Building a custom image
Every user container runs the same image: comcon:latest, built from one Containerfile. comcon generate produces that file from your choices, builds it locally, and only then offers it as a preset.
Your choices
| Choice | Options | Default |
|---|---|---|
| Base OS | debian-trixie, debian-bookworm, ubuntu-24.04 | debian-trixie |
| Agent | Devin, MagicStride, Claude Code, Codex, OpenCode, or none — a closed recipe list, so every image is a known-good build | Devin |
| Browser | Headful Chromium (the browser.<user> surface) or none | Chromium |
| Toolkits | office (LibreOffice + Evince), imagemagick, nodejs-devtools, or a custom package list | none — CLI tooling only |
| Capabilities | wine (Windows binaries), android-tools (adb) | none |
| Web surfaces | Which /etc/comcon/apps/*.conf route declarations ship | browser.conf |
You bring your own agent subscriptions — comcon installs the tooling, you sign in once inside your container.
What every image guarantees
The generated Containerfile follows a fixed contract so the surfaces always work:
- A non-root user (uid 1000) with passwordless sudo inside the container only — agents can install packages without ever touching the host.
- Zellij pinned to a released version, serving the
term.<user>web terminal. - The browser machinery when Chromium is included: Xvfb, the CDP screencast bridge, the canvas client, and agent helpers that drive the same visible browser.
- Container sshd on :2222, published per user as
ssh -p 2200+slot— the remote-attach path. Key-only, lands inside the container, never on the host. - Fixed port contract:
EXPOSE 2222 8082 9222 9223 9224plus agent serve ports. Publishing decisions live in provisioning, not the image.
Example requests
generate a minimal image — claude-code, no browser, no extra appsgenerate an image with devin + chromium + nodejs-devtools + android-toolsCustom images are verified by an actual build before deploy. If a choice has no recipe, the generator says so instead of improvising.