docker-customize

# Docker Customize Land a container change in the first channel that can carry it, in the order below. Files sit on the project bind mount, so this skill runs from inside the container or on the host. Rebuild, restart, and compose validation are host-only (the image has no Docker CLI): name the command for the operator, do not run it from inside the container. ## 1. Apt package The container runs as `USER claude` with `cap_drop: ALL` and `no-new-privileges`, so nothing installs a package at runtime. It has to be in the image. Add it inside the operator block of `Dockerfile.hermit` (between `# --- operator:` and `# --- end operator ---`): ```dockerfile RUN apt-get update && apt-get install -y --no-install-recommends \ <pkg> <pkg> && \ rm -rf /var/lib/apt/lists/* ``` A Dockerfile rendered before the operator block existed has no such markers. Add the block yourself, between the `gh` install layer and the `# Match host UID` comment, then put the `RUN` inside it: ```dockerfile # --- operator: root-context installs go here; upgrades merge around this block --- # # --- end operator --- ``` Then rebuild on the host: `.claude-code-hermit/bin/hermit-docker restart --build` (it needs the container running; from stopped, `.claude-code-hermit/bin/hermit-docker up --build`). Tell the operator: `docker.packages` in `config.json` is read only when the templates are rendered, so setting it installs nothing on its own. Re-check the file after an upgrade. ## 2. Boot-time sh...