Updating
Pull a newer image tag and restart the container; the config volume carries everything over. Each image ships THIRD-PARTY-NOTICES.html in /usr/share/doc/kubyl-server/, with the open-source licenses of everything linked into the server binary.
One image
From the next server release there is one image. It contains the server (a static musl binary), helm and every AI agent the server supports (AI agents), each at the latest release at the time the image was built. The base is node:24-bookworm-slim (Debian 12, glibc, Node.js 24 LTS). Agents stay off until you turn them on.
- Size (arm64, measured): about 3.1 GB unpacked and about 0.85 GB compressed, which is what a pull transfers. The agents dominate. The amd64 image is of similar size.
- It runs as uid 65532 with a read-only root file system. Everything written (agent homes, npm's cache, Helm's directories,
TMPDIR) is below/config, which must allow executing files: anoexecmount breaks the Copilot agent. - The exact versions of *your* image are in
/usr/share/doc/kubyl-server/bundled-versions.txt.
Build arguments
If you build the image yourself, every tool has a build argument that defaults to latest.
| Tool | Build argument |
|---|---|
| helm | HELM_VERSION |
| Claude adapter (pulls Claude Code) | CLAUDE_AGENT_ACP_VERSION |
| Codex adapter | CODEX_ACP_VERSION |
| Codex CLI | OPENAI_CODEX_VERSION |
| Gemini CLI | GEMINI_CLI_VERSION |
| GitHub Copilot CLI | COPILOT_VERSION |
| OpenCode | OPENCODE_VERSION |
| goose | GOOSE_VERSION |
Pin one with --build-arg GEMINI_CLI_VERSION=0.63.0, or set it to the empty string to leave the tool out (--build-arg COPILOT_VERSION= --build-arg CLAUDE_AGENT_ACP_VERSION=). A tool that cannot be resolved, downloaded or verified fails the build; nothing falls back silently. Because latest moves, two builds of the same Dockerfile differ: pin everything for a reproducible release.
Licenses
The image bundles third-party software and ships the license texts in /usr/share/doc/kubyl-server/licenses/ (with npm/SUMMARY.tsv listing package, version and declared license).
- Apache-2.0: helm, the Claude and Codex adapters, Codex CLI, Gemini CLI and goose.
- MIT: OpenCode and Node.js (plus bundled third-party licenses).
- Proprietary: Claude Code (inside the Claude adapter's SDK; use is subject to Anthropic's legal agreements) and the GitHub Copilot CLI (GitHub Copilot CLI License; using it needs a GitHub Copilot subscription).
The other npm dependencies (about 130 packages) declare MIT, ISC, Apache-2.0, BSD-2/3-Clause or Unlicense. This is a technical reading of the shipped files, not legal advice; the versions change with every build. Leave out a proprietary agent with the empty build argument above if you don't want it.