distros/skills/ubuntu-builder/SKILL.md
Minimal Ubuntu 24.04 builder image (pixi + Node.js + build-toolchain) used as the multi-stage builder for Ubuntu-based boxes — currently ubuntu-coder. Runs as uid 1000 `ubuntu` (adopted from the upstream ubuntu:24.04 base image via the embedded distro vocabulary's base_user declaration). MUST be invoked before building, deploying, configuring, or troubleshooting the ubuntu-builder box.
npx skillsauth add overthinkos/overthink-plugins ubuntu-builderInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Ubuntu 24.04 (noble) counterpart of /charly-distros:fedora-builder and /charly-distros:debian-builder. Same role — pixi/npm/cargo multi-stage builder — with one important difference: the builder runs as ubuntu (uid 1000) because the upstream ubuntu:24.04 base image ships a pre-existing ubuntu:ubuntu account at uid 1000, and the embedded distro.ubuntu.base_user vocabulary adopts it.
Lives in the overthinkos/ubuntu repo (git submodule at box/ubuntu).
Build it from the submodule: charly -C box/ubuntu box build ubuntu-builder
(normally builds implicitly as a dependency of ubuntu-coder). Its
pixi/nodejs/build-toolchain candies are pulled by github reference from the
main repo.
| Property | Value |
|----------|-------|
| Base | ubuntu (which = ubuntu:24.04 + our bootstrap) |
| Layers | pixi, nodejs, build-toolchain |
| Platforms | linux/amd64 |
| Registry | ghcr.io/overthinkos |
| User | ubuntu / uid 1000 (adopt mode — see /charly-image:image "user_policy") |
| Home | /home/ubuntu |
/charly-distros:ubuntu — Ubuntu 24.04 + bootstrap. Inherits Debian's apt-get update && apt-get install -y --no-install-recommends curl ca-certificates gnupg pattern because the embedded distro.ubuntu vocabulary declares inherits: debian. Ubuntu-specific: base_user: { name: ubuntu, uid: 1000, gid: 1000, home: /home/ubuntu } — no useradd step emitted./charly-languages:pixi — pixi package manager + env paths (/home/ubuntu/.pixi)./charly-coder:nodejs — Node.js + npm (generic nodejs)./charly-coder:build-toolchain — same Debian -dev packages as /charly-distros:debian-builder.When the generator emits the Containerfile for this image, the bootstrap section contains:
# User ubuntu (uid=1000) adopted from base image (declared in the embedded distro.base_user vocabulary) — no useradd needed
WORKDIR /home/ubuntu
USER 1000
No useradd, no groupadd, no usermod -l rename. The upstream ubuntu:ubuntu account is honored verbatim — HOME, npm prefix, pixi env, cargo home, sudoers all derive from resolved.User = "ubuntu". See /charly-image:image "user_policy" and /charly-internals:generate-source "writeBootstrap".
Declares builds: [pixi, npm, cargo] and is referenced from ubuntu: as:
ubuntu:
builder:
pixi: ubuntu-builder
npm: ubuntu-builder
cargo: ubuntu-builder
During charly box build ubuntu-coder, cargo/npm/pixi-owning candies get their FROM ubuntu-builder AS <layer>-<type>-build stages from this image, then COPY --from=<stage> --chown=1000:1000 /home/ubuntu /home/ubuntu into the final ubuntu-coder. (The --chown=1000:1000 numeric form works uniformly regardless of user name — see /charly-coder:build-toolchain for the builder-artifact COPY pattern.)
/charly-distros:fedora-builder — RPM-family, user:user uid 1000 (create)./charly-distros:debian-builder — deb-family, Debian 13, user:user (create — Debian 13 ships no pre-existing uid-1000 user)./charly-distros:arch-builder — pacman-family, user:user + yay for AUR.The three builders have near-identical candy stacks (pixi + nodejs + build-toolchain). The only meaningful divergence is this box's adopt-mode ubuntu:ubuntu identity.
charly -C box/ubuntu box build ubuntu-builder
charly shell ubuntu-builder # drops you into /home/ubuntu as uid 1000
id # uid=1000(ubuntu) gid=1000(ubuntu)
Typically not invoked directly — it's a build-time dependency of /charly-coder:ubuntu-coder.
charly -C box/ubuntu box list | grep ubuntu-buildercharly shell ubuntu-builder -- id → uid=1000(ubuntu) gid=1000(ubuntu)charly shell ubuntu-builder -- pixi --version && node --version && gcc --version/charly-distros:ubuntu — parent base; declares base_user: in the embedded distro vocabulary./charly-coder:ubuntu-coder — the consumer that this builder serves./charly-distros:debian-builder — deb-family sibling without adopt mode./charly-distros:fedora-builder — canonical RPM-family sibling./charly-languages:pixi, /charly-coder:nodejs, /charly-coder:build-toolchain/charly-build:build — base_user: declaration format in the embedded distro.* vocabulary/charly-image:image — user_policy: field (auto / adopt / create) and the decision table/charly-build:generate — adopt-vs-create writeBootstrap emission modesMUST be invoked when:
ubuntu-builder itself.ubuntu-coder build (this is the source stage; uid 1000 = ubuntu by adoption).${HOME} = /home/ubuntu (not /home/user) inside builder stages.tools
Use when authoring or modifying a charly PLUGIN — a candy with a `plugin:` block that contributes Providers (verbs/kinds/deploy-targets/steps/builders/commands), its own CUE schema, builtin (compiled-in) or external (out-of-tree git repo). Covers the unified Provider model, the per-plugin CUE-schema contract (single source → Go params for dev + schema-over-Describe RPC for runtime), the SDK, and the loader.
tools
The CUE data-validation / configuration CLI (cue), pinned to v0.16.1. Use when working with the cue candy, installing the cue binary into a box or onto a target:local dev host, or running the offline schema-vendoring pipeline that feeds charly's egress validation.
tools
CUE EGRESS validation — validating (and, where it adds value, generating) the config files charly WRITES to a system BEFORE the bytes hit disk. MUST be invoked before working on charly/egress.go, the vendored schemas under candy/plugin-egress/egress-schemas/vendor/, the ValidateEgress / registerVendoredEgressKind path, the offline `task cue:vendor` pipeline, or adding an egress schema for any written artifact (cloud-init, k8s manifests, traefik routes, runtime config, install ledger, systemd/quadlet units, ssh_config, libvirt XML).
tools
Kubernetes cluster-probe declarative check verb — the `kube:` check verb (nodes, pods, ingress, storage class, addon health, apply/delete, and arbitrary resource GETs) served out-of-process by the candy/plugin-kube plugin (vendored client-go; no external kubectl required).