overthinkos/language-runtimes
ov-coder/skills/language-runtimes/SKILL.md
Multi-language runtime meta-layer — Go, PHP, .NET 9 SDK, nodejs-devel, python3-devel, ramalama. System Python via RPM (not pixi-python). Uses nodejs and rust layers as explicit deps. Use when working with polyglot development or composing multiple language runtimes into a single image.
development
Updated May 10, 2026
$ install --global
skillsauthnpx skillsauth add overthinkos/overthink-plugins language-runtimesInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 10, 2026, 5:22 AM169.7s1 file scanned
SKILL.md
- name:
- language-runtimes
- description:
- |
language-runtimes -- Go, PHP, .NET, nodejs-devel, python3-devel
Layer Properties
| Property | Value |
|----------|-------|
| Dependencies | nodejs, rust |
| Install files | layer.yml (packages only) |
Packages (RPM)
dotnet-sdk-9.0— Microsoft .NET 9 SDK (~600 MB, dominant size)golang-bin— Go compiler + standard librarygolang-bazil-fuse-devel— Go FUSE bindings (for layers compiling FUSE Go code)libicu— ICU i18n library (required by .NET)php— PHP CLI + core modulespython3-devel— system Python 3 + dev headerspython3-ramalama— RamaLama tool (Python)nodejs-devel— Node.js headers (some native-module compiles need this alongside thenodejslayer's runtime)
Packages (pac) — Arch Linux
dotnet-sdk— in[extra](no third-party repo needed)go,icu,php,python— all[core]/[extra]. Arch ships headers with the main package (no-develsplit), sonodejs-devel/python3-develhave no separatepac:entries.
Drops on Arch: python3-ramalama (not packaged — install via uv tool install ramalama), golang-bazil-fuse-devel (Go library fetched via go get).
Packages (deb) — Debian + Ubuntu
golang-go— Go compiler + stdliblibicu-dev— ICU with dev headersphp-cli— PHP CLI binary (Debian splitsphpintophp-cli/php-fpm/ etc.)python3-dev— system Python 3 + dev headers
dotnet-sdk-9.0 is not in the deb: package list. It's installed by a cross-distro cmd: task via Microsoft's official dotnet-install.sh — see the next subsection. python3-ramalama, golang-bazil-fuse-devel, nodejs-devel are dropped (not packaged on Debian/Ubuntu).
dotnet-sdk-9.0 via Microsoft's dotnet-install.sh (2026-04)
Cross-distro parity for .NET 9 requires juggling three asymmetric availability windows:
| Distro | Where dotnet-sdk-9.0 lives |
|---|---|
| Fedora 43 | Distro repo (rpm: pulls dotnet-sdk-9.0) |
| Arch | [extra] (pac: pulls dotnet-sdk) |
| Debian 13 trixie | Microsoft's trixie apt repo has it; Debian main does not |
| Ubuntu 24.04 noble | Neither Canonical noble (ships 8.0 + 10.0) nor Microsoft's noble apt repo (ships only 10.0) has 9.0 |
Rather than carrying that asymmetry in layer code, the layer uses Microsoft's official cross-distro installer script, channel-pinned to 9.0. It installs to /usr/share/dotnet and symlinks /usr/bin/dotnet:
tasks:
- cmd: |
if command -v dotnet >/dev/null 2>&1; then
exit 0 # already installed by distro rpm/pac
fi
if ! command -v apt-get >/dev/null 2>&1; then
exit 0 # non-Debian-family + no dotnet — intentional drop
fi
install -d /usr/share/dotnet
curl -fsSL https://builds.dotnet.microsoft.com/dotnet/scripts/v1/dotnet-install.sh -o /tmp/dotnet-install.sh
chmod +x /tmp/dotnet-install.sh
/tmp/dotnet-install.sh --channel 9.0 --install-dir /usr/share/dotnet
ln -sf /usr/share/dotnet/dotnet /usr/bin/dotnet
rm -f /tmp/dotnet-install.sh
user: root
Verified 2026-04-20 on ghcr.io/overthinkos/ubuntu-coder:latest:
$ /usr/bin/dotnet --version
9.0.313
Idempotent: the outer command -v dotnet guard makes this task a no-op on Fedora/Arch (where the distro package already installed dotnet) and on rebuilds (where the previous run already placed the symlink). Runtime dependency: libicu-dev (already installed by the layer's deb: section).
See /ov-build:layer for general cross-distro task-authoring patterns.
Tag-section overrides
debian:13:— just packages (same as genericdeb:).ubuntu:24.04:— just packages (same as genericdeb:).
Both exist so future Microsoft-apt-repo-based installs can be slotted into tag sections via repos: + packages: without disturbing the generic deb: fallback.
The vestigial requires: python removed in 2026-04
The layer used to declare requires: python, pulling in the
python ov-layer → pixi ov-layer → a conda-forge Python env
(~500 MB). But this layer installs python3-devel + python3-ramalama
via RPM — system Python. The pixi-python env was never referenced
by anything this layer installs. The dep was dropped in 2026-04;
consumers of language-runtimes now get only the RPM Python stack.
Consequence for /ov-coder:fedora-coder (the biggest consumer): the
whole python / pixi ov-layer chain drops out of the resolved layer
set (since /ov-coder:uv also dropped its vestigial python dep and
/ov-foundation:supervisord also removed its). Image size dropped by
several hundred MB. See CLAUDE.md "Key Rules" → "Don't declare
defensive deps" for the general rule.
If you genuinely need the pixi-python env (e.g. a layer that
installs a Python package from conda-forge via pixi), declare
requires: python on THAT layer directly — don't rely on transitive
pulls.
Tests
Six build-scope tests ship with the layer:
| Test | Purpose |
|---|---|
| dotnet-binary + dotnet-version | .NET SDK installed and responsive |
| php-binary + php-version | PHP CLI reachable |
| system-python3 + system-python3-version | /usr/bin/python3 is the system interpreter (the RPM-installed one; explicitly NOT a pixi-env path) |
Go and Node.js testing is delegated to the /ov-coder:golang and
/ov-coder:nodejs / /ov-coder:nodejs24 layer skills — those are
the single sources of truth for their respective binaries.
Usage
# image.yml
my-polyglot:
layers:
- language-runtimes
Used In Images
/ov-coder:fedora-coder— kitchen-sink dev image, canonical RPM consumer./ov-coder:arch-coder— pacman-based sibling./ov-coder:debian-coder,/ov-coder:ubuntu-coder— deb-based siblings, consumers of the dotnet-install.sh task./ov-foundation:bazzite-ai(disabled).
Related Layers
/ov-coder:nodejs— Node.js runtime (direct dependency)/ov-coder:rust— Rust toolchain (direct dependency)/ov-foundation:python— Pixi-python env. Not a dep of this layer as of 2026-04./ov-coder:golang— Go toolchain (may be added separately for clarity even thoughgolang-binis already in this layer's RPM list)/ov-coder:uv— direct-download Rust binary (also dropped its vestigial pixi-python dep in 2026-04)
Related Commands
/ov-build:layer— authoring reference (tag-section cascade,cmd:vs declarative repos)/ov-build:build—base_user:and bootstrap packages/ov-core:shell— verify runtimes inside a container
When to Use This Skill
MUST be invoked when:
- Composing
language-runtimesinto an image. - Debating pixi-python vs. system python3 — this layer is the canonical "system python3 only" example.
- Understanding why the
pythonov-layer is missing from an image that uses language-runtimes (that's by design since 2026-04).
Related
/ov-build:eval— declarative testing (eval:block,ov eval image,ov eval live)
Related Skills
overthinkos/plugin
tools
VerifiedTrustedCommunity
Use when authoring or modifying a charly PLUGIN — a candy with a `plugin:` block that contributes Providers (verbs/kinds/deploy-targets/steps/builders/commands), its own CUE schema, builtin (compiled-in) or external (out-of-tree git repo). Covers the unified Provider model, the per-plugin CUE-schema contract (single source → Go params for dev + schema-over-Describe RPC for runtime), the SDK, and the loader.
SKILL.mdUpdated Jun 22, 2026
overthinkos/cue
tools
VerifiedTrustedCommunity
The CUE data-validation / configuration CLI (cue), pinned to v0.16.1. Use when working with the cue candy, installing the cue binary into a box or onto a target:local dev host, or running the offline schema-vendoring pipeline that feeds charly's egress validation.
SKILL.mdUpdated Jun 16, 2026
overthinkos/egress
tools
VerifiedTrustedCommunity
CUE EGRESS validation — validating (and, where it adds value, generating) the config files charly WRITES to a system BEFORE the bytes hit disk. MUST be invoked before working on charly/egress.go, the vendored schemas under candy/plugin-egress/egress-schemas/vendor/, the ValidateEgress / registerVendoredEgressKind path, the offline `task cue:vendor` pipeline, or adding an egress schema for any written artifact (cloud-init, k8s manifests, traefik routes, runtime config, install ledger, systemd/quadlet units, ssh_config, libvirt XML).
SKILL.mdUpdated Jun 16, 2026
overthinkos/check-k8s
tools
VerifiedTrustedCommunity
Kubernetes cluster-probe declarative check verb — the `kube:` check verb (nodes, pods, ingress, storage class, addon health, apply/delete, and arbitrary resource GETs) served out-of-process by the candy/plugin-kube plugin (vendored client-go; no external kubectl required).
SKILL.mdUpdated Jun 14, 2026