amplifier-bundle-containers

One Call, Full Container

14-step provisioning collapsed into one create call

The Chore

Agents need disposable containers — but hand-provisioning one is a 14-step chore

AI agents constantly need throwaway, isolated containers to run and test code. Doing it by hand is a well-defined 14-step routine, laid out as a table in the bundle's DESIGN.md "Convenience Gap."

So what happens when you collapse that table?

Check Docker/Podman is installed, running, and permitted
Pick a base image and choose the docker run flags
Mount the project; forward API keys, git, GH, and SSH
Apply dotfiles, then explain connect / clean-up / save-state

The Collapse

Steps 1–11 collapse into a single create call

The 14-step "Convenience Gap" table runs rows 1 through 14. The bundle collapses steps 1–11 into one containers(operation='create') call with smart defaults — the README states it turns "that 14-step process into one or two tool calls."

But one call is only worth it if it makes good choices for you.

14

manual steps in the Convenience Gap table

1–11

steps folded into one create call

The Catch

Collapsing the steps only helps if the create call is smart enough to choose well for you

Removing 11 manual steps is only leverage if the defaults underneath are right — the correct base image, the credentials that belong, and safety that holds. Otherwise "one call" just hides bad decisions.

The next three beats show how the single call earns that trust.

Smart Defaults

Purpose profiles pick the base image so you don't have to

7 PURPOSE_PROFILES (python, node, rust, go, general, amplifier, clean) are surfaced as 8 documented purposes. The 8th, try-repo, shallow-clones a repo and auto-detects language via REPO_MARKERS, falling back to "general."

With the image chosen, the call still has to wire up access safely.

Cargo.toml → rust
pyproject.toml / setup.py / requirements.txt → python
package.json → node
go.mod → go · no match → general

Credentials

A 17-pattern allowlist forwards credentials, guarded by a denylist

DEFAULT_ENV_PATTERNS is a 17-entry glob allowlist that auto-forwards keys like *_API_KEY, *_TOKEN, and ANTHROPIC_*. A NEVER_PASSTHROUGH denylist skips environment-specific vars before any glob match.

Convenient access — but the box itself still needs to be safe by construction.

17

glob patterns in the DEFAULT_ENV_PATTERNS allowlist

NEVER
PASSTHROUGH

denylist blocking PATH, HOME, SSH_AUTH_SOCK, and more

Hardened by Default

Every container is locked down before you ask

Containers launch with --security-opt=no-new-privileges, a 4g memory default, and a 256 pids limit. A two-phase user model runs as root during setup, then switches to a mapped host UID:GID user for exec — with an as_root override when needed.

So one call is safe. But does the agent actually know what happened?

4g

default memory limit

256

default pids limit

no-new-
privileges

security-opt set on every create

The Payoff

Every create hands back a structured provisioning report — nothing is a mystery

Each create returns a typed list of ProvisioningStep results — name, status, detail, error — with status in {success, skipped, failed, partial}. Steps are appended for env passthrough, git/GH/SSH forwarding, dotfiles, repos, and config files.

The agent knows exactly what happened, not just "it worked."

# ProvisioningStep(name, status, detail, error)
env_passthrough   success
forward_git       success
forward_gh        success
forward_ssh       skipped
dotfiles          success
repos             success
config_files      skipped

The Takeaway

One tool, 19 operations, five complete phases — provisioning becomes a call, not a chore

The containers tool exposes a single operation enum with 19 operations. Five phases — from Core MVP to Compose, repos, and config files — are all COMPLETE, tagged v0.2.0 on 2026-05-17. Built primarily by Brian Krabach (54 of 60 commits on main).

Hand-provisioning was 14 steps. Now it's a single create call that reports back.

19

operations on one tool

5

phases, all COMPLETE

v0.2.0

tagged 2026-05-17

Sources

Research Methodology

Data as of: commit 28ddf5b (HEAD of main), tag v0.2.0 (2026-05-17)

Feature status: Active — all five implementation phases COMPLETE

Primary source: canonical remote microsoft/amplifier-bundle-containers (local clone origin is the colombod fork, upstream is microsoft)

Research performed:

Convenience Gap table: sed -n '40,63p' DESIGN.md ; grep -n '14' README.md
Operation enum (19): sed -n '155,173p' __init__.py | grep -c '"'
Allowlist / denylist: sed -n '51,68p' provisioner.py ; sed -n '27,49p' provisioner.py
Purpose profiles & markers: regex-extract PURPOSE_PROFILES + sed -n '139,182p' images.py
Security defaults: grep -n 'no-new-privileges\|--memory\|pids-limit' __init__.py
ProvisioningStep: sed -n '16,24p' provisioner.py ; grep -n 'report.append' __init__.py
Timeline & contributors: git log --oneline ; git shortlog -sne --all
Tests: grep -rn 'def test_' tests/unit | wc -l (189 unit + 16 integration + 9 in module tests)

Gaps: DESIGN.md documents "160 tests (144 unit + 16 integration)" while live def test_ counts are higher (documentation lags source); pytest was not run for a collected count. Module pyproject version is 0.1.0 while the git tag is v0.2.0.

Primary contributors: Brian Krabach (54 of 60 commits on main); Salil Das (3), Diego Colombo (2), David Koleczek (1).