These defaults are for development inside a space, not for publicly reachable or production databases.

The services follow the XDG base-directory layout:

Edit the native server config and restart the corresponding service to change ports, authentication, persistence, or network exposure. To reset a database, stop its service and remove only that service's directory under ~/.local/share; its next start initializes a fresh database.