Merge branch 'main' of https://github.com/makespacemadrid/coder-workspaces

Author: successbyfailure

Docker-Images/Designer/Dockerfile

@@ -131,6 +131,8 @@ rm /tmp/opencode-desktop.deb
 rm -rf /var/lib/apt/lists/*
 EOSH
 
+ENV COWORK_VM_BACKEND=host
+
 # Claude Desktop (.deb repo comunitario) + wrapper no-sandbox para Electron
 RUN <<'EOSH'
 set -e
@@ -143,8 +145,8 @@ if [ -x /usr/share/claude-desktop/claude-desktop ] && [ -x /usr/bin/claude-deskt
   mv /usr/bin/claude-desktop /usr/bin/claude-desktop.real || true
   cat > /usr/bin/claude-desktop <<'EOFWRAP'
 #!/bin/sh
-exec env ELECTRON_DISABLE_SANDBOX=1 ELECTRON_OZONE_PLATFORM_HINT="${ELECTRON_OZONE_PLATFORM_HINT:-auto}" \
-  /usr/share/claude-desktop/claude-desktop --no-sandbox --disable-gpu-sandbox --disable-setuid-sandbox --disable-seccomp-filter-sandbox --no-zygote --disable-gpu "$@"
+exec env ELECTRON_DISABLE_SANDBOX=1 ELECTRON_OZONE_PLATFORM_HINT="${ELECTRON_OZONE_PLATFORM_HINT:-auto}" COWORK_VM_BACKEND="${COWORK_VM_BACKEND:-host}" \
+  /usr/bin/claude-desktop.real "$@"
 EOFWRAP
   chmod +x /usr/bin/claude-desktop
 fi

Docker-Images/Developer/Dockerfile

@@ -197,7 +197,8 @@ RUN set -e; \
 # Electron apps dentro de contenedores Docker necesitan desactivar el sandbox
 # (no hay user namespaces). Los wrappers añaden --no-sandbox y pistas de Ozone.
 ENV ELECTRON_DISABLE_SANDBOX=1 \
-    ELECTRON_OZONE_PLATFORM_HINT=auto
+    ELECTRON_OZONE_PLATFORM_HINT=auto \
+    COWORK_VM_BACKEND=host
 RUN <<'EOSH'
 set -e
 wrap() {
@@ -206,15 +207,23 @@ wrap() {
     mv "$name" "${name}.real" || true
     cat > "$name" <<SHWRAP
 #!/bin/sh
-exec env ELECTRON_DISABLE_SANDBOX=1 ELECTRON_OZONE_PLATFORM_HINT="${ELECTRON_OZONE_PLATFORM_HINT:-auto}" \
+exec env ELECTRON_DISABLE_SANDBOX=1 ELECTRON_OZONE_PLATFORM_HINT="${ELECTRON_OZONE_PLATFORM_HINT:-auto}" COWORK_VM_BACKEND="${COWORK_VM_BACKEND:-host}" \
   "$target" --no-sandbox --disable-gpu-sandbox --disable-setuid-sandbox --disable-seccomp-filter-sandbox --no-zygote $EXTRA_FLAGS "$@"
 SHWRAP
     chmod +x "$name"
   fi
 }
 TARGET_BIN=/usr/lib/github-desktop/github-desktop EXTRA_FLAGS="--password-store=basic" wrap /usr/bin/github-desktop /usr/lib/github-desktop/github-desktop
-TARGET_BIN=/usr/share/claude-desktop/claude-desktop EXTRA_FLAGS="--disable-gpu" wrap /usr/bin/claude-desktop /usr/share/claude-desktop/claude-desktop
 TARGET_BIN=/usr/share/code/bin/code EXTRA_FLAGS="" wrap /usr/bin/code /usr/share/code/bin/code
+if [ -x /usr/bin/claude-desktop ]; then
+  mv /usr/bin/claude-desktop /usr/bin/claude-desktop.real || true
+  cat > /usr/bin/claude-desktop <<'EOFWRAP'
+#!/bin/sh
+exec env ELECTRON_DISABLE_SANDBOX=1 ELECTRON_OZONE_PLATFORM_HINT="${ELECTRON_OZONE_PLATFORM_HINT:-auto}" COWORK_VM_BACKEND="${COWORK_VM_BACKEND:-host}" \
+  /usr/bin/claude-desktop.real "$@"
+EOFWRAP
+  chmod +x /usr/bin/claude-desktop
+fi
 # Google Chrome (no es Electron pero también necesita --no-sandbox en Docker)
 if [ -x /opt/google/chrome/google-chrome ]; then
   mv /usr/bin/google-chrome-stable /usr/bin/google-chrome-stable.real 2>/dev/null || true

Docker-Images/DeveloperAndroid/Dockerfile

@@ -65,13 +65,6 @@ RUN mkdir -p /etc/pulse/default.pa.d && \
     printf 'load-module module-null-sink sink_name=vcable sink_properties=device.description="VirtualCable"\nset-default-sink vcable\n' \
     > /etc/pulse/default.pa.d/10-null-sink.pa
 
-# Vulkan loader + Mesa Vulkan drivers (incluye Zink: OpenGL sobre Vulkan para NVIDIA en KasmVNC)
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-        libvulkan1 \
-        mesa-vulkan-drivers \
-    && rm -rf /var/lib/apt/lists/*
-
 # GitHub CLI (repositorio oficial)
 RUN install -m 0755 -d /etc/apt/keyrings && \
     curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | gpg --dearmor -o /etc/apt/keyrings/githubcli-archive-keyring.gpg && \
@@ -150,28 +143,44 @@ RUN set -e; \
     rm -rf /var/lib/apt/lists/* /tmp/opencode-desktop.deb
 
 # Android SDK commandline tools + componentes principales
-ENV ANDROID_HOME=/opt/android-sdk \
-    ANDROID_SDK_ROOT=/opt/android-sdk \
+ENV ANDROID_HOME=/home/coder/Android/Sdk \
+    ANDROID_SDK_ROOT=/home/coder/Android/Sdk \
+    ANDROID_EMULATOR_DEFAULT_GPU=swiftshader \
     ANDROID_USER_HOME=/home/coder/.android \
-    PATH=$PATH:/opt/android-sdk/platform-tools:/opt/android-sdk/cmdline-tools/latest/bin:/opt/android-sdk/emulator:/opt/gradle/gradle-9.3.1/bin
+    PATH=$PATH:/home/coder/Android/Sdk/platform-tools:/home/coder/Android/Sdk/cmdline-tools/latest/bin:/home/coder/Android/Sdk/emulator:/opt/gradle/gradle-9.3.1/bin
 
 ARG ANDROID_SDK_VERSION=14742923
-RUN mkdir -p /opt/android-sdk/cmdline-tools && \
+RUN mkdir -p /home/coder/Android/Sdk/cmdline-tools && \
     curl -fsSL "https://dl.google.com/android/repository/commandlinetools-linux-${ANDROID_SDK_VERSION}_latest.zip" -o /tmp/cmdline-tools.zip && \
-    unzip -q /tmp/cmdline-tools.zip -d /opt/android-sdk/cmdline-tools && \
-    mv /opt/android-sdk/cmdline-tools/cmdline-tools /opt/android-sdk/cmdline-tools/latest && \
+    unzip -q /tmp/cmdline-tools.zip -d /home/coder/Android/Sdk/cmdline-tools && \
+    mv /home/coder/Android/Sdk/cmdline-tools/cmdline-tools /home/coder/Android/Sdk/cmdline-tools/latest && \
     rm /tmp/cmdline-tools.zip && \
-    yes | /opt/android-sdk/cmdline-tools/latest/bin/sdkmanager --licenses >/dev/null || true && \
-    /opt/android-sdk/cmdline-tools/latest/bin/sdkmanager --update && \
-    /opt/android-sdk/cmdline-tools/latest/bin/sdkmanager \
+    yes | /home/coder/Android/Sdk/cmdline-tools/latest/bin/sdkmanager --licenses >/dev/null || true && \
+    /home/coder/Android/Sdk/cmdline-tools/latest/bin/sdkmanager --update && \
+    /home/coder/Android/Sdk/cmdline-tools/latest/bin/sdkmanager \
       "platform-tools" \
       "emulator" && \
-    chown -R coder:coder /opt/android-sdk && \
+    mv /home/coder/Android/Sdk/emulator/emulator /home/coder/Android/Sdk/emulator/emulator.real && \
+    { \
+      printf '%s\n' '#!/usr/bin/env bash' 'set -e' ''; \
+      printf '%s\n' 'default_gpu="${ANDROID_EMULATOR_DEFAULT_GPU:-swiftshader}"'; \
+      printf '%s\n' 'for arg in "$@"; do'; \
+      printf '%s\n' '  if [ "$arg" = "-gpu" ]; then'; \
+      printf '%s\n' '    exec /home/coder/Android/Sdk/emulator/emulator.real "$@"'; \
+      printf '%s\n' '  fi'; \
+      printf '%s\n' 'done' ''; \
+      printf '%s\n' 'exec /home/coder/Android/Sdk/emulator/emulator.real -gpu "$default_gpu" "$@"'; \
+    } > /home/coder/Android/Sdk/emulator/emulator && \
+    chmod +x /home/coder/Android/Sdk/emulator/emulator && \
+    ln -sfn /home/coder/Android/Sdk /opt/android-sdk && \
+    chown -R coder:coder /home/coder/Android /home/coder/.android && \
     install -d -o coder -g coder /home/coder/.android
 
 # Android Studio
-ARG ANDROID_STUDIO_VERSION=2025.2.3.9
-RUN curl -fsSL "https://redirector.gvt1.com/edgedl/android/studio/ide-zips/${ANDROID_STUDIO_VERSION}/android-studio-${ANDROID_STUDIO_VERSION}-linux.tar.gz" -o /tmp/android-studio.tar.gz && \
+ARG ANDROID_STUDIO_VERSION=2025.3.2
+ARG ANDROID_STUDIO_BUILD=2025.3.2.6
+ARG ANDROID_STUDIO_PACKAGE=android-studio-panda2-linux.tar.gz
+RUN curl -fsSL "https://redirector.gvt1.com/edgedl/android/studio/ide-zips/${ANDROID_STUDIO_BUILD}/${ANDROID_STUDIO_PACKAGE}" -o /tmp/android-studio.tar.gz && \
     tar -xzf /tmp/android-studio.tar.gz -C /opt && \
     rm /tmp/android-studio.tar.gz && \
     chown -R coder:coder /opt/android-studio && \

workspaces/AdvancedHostDANGER/main.tf

@@ -194,6 +194,34 @@ PULSECFG
     done
     unset _pa_try
 
+    # Configurar Claude Desktop cowork VM para usar HostBackend en Docker
+    # COWORK_VM_BACKEND=host evita que Claude Desktop use bwrap (que falla en contenedores)
+    # El contenedor Docker ya provee el aislamiento necesario
+    COWORK_TAG="# managed-by-danger-template: cowork-vm-backend"
+    for cowork_file in "$HOME/.xsessionrc" "$HOME/.profile"; do
+      if ! grep -qF "$COWORK_TAG" "$cowork_file" 2>/dev/null; then
+        printf '%s\nexport COWORK_VM_BACKEND=host\n' "$COWORK_TAG" >> "$cowork_file"
+      fi
+    done
+    mkdir -p "$HOME/.config/environment.d"
+    cat > "$HOME/.config/environment.d/claude-cowork.conf" <<EOF
+$${COWORK_TAG}
+COWORK_VM_BACKEND=host
+EOF
+    CLAUDE_WRAP_TAG="# managed-by-danger-template: claude-desktop-wrapper"
+    if [ -x /usr/bin/claude-desktop ] && ! grep -qF "$CLAUDE_WRAP_TAG" /usr/bin/claude-desktop 2>/dev/null; then
+      if [ ! -x /usr/bin/claude-desktop.real ]; then
+        sudo cp /usr/bin/claude-desktop /usr/bin/claude-desktop.real
+      fi
+      sudo tee /usr/bin/claude-desktop >/dev/null <<EOF
+#!/bin/sh
+$${CLAUDE_WRAP_TAG}
+exec env ELECTRON_DISABLE_SANDBOX=1 ELECTRON_OZONE_PLATFORM_HINT="$${ELECTRON_OZONE_PLATFORM_HINT:-auto}" COWORK_VM_BACKEND="$${COWORK_VM_BACKEND:-host}" \
+  /usr/bin/claude-desktop.real "$$@"
+EOF
+      sudo chmod 0755 /usr/bin/claude-desktop
+    fi
+
     # Asegurar /home/coder como HOME efectivo incluso si se ejecuta como root
     sudo mkdir -p /home/coder
     sudo chown "$USER:$USER" /home/coder || true
@@ -331,17 +359,35 @@ PY
     touch "$HOME/.codex/config.toml"
     # Migrar config antigua de chrome-devtools (formato bash -lc) si existe
     python3 - <<'PY'
-import re, os
+import os
 path = os.path.expanduser("~/.codex/config.toml")
 try:
-    with open(path) as f:
+    with open(path, encoding="utf-8") as f:
         content = f.read()
 except FileNotFoundError:
     content = ""
 if "[mcp_servers.chrome-devtools]" in content and '"bash"' in content:
-    content = re.sub(r'\n*\[mcp_servers\.chrome-devtools\][^\[]*', '', content, flags=re.DOTALL)
-    with open(path, 'w') as f:
-        f.write(content.rstrip('\n') + '\n')
+    lines = content.splitlines()
+    cleaned = []
+    i = 0
+    removed = False
+    while i < len(lines):
+        if lines[i].strip() == "[mcp_servers.chrome-devtools]":
+            j = i + 1
+            block = [lines[i]]
+            while j < len(lines) and not lines[j].lstrip().startswith("["):
+                block.append(lines[j])
+                j += 1
+            if '"bash"' in "\n".join(block):
+                removed = True
+                i = j
+                continue
+        cleaned.append(lines[i])
+        i += 1
+    if removed:
+        content = "\n".join(cleaned).rstrip("\n")
+        with open(path, "w", encoding="utf-8") as f:
+            f.write((content + "\n") if content else "")
 PY
     if ! grep -q '^\[mcp_servers\.chrome-devtools\]' "$HOME/.codex/config.toml" 2>/dev/null; then
       cat >> "$HOME/.codex/config.toml" <<'CODEXCFG'
@@ -1212,6 +1258,9 @@ resource "docker_container" "workspace" {
 
   # Para mejorar KasmVNC y navegadores
   shm_size = 2 * 1024 * 1024 * 1024
+  # seccomp=unconfined: necesario para bwrap (Claude Code/Desktop usan bwrap para sandbox bash)
+  # SYS_ADMIN solo no es suficiente; seccomp bloquea CLONE_NEWUSER incluso con esa capability
+  security_opts = ["seccomp=unconfined"]
   # Permitir FUSE/SSHFS y montajes remotos
   capabilities {
     add = ["SYS_ADMIN"]

workspaces/Developer/README.md

@@ -46,6 +46,7 @@ Workspace de desarrollo general, con **Docker in Docker (DinD)**, escritorio XFC
 - El daemon Docker se arranca dentro del contenedor (`dockerd` con overlay2) y guarda datos en `/var/lib/docker`.
 - Usa KasmVNC para escritorio XFCE (consola del workspace -> abrir URL de KasmVNC).
 - El contenedor lleva labels `com.centurylinklabs.watchtower.*` para auto-actualización vía Watchtower.
+- Claude Desktop fuerza `COWORK_VM_BACKEND=host` para que el modo cowork no intente usar `bwrap` dentro del contenedor.
 
 ### Limitaciones de DinD
 - No hay Swarm ni orquestador, por lo que `docker compose` ignora la sección `deploy.*` (incluidos `resources.reservations/limits`, `placement`, `replicas`); solo aplican los flags directos de `docker run`/`docker compose` como `--cpus` o `--memory`.

workspaces/Developer/main.tf

@@ -237,6 +237,34 @@ PULSECFG
     done
     unset _pa_try
 
+    # Configurar Claude Desktop cowork VM para usar HostBackend en Docker
+    # COWORK_VM_BACKEND=host evita que Claude Desktop use bwrap (que falla en contenedores)
+    # El contenedor Docker ya provee el aislamiento necesario
+    COWORK_TAG="# managed-by-developer-template: cowork-vm-backend"
+    for cowork_file in "$HOME/.xsessionrc" "$HOME/.profile"; do
+      if ! grep -qF "$COWORK_TAG" "$cowork_file" 2>/dev/null; then
+        printf '%s\nexport COWORK_VM_BACKEND=host\n' "$COWORK_TAG" >> "$cowork_file"
+      fi
+    done
+    mkdir -p "$HOME/.config/environment.d"
+    cat > "$HOME/.config/environment.d/claude-cowork.conf" <<EOF
+$${COWORK_TAG}
+COWORK_VM_BACKEND=host
+EOF
+    CLAUDE_WRAP_TAG="# managed-by-developer-template: claude-desktop-wrapper"
+    if [ -x /usr/bin/claude-desktop ] && ! grep -qF "$CLAUDE_WRAP_TAG" /usr/bin/claude-desktop 2>/dev/null; then
+      if [ ! -x /usr/bin/claude-desktop.real ]; then
+        sudo cp /usr/bin/claude-desktop /usr/bin/claude-desktop.real
+      fi
+      sudo tee /usr/bin/claude-desktop >/dev/null <<EOF
+#!/bin/sh
+$${CLAUDE_WRAP_TAG}
+exec env ELECTRON_DISABLE_SANDBOX=1 ELECTRON_OZONE_PLATFORM_HINT="$${ELECTRON_OZONE_PLATFORM_HINT:-auto}" COWORK_VM_BACKEND="$${COWORK_VM_BACKEND:-host}" \
+  /usr/bin/claude-desktop.real "$$@"
+EOF
+      sudo chmod 0755 /usr/bin/claude-desktop
+    fi
+
     # Asegurar /home/coder como HOME efectivo incluso si se ejecuta como root
     sudo mkdir -p /home/coder
     sudo chown "$USER:$USER" /home/coder || true
@@ -374,17 +402,35 @@ PY
     touch "$HOME/.codex/config.toml"
     # Migrar config antigua de chrome-devtools (formato bash -lc) si existe
     python3 - <<'PY'
-import re, os
+import os
 path = os.path.expanduser("~/.codex/config.toml")
 try:
-    with open(path) as f:
+    with open(path, encoding="utf-8") as f:
         content = f.read()
 except FileNotFoundError:
     content = ""
 if "[mcp_servers.chrome-devtools]" in content and '"bash"' in content:
-    content = re.sub(r'\n*\[mcp_servers\.chrome-devtools\][^\[]*', '', content, flags=re.DOTALL)
-    with open(path, 'w') as f:
-        f.write(content.rstrip('\n') + '\n')
+    lines = content.splitlines()
+    cleaned = []
+    i = 0
+    removed = False
+    while i < len(lines):
+        if lines[i].strip() == "[mcp_servers.chrome-devtools]":
+            j = i + 1
+            block = [lines[i]]
+            while j < len(lines) and not lines[j].lstrip().startswith("["):
+                block.append(lines[j])
+                j += 1
+            if '"bash"' in "\n".join(block):
+                removed = True
+                i = j
+                continue
+        cleaned.append(lines[i])
+        i += 1
+    if removed:
+        content = "\n".join(cleaned).rstrip("\n")
+        with open(path, "w", encoding="utf-8") as f:
+            f.write((content + "\n") if content else "")
 PY
     if ! grep -q '^\[mcp_servers\.chrome-devtools\]' "$HOME/.codex/config.toml" 2>/dev/null; then
       cat >> "$HOME/.codex/config.toml" <<'CODEXCFG'

workspaces/DeveloperAndroid/README.md

@@ -11,7 +11,7 @@ tags: [android, mobile, kde, workspace, makespace]
 Workspace gráfico KDE/KasmVNC con toolchain Android preinstalado. Usa la imagen `ghcr.io/makespacemadrid/coder-mks-developer-android:latest`.
 
 ## Qué incluye
-- Android SDK CLI con `platform-tools`, emulator y `cmdline-tools;latest` (instala tus propias plataformas/ build-tools según el proyecto).
+- Android SDK CLI en `/home/coder/Android/Sdk` con `platform-tools`, emulator y `cmdline-tools;latest` (instala tus propias plataformas/ build-tools según el proyecto).
 - Android Studio Otter 3 Feature Drop (2025.2.3.x).
 - Java 17, Node.js 22 (npm/pnpm/yarn), git/git-lfs y utilidades de desarrollo.
 - VS Code listo para personalizar tus extensiones (sin bundle preinstalado) y soporte C/C++ vía paquetes base.
@@ -37,6 +37,8 @@ Workspace gráfico KDE/KasmVNC con toolchain Android preinstalado. Usa la imagen
 
 ## Notas
 - Escritorio KDE vía KasmVNC; VS Code (web y desktop) listo para configurar a tu gusto.
+- El SDK Android canónico del workspace es `/home/coder/Android/Sdk`; `/opt/android-sdk` queda como compatibilidad para tooling heredado.
+- El emulador Android usa `-gpu swiftshader` por defecto para evitar cierres con `-gpu host` en escritorios remotos; puedes sobrescribirlo con `ANDROID_EMULATOR_DEFAULT_GPU` o pasando `-gpu` manualmente.
 - Bloqueo de pantalla/ahorro de energía deshabilitado para no interrumpir builds largos.
 - Botones JetBrains disponibles en el dashboard (IntelliJ IDEA remoto); instala el plugin de Android para emular Android Studio y requiere JetBrains Gateway/Coder Desktop.
 - Home persistente en `/home/coder` (volumen o bind mount según parámetros); labels de Watchtower habilitadas.