fix(docker): refresh installer SHAs + pin Claude Code to @latest channel#48
Merged
Merged
Conversation
…annel
Three coupled changes triggered by an attempted ckipper worktree
rebuild-image that failed in the uv step with sha256sum FAILED.
1. UV_INSTALLER_SHA256 refreshed (facbed3... -> d79d834...). The
astral.sh/uv/install.sh script drifted upstream since 2026-04-30.
This is what made the rebuild fail; ARG/SHA256 lockstep means the
build halts as soon as the pin diverges from the file on the wire.
2. CLAUDE_INSTALLER_SHA256 refreshed (b315b46... -> 005ec1a...).
Anthropic's bootstrap installer at claude.ai/install.sh also drifted
in the same window. Would have failed in the next step regardless.
3. The bootstrap installer accepts a positional arg
('stable' | 'latest' | a specific semver) that gets forwarded to
'claude install <target>'. Pass 'latest' so containers track the
same release channel as Homebrew's claude-code@latest cask. This
mirrors the host install when CLI users have done
brew install --cask claude-code@latest
The stable channel lags @latest by ~a week; pinning to @latest
removes that gap between host and container.
Validated by a from-scratch test build with --build-arg CACHEBUST=...
(all 11/11 steps succeeded; docker run --entrypoint claude
ckipper-dev-test --version reports 2.1.154, matching the host's
@latest cask).
Refreshing the SHAs in the same commit because they're co-located,
co-broken, and would have to be re-pinned together anyway.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Your
ck worktree rebuild-imagewas failing at step 3/11 withsha256sum: WARNING: 1 computed checksum did NOT matchon the uv installer. Both pinned installer SHAs in the Dockerfile had drifted upstream since 2026-04-30, and while we're in here, swap the Claude Code install to the@latestchannel so containers track the same release stream as the Homebrewclaude-code@latestcask.Three changes
UV_INSTALLER_SHA256refreshedfacbed3...→d79d834....astral.sh/uv/install.shdrifted; this is what made the build fail.CLAUDE_INSTALLER_SHA256refreshedb315b46...→005ec1a.... The Anthropic bootstrap also drifted in the same window.bash /tmp/install.sh→bash /tmp/install.sh latest. The bootstrap script accepts a positional channel argument (stable|latest| a specific semver) that gets forwarded toclaude install <target>. Passinglatestmirrors the host install when CLI users have donebrew install --cask claude-code@latest(stable cask lags @latest by ~a week).Validated
From-scratch build with
--build-arg CACHEBUST=$(date +%s):docker run --rm --entrypoint /usr/local/bin/claude ckipper-dev-test:latest --versionreports2.1.154 (Claude Code), matching the host's@latestcaskTest plan
claude --versionmatches host's@latestgit pull && ./install.sh && ck worktree rebuild-image