[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6HV932SWBGSCRS5E28D45EV":3,"skill-same:01M6HV932SWBGSCRS5E28D45EV":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":45,"linkOnly":46,"markdownContent":47,"markdownBody":48,"frontMatter":49,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":55,"ownerHtmlUrl":56,"ownerBlogUrl":6,"ownerDescription":57,"updatedAt":58,"install":59,"resources":72},"01M6HV932SWBGSCRS5E28D45EV","docker-customize",null,"Route a request to install a tool, binary, package, env var, persistent directory, side service, or personal\u002Fthird-party skill in the hermit Docker container to the first channel that can carry it. Apt packages go in the Dockerfile operator block; boot-time shell work goes in docker-entrypoint.hermit-local.sh; compose and Dockerfile only when nothing else fits. Activates on messages like \"install skills in the container\", \"install gog in the container\", \"add an apt package\", \"download a binary into the container\", \"set a container env var\", \"add a volume or port to compose\".","gtapps\u002Fhermitd","gtapps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F16778396?v=4","01M6HTX8TNTPQN3NXRVA63VHTH","01M6HTX8Z23S531ZPPA5DKJVD0",85,"MIT","https:\u002F\u002Fgithub.com\u002Fgtapps\u002Fhermitd\u002Fblob\u002Fmain\u002Fplugins\u002Fhermitd\u002Fskills\u002Fdocker-customize\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44],"docker customize","docker","customize","work","when","request","port","local","volume","time","route","only","install","directory","SET","messages","operator","packages","dockerfile","go","gog","personal","2026-11-10 10:12:30",false,"---\nname: docker-customize\ndescription: Route a request to install a tool, binary, package, env var, persistent directory, side service, or personal\u002Fthird-party skill in the hermit Docker container to the first channel that can carry it. Apt packages go in the Dockerfile operator block; boot-time shell work goes in docker-entrypoint.hermit-local.sh; compose and Dockerfile only when nothing else fits. Activates on messages like \"install skills in the container\", \"install gog in the container\", \"add an apt package\", \"download a binary into the container\", \"set a container env var\", \"add a volume or port to compose\".\n---\n\n# Docker Customize\n\nLand a container change in the first channel that can carry it, in the order below. Files sit on the project bind mount, so this skill runs from inside the container or on the host. Rebuild, restart, and compose validation are host-only (the image has no Docker CLI): name the command for the operator, do not run it from inside the container.\n\nFor installing or importing personal and third-party skills, read only the \"Personal and third-party skills in Docker\" section in `${CLAUDE_PLUGIN_ROOT}\u002Fdocs\u002Fcreating-your-own-hermit.md` ([guide](..\u002F..\u002Fdocs\u002Fcreating-your-own-hermit.md#personal-and-third-party-skills-in-docker)). Use the sections below for any required dependencies or container configuration.\n\nWhen deployment context is needed, read `runtime_mode` from `.hermit\u002Fstate\u002Fruntime.json`. Before environment-dependent commands, locate the current shell with `[ -f \u002F.dockerenv ] || [ -f \u002Frun\u002F.containerenv ] && echo container || echo host`, the check used by `docker-setup`. Recorded deployment mode does not locate the current shell: a host session can manage a Docker Hermit's shared project. Do not use `$TMUX` to distinguish them; Docker also runs Claude inside tmux. Keep rebuild, restart, and compose validation on the host as above.\n\n## 1. Apt package\n\nThe container runs as `USER claude` with `cap_drop: ALL` and `no-new-privileges`, so nothing installs a package at runtime. It has to be in the image.\n\nAdd it inside the operator block of `Dockerfile.hermit` (between `# --- operator:` and `# --- end operator ---`):\n\n```dockerfile\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n      \u003Cpkg> \u003Cpkg> && \\\n    rm -rf \u002Fvar\u002Flib\u002Fapt\u002Flists\u002F*\n```\n\nA Dockerfile rendered before the operator block existed has no such markers. Add the block yourself, between the `gh` install layer and the `# Match host UID` comment, then put the `RUN` inside it:\n\n```dockerfile\n# --- operator: root-context installs go here; upgrades merge around this block ---\n#\n# --- end operator ---\n```\n\nThen rebuild on the host: `hermitd restart --build` (it needs the container running; from stopped, `hermitd start --build`).\n\nTell the operator: `docker.packages` in `config.json` is read only when the templates are rendered, so setting it installs nothing on its own. Re-check the file after an upgrade.\n\n## 2. Boot-time shell\n\nIf a shell can do it at boot, put it in `\u003Cproject-root>\u002Fdocker-entrypoint.hermit-local.sh`. Persist files under `.claude.local\u002F` (bind-mounted, gitignored). Upgrades never touch the sidecar.\n\nThe managed entrypoint sources the sidecar twice, with `HERMIT_ENTRY_PHASE` naming which:\n\n- `pre-boot`: channel dirs exist, env resolved, before plugins install. Env, directories, downloads, `pip` \u002F `npm -g`, pre-session checks.\n- `pre-launch`: immediately before `hermitd-start`. Side services, last-second overrides.\n\nIt inherits `set -euo pipefail`. Guard optional commands with `|| true`. Anchor every path to `${PROJECT_DIR}`, which the managed entrypoint exports: the sidecar is sourced into that shell, so a bare relative path lands in the wrong tree as soon as an earlier block has `cd`'d, and it cannot be replayed from a session with a different cwd. Create the file with `#!\u002Fusr\u002Fbin\u002Fenv bash` if absent (it is sourced, so no `chmod +x`). Append; never overwrite existing content. Run `bash -n` on the file after writing it. Run the same commands once now so they take effect this session.\n\nApplies on `hermitd restart`. No rebuild.\n\nShape of an appended block:\n\n```bash\n# --- operator: \u003Cwhat> ---\nif [ \"$HERMIT_ENTRY_PHASE\" = pre-boot ]; then\n  mkdir -p \"${PROJECT_DIR}\u002F.claude.local\u002F\u003Cname>\"\n  curl -fsSL \u003Curl> -o \"${PROJECT_DIR}\u002F.claude.local\u002F\u003Cname>\u002F\u003Cbin>\"\n  chmod +x \"${PROJECT_DIR}\u002F.claude.local\u002F\u003Cname>\u002F\u003Cbin>\"\n  export PATH=\"${PROJECT_DIR}\u002F.claude.local\u002F\u003Cname>:${PATH}\"\nfi\n```\n\n## 3. Compose or Dockerfile only\n\nIf only `docker-compose.hermit.yml` or `Dockerfile.hermit` can carry it (volumes, ports, capabilities, base image), edit as one contiguous block with a leading comment — in `Dockerfile.hermit` that block is the operator block from § 1. Validate a compose edit on the host with `docker compose -f docker-compose.hermit.yml config -q`, adding `-f docker-compose.security.yml` when that file exists so the check covers what the wrapper actually builds: the host wrapper refuses every `up` and `build` on a file that does not parse.\n\n`hermit-evolve` reconciles the file against the baseline `docker-setup` recorded: with a baseline and an upstream move `evolve-apply` prepares the 3-way merge and the hermit reviews a clean merge or resolves overlapping lines before installing it; with no baseline the file is kept, the upstream copy parked under `.hermit\u002Fstate\u002F`, and the operator told; with no upstream move the file is left alone. Re-check the block after every evolve.\n\n\n### Merge a parked upstream copy\n\nWhen the operator asks to merge a parked `Dockerfile.hermit` or `docker-compose.hermit.yml`:\n\n1. Select that file's newest `.hermit\u002Fstate\u002F\u003Cname>.\u003Ctimestamp>.upstream` and keep its adjacent `.upstream.json` receipt. Read [hermit-evolve reference §5d](..\u002Fhermit-evolve\u002Freference.md#5d-merge-compose-and-dockerfile-template-changes-in-place) for the merge procedure and structural checks.\n2. Save the current project file to a timestamped `.bak` under `.hermit\u002Fstate\u002F`. With a verified `base_path`, follow §5d's `git merge-file` procedure and resolve only conflict regions. Without a verified base, merge the parked upstream changes into a scratch copy while preserving operator edits, including the Dockerfile operator block and custom git identity mount. Never treat the whole parked file as a replacement for a customized project file.\n3. Run §5d's checks on the scratch copy: no conflict markers; compose parses as one document with `services.hermit` and `volumes`; Dockerfile retains `FROM`, build arguments, entrypoint copy and a final non-root `USER`. Install only a checked merge. On the host, validate compose with the security overlay when present.\n4. Run `bun ${CLAUDE_PLUGIN_ROOT}\u002Fscripts\u002Fevolve-plan.ts .hermit adopt \u003Cfile>`, where `\u003Cfile>` is exactly `Dockerfile.hermit` or `docker-compose.hermit.yml`. It validates the parked candidate and project merge, then records the current upstream baseline and removes the parked copies. If refused, report the reason; never bypass it by seeding a baseline manually.\n5. After `status: \"adopted\"`, ask the host operator to run `hermitd update`. Later upgrades can merge against the recorded baseline.\n","# Docker Customize\n\nLand a container change in the first channel that can carry it, in the order below. Files sit on the project bind mount, so this skill runs from inside the container or on the host. Rebuild, restart, and compose validation are host-only (the image has no Docker CLI): name the command for the operator, do not run it from inside the container.\n\nFor installing or importing personal and third-party skills, read only the \"Personal and third-party skills in Docker\" section in `${CLAUDE_PLUGIN_ROOT}\u002Fdocs\u002Fcreating-your-own-hermit.md` ([guide](..\u002F..\u002Fdocs\u002Fcreating-your-own-hermit.md#personal-and-third-party-skills-in-docker)). Use the sections below for any required dependencies or container configuration.\n\nWhen deployment context is needed, read `runtime_mode` from `.hermit\u002Fstate\u002Fruntime.json`. Before environment-dependent commands, locate the current shell with `[ -f \u002F.dockerenv ] || [ -f \u002Frun\u002F.containerenv ] && echo container || echo host`, the check used by `docker-setup`. Recorded deployment mode does not locate the current shell: a host session can manage a Docker Hermit's shared project. Do not use `$TMUX` to distinguish them; Docker also runs Claude inside tmux. Keep rebuild, restart, and compose validation on the host as above.\n\n## 1. Apt package\n\nThe container runs as `USER claude` with `cap_drop: ALL` and `no-new-privileges`, so nothing installs a package at runtime. It has to be in the image.\n\nAdd it inside the operator block of `Dockerfile.hermit` (between `# --- operator:` and `# --- end operator ---`):\n\n```dockerfile\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n      \u003Cpkg> \u003Cpkg> && \\\n    rm -rf \u002Fvar\u002Flib\u002Fapt\u002Flists\u002F*\n```\n\nA Dockerfile rendered before the operator block existed has no such markers. Add the block yourself, between the `gh` install layer and the `# Match host UID` comment, then put the `RUN` inside it:\n\n```dockerfile\n# --- operator: root-context installs go here; upgrades merge around this block ---\n#\n# --- end operator ---\n```\n\nThen rebuild on the host: `hermitd restart --build` (it needs the container running; from stopped, `hermitd start --build`).\n\nTell the operator: `docker.packages` in `config.json` is read only when the templates are rendered, so setting it installs nothing on its own. Re-check the file after an upgrade.\n\n## 2. Boot-time shell\n\nIf a shell can do it at boot, put it in `\u003Cproject-root>\u002Fdocker-entrypoint.hermit-local.sh`. Persist files under `.claude.local\u002F` (bind-mounted, gitignored). Upgrades never touch the sidecar.\n\nThe managed entrypoint sources the sidecar twice, with `HERMIT_ENTRY_PHASE` naming which:\n\n- `pre-boot`: channel dirs exist, env resolved, before plugins install. Env, directories, downloads, `pip` \u002F `npm -g`, pre-session checks.\n- `pre-launch`: immediately before `hermitd-start`. Side services, last-second overrides.\n\nIt inherits `set -euo pipefail`. Guard optional commands with `|| true`. Anchor every path to `${PROJECT_DIR}`, which the managed entrypoint exports: the sidecar is sourced into that shell, so a bare relative path lands in the wrong tree as soon as an earlier block has `cd`'d, and it cannot be replayed from a session with a different cwd. Create the file with `#!\u002Fusr\u002Fbin\u002Fenv bash` if absent (it is sourced, so no `chmod +x`). Append; never overwrite existing content. Run `bash -n` on the file after writing it. Run the same commands once now so they take effect this session.\n\nApplies on `hermitd restart`. No rebuild.\n\nShape of an appended block:\n\n```bash\n# --- operator: \u003Cwhat> ---\nif [ \"$HERMIT_ENTRY_PHASE\" = pre-boot ]; then\n  mkdir -p \"${PROJECT_DIR}\u002F.claude.local\u002F\u003Cname>\"\n  curl -fsSL \u003Curl> -o \"${PROJECT_DIR}\u002F.claude.local\u002F\u003Cname>\u002F\u003Cbin>\"\n  chmod +x \"${PROJECT_DIR}\u002F.claude.local\u002F\u003Cname>\u002F\u003Cbin>\"\n  export PATH=\"${PROJECT_DIR}\u002F.claude.local\u002F\u003Cname>:${PATH}\"\nfi\n```\n\n## 3. Compose or Dockerfile only\n\nIf only `docker-compose.hermit.yml` or `Dockerfile.hermit` can carry it (volumes, ports, capabilities, base image), edit as one contiguous block with a leading comment — in `Dockerfile.hermit` that block is the operator block from § 1. Validate a compose edit on the host with `docker compose -f docker-compose.hermit.yml config -q`, adding `-f docker-compose.security.yml` when that file exists so the check covers what the wrapper actually builds: the host wrapper refuses every `up` and `build` on a file that does not parse.\n\n`hermit-evolve` reconciles the file against the baseline `docker-setup` recorded: with a baseline and an upstream move `evolve-apply` prepares the 3-way merge and the hermit reviews a clean merge or resolves overlapping lines before installing it; with no baseline the file is kept, the upstream copy parked under `.hermit\u002Fstate\u002F`, and the operator told; with no upstream move the file is left alone. Re-check the block after every evolve.\n\n\n### Merge a parked upstream copy\n\nWhen the operator asks to merge a parked `Dockerfile.hermit` or `docker-compose.hermit.yml`:\n\n1. Select that file's newest `.hermit\u002Fstate\u002F\u003Cname>.\u003Ctimestamp>.upstream` and keep its adjacent `.upstream.json` receipt. Read [hermit-evolve reference §5d](..\u002Fhermit-evolve\u002Freference.md#5d-merge-compose-and-dockerfile-template-changes-in-place) for the merge procedure and structural checks.\n2. Save the current project file to a timestamped `.bak` under `.hermit\u002Fstate\u002F`. With a verified `base_path`, follow §5d's `git merge-file` procedure and resolve only conflict regions. Without a verified base, merge the parked upstream changes into a scratch copy while preserving operator edits, including the Dockerfile operator block and custom git identity mount. Never treat the whole parked file as a replacement for a customized project file.\n3. Run §5d's checks on the scratch copy: no conflict markers; compose parses as one document with `services.hermit` and `volumes`; Dockerfile retains `FROM`, build arguments, entrypoint copy and a final non-root `USER`. Install only a checked merge. On the host, validate compose with the security overlay when present.\n4. Run `bun ${CLAUDE_PLUGIN_ROOT}\u002Fscripts\u002Fevolve-plan.ts .hermit adopt \u003Cfile>`, where `\u003Cfile>` is exactly `Dockerfile.hermit` or `docker-compose.hermit.yml`. It validates the parked candidate and project merge, then records the current upstream baseline and removes the parked copies. If refused, report the reason; never bypass it by seeding a baseline manually.\n5. After `status: \"adopted\"`, ask the host operator to run `hermitd update`. Later upgrades can merge against the recorded baseline.\n",{"name":5,"description":7},"main","79e254360ba999b70a827541bbcfd2d4cc525992","plugins\u002Fhermitd\u002Fskills\u002Fdocker-customize",16,"https:\u002F\u002Fgithub.com\u002Fgtapps\u002Fhermitd","https:\u002F\u002Fhermitd.dev","https:\u002F\u002Fgithub.com\u002Fgtapps","Software engineer from Portugal.\r\nBuilding and deploying agents for real companies.","2026-11-14 03:31:41",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add gtapps\u002Fhermitd --skill docker-customize",{"tool":65,"command":66},"bunx","bunx skills add gtapps\u002Fhermitd --skill docker-customize",{"tool":68,"command":69},"pnpm","pnpm dlx skills add gtapps\u002Fhermitd --skill docker-customize","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgtapps\u002Fhermitd\u002Fblob\u002Fmain\u002Fplugins\u002Fhermitd\u002Fskills\u002Fdocker-customize\u002FSKILL.md",true,[],[74,90,105,131,147,156],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":80,"publishedAt":45},"01M718AB18DTYHVGXA6VF1VVR2","dream","Nightly memory maintenance from transcript ground truth. Verifies, enriches and tidies auto-memory and topic pages with snapshot validation and undo. Also handles 'undo the dream'.","https:\u002F\u002Fgithub.com\u002Fgtapps\u002Fhermitd\u002Fblob\u002Fmain\u002Fplugins\u002Fhermitd\u002Fskills\u002Fdream\u002FSKILL.md",[],[76,81,82,83,84,85,86,87,88,89],"with","maintenance","memory","validation","snapshot","pages","auto","memory maintenance","transcript",{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":45},"01M6HVD4WX8RB5EKH49HM66M8X","when-done-switch-to","Arm a deferred model or effort switch. Use for \"when done switch to\", \"after this drop to sonnet\", or \"switch model when idle\".","https:\u002F\u002Fgithub.com\u002Fgtapps\u002Fhermitd\u002Fblob\u002Fmain\u002Fplugins\u002Fhermitd\u002Fskills\u002Fwhen-done-switch-to\u002FSKILL.md",[],[27,97,98,99,100,101,102,103,104],"done","switch","when done switch to","for","model","use","drop","sonnet",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":45},"01M6HVD0ZA2Q1RD7CA0X8VWF3T","weekly-review","Generate the weekly review report for the current ISO week. Writes to .hermit\u002Fcompiled\u002Freview-weekly-YYYY-Www.md (dev-facing detail) and sends a plain-language channel summary (Delivered \u002F Decisions \u002F Waiting on you \u002F Spend). Runs every Sunday at 23:00 via routine.","https:\u002F\u002Fgithub.com\u002Fgtapps\u002Fhermitd\u002Fblob\u002Fmain\u002Fplugins\u002Fhermitd\u002Fskills\u002Fweekly-review\u002FSKILL.md",[],[112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,100,127,128,129,130],"weekly review","review","weekly","hermit","plain","routine","channel","summary","report","at","generate","via","decisions","you","detail","iso","review report","dev","plain-language",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":137,"publishedAt":45},"01M6HVCW8PHZXSPYAZQBZXB9DX","watch","Background events via the config watch monitor or ad-hoc Monitor tool. Quiet watches cost zero tokens.","https:\u002F\u002Fgithub.com\u002Fgtapps\u002Fhermitd\u002Fblob\u002Fmain\u002Fplugins\u002Fhermitd\u002Fskills\u002Fwatch\u002FSKILL.md",[],[133,138,139,140,141,142,143,144,145,123,146],"monitor","ZeRO","tokens","tool","cost","ad","config","background","events",{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":153,"publishedAt":45},"01M6HVCRMG53K3Y63WAH59YVFJ","watch-activate","Activate the config watch monitor.","https:\u002F\u002Fgithub.com\u002Fgtapps\u002Fhermitd\u002Fblob\u002Fmain\u002Fplugins\u002Fhermitd\u002Fskills\u002Fwatch-activate\u002FSKILL.md",[],[133,154,155,138,144],"activate","watch activate",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":165,"publishedAt":45},"01M6HVCK6782RD4D9ADQY0ENKD","voice-notes","Transcribe and respond to voice notes. Activates when any channel message carries an audio attachment, or when asked to transcribe an inbound voice message.","https:\u002F\u002Fgithub.com\u002Fgtapps\u002Fhermitd\u002Fblob\u002Fmain\u002Fplugins\u002Fhermitd\u002Fskills\u002Fvoice-notes\u002FSKILL.md",[162],{"categoryNo":163,"categoryName":164,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000016","图像与多媒体",[166,167,168,37,169,170,39,171,172,173,115,27,174,175,176,177,178,179,125,180],"notes","voice","voice notes","Audio","transcribe","understand","transcription","my","read","message","can","telegram","channel message","discord","up"]