fix: require ANTHROPIC_API_KEY for Claude Code auth in VNC container

Browser-based OAuth login does not work inside the VNC session because the OAuth redirect callback cannot reach back into the container. The solution is to set ANTHROPIC_API_KEY in the Kubernetes secret — when this env var is present, Claude Code skips browser auth entirely. Changes: - init-repo.sh: warn clearly at startup if ANTHROPIC_API_KEY is unset - values.yaml: document ANTHROPIC_API_KEY in the envSecretName comment - VARIABLES.md: add ANTHROPIC_API_KEY entry and update secret template Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-02-20 09:24:54 -05:00
31 changed files with 1511 additions and 3299 deletions
@@ -1,9 +0,0 @@
 {
  "enabledMcpjsonServers": [
    "kubernetes",
    "flux",
    "playwright",
    "github",
    "pgtuner"
  ]
 }
@@ -1,94 +0,0 @@
 # CI/CD Pipeline Guide
 ## 🚀 Simplified Pipeline - Only 3 Workflows!
 ### 1️⃣ For Releases → **Unified Release**
 Use this for all version releases:
 1. Go to [Actions → Unified Release](https://github.com/cpfarhood/devcontainer/actions/workflows/release-unified.yaml)
 2. Click "Run workflow"
 3. Either:
   - Enter specific version (e.g., `0.2.1`), OR
   - Choose release type (patch/minor/major) for auto-increment
 4. Click "Run workflow"
 **This single workflow does EVERYTHING:**
 - ✅ Updates chart version
 - ✅ Creates git tag
 - ✅ Builds Docker image with all proper tags
 - ✅ Publishes Helm chart to GHCR
 - ✅ Creates GitHub Release with changelog
 - ✅ No more `[skip ci]` blocking builds!
 ### 2️⃣ For Quick Fixes → **Quick Fix Build**
 Use this for emergency fixes without version changes:
 1. Go to [Actions → Quick Fix Build](https://github.com/cpfarhood/devcontainer/actions/workflows/quick-fix.yaml)
 2. Click "Run workflow"
 3. Enter tag (default: `latest`)
 4. Click "Run workflow"
 **Just builds and pushes Docker image** - no version bumps, no releases.
 ### 3️⃣ Automatic CI → **Build and Push**
 Runs automatically on:
 - Pull requests (builds but doesn't push)
 - Tags starting with `v*` (builds and pushes)
 - Manual trigger available
 ## Workflow Files
 | Workflow | File | Purpose | When to Use |
 |----------|------|---------|-------------|
 | **Unified Release** | `release-unified.yaml` | Full release process | New versions |
 | **Quick Fix Build** | `quick-fix.yaml` | Docker build only | Hotfixes |
 | **Build and Push** | `build-and-push.yaml` | CI/CD automation | PRs & tags |
 ## Examples
 ### Release a new version
 ```bash
 # Via GitHub UI (Recommended):
 # Go to Actions → Unified Release → Run workflow
 # Via GitHub CLI:
 gh workflow run release-unified.yaml -f version=0.2.1
 # OR auto-increment:
 gh workflow run release-unified.yaml -f release_type=patch
 ```
 ### Push a quick fix
 ```bash
 # Via GitHub UI:
 # Go to Actions → Quick Fix Build → Run workflow
 # Via GitHub CLI:
 gh workflow run quick-fix.yaml -f tag=hotfix-1
 ```
 ### Check workflow status
 ```bash
 # List all recent runs
 gh run list --limit 5
 # Watch a specific workflow
 gh run watch
 ```
 ## Version Strategy
 - **Major** (1.0.0): Breaking changes
 - **Minor** (0.2.0): New features
 - **Patch** (0.2.1): Bug fixes
 ## What We Fixed
 ### Before (Nightmare 😱)
 - Auto-version-bump with `[skip ci]` prevented Docker builds
 - 6+ disconnected workflows
 - Manual tag deletion and re-pushing
 - Version conflicts everywhere
 ### After (Simple! 🎉)
 - **3 total workflows** (down from 6+)
 - **1 button** for complete releases
 - **No more `[skip ci]`** blocking builds
 - **Clear separation** of concerns
@@ -4,6 +4,8 @@ on:
  push:
    branches:
      - main
    tags:
      - 'v*'
  pull_request:
    branches:
      - main
@@ -16,9 +18,6 @@ env:
 jobs:
  build-and-push:
    runs-on: ubuntu-latest
    # Skip builds triggered by release-unified.yaml commits (github-actions[bot])
    # to prevent racing with the release workflow's own Docker build
    if: github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request' || github.actor != 'github-actions[bot]'
    permissions:
      contents: read
      packages: write
@@ -47,6 +46,9 @@ jobs:
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=sha,prefix=sha-
            type=raw,value=latest,enable={{is_default_branch}}
@@ -0,0 +1,57 @@
 name: Publish Helm Chart
 on:
  push:
    branches:
      - main
    paths:
      - 'chart/**'
  workflow_dispatch:
 permissions:
  contents: write
  packages: write
 jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Helm
        uses: azure/setup-helm@v4
      - name: Bump patch version
        id: bump
        run: |
          CURRENT=$(grep '^version:' chart/Chart.yaml | awk '{print $2}')
          MAJOR=$(echo $CURRENT | cut -d. -f1)
          MINOR=$(echo $CURRENT | cut -d. -f2)
          PATCH=$(echo $CURRENT | cut -d. -f3)
          NEW_VERSION="${MAJOR}.${MINOR}.$((PATCH + 1))"
          sed -i "s/^version: .*/version: ${NEW_VERSION}/" chart/Chart.yaml
          echo "version=${NEW_VERSION}" >> $GITHUB_OUTPUT
      - name: Commit version bump
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add chart/Chart.yaml
          git commit -m "chore: bump chart version to ${{ steps.bump.outputs.version }} [skip ci]"
          git push
      - name: Log in to GHCR
        run: |
          helm registry login ghcr.io \
            --username ${{ github.actor }} \
            --password ${{ secrets.GITHUB_TOKEN }}
      - name: Package chart
        run: helm package chart/
      - name: Push chart to GHCR
        run: |
          helm push devcontainer-${{ steps.bump.outputs.version }}.tgz oci://ghcr.io/cpfarhood/charts
@@ -1,54 +0,0 @@
 name: Quick Fix Build
 on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag for the image (defaults to latest)'
        required: false
        default: 'latest'
        type: string
 env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
 jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and Push
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.inputs.tag }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64
      - name: Summary
        run: |
          echo "## ✅ Quick Fix Build Complete" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Images Published:" >> $GITHUB_STEP_SUMMARY
          echo "- \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.inputs.tag }}\`" >> $GITHUB_STEP_SUMMARY
          echo "- \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY
@@ -1,159 +0,0 @@
 name: Unified Release
 on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to release (e.g., 0.1.25)'
        required: true
        type: string
      release_type:
        description: 'Release type'
        required: true
        default: 'patch'
        type: choice
        options:
          - patch
          - minor
          - major
 env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
 jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Set up Helm
        uses: azure/setup-helm@v4
      - name: Configure Git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
      - name: Determine Version
        id: version
        run: |
          if [ "${{ github.event.inputs.version }}" != "" ]; then
            VERSION="${{ github.event.inputs.version }}"
          else
            # Auto-determine next version based on release type
            CURRENT=$(grep '^version:' chart/Chart.yaml | awk '{print $2}')
            MAJOR=$(echo $CURRENT | cut -d. -f1)
            MINOR=$(echo $CURRENT | cut -d. -f2)
            PATCH=$(echo $CURRENT | cut -d. -f3)
            case "${{ github.event.inputs.release_type }}" in
              major)
                VERSION="$((MAJOR + 1)).0.0"
                ;;
              minor)
                VERSION="${MAJOR}.$((MINOR + 1)).0"
                ;;
              patch)
                VERSION="${MAJOR}.${MINOR}.$((PATCH + 1))"
                ;;
            esac
          fi
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
          echo "tag=v${VERSION}" >> $GITHUB_OUTPUT
          echo "🚀 Releasing version ${VERSION}"
      - name: Update Chart Version
        run: |
          sed -i "s/^version: .*/version: ${{ steps.version.outputs.version }}/" chart/Chart.yaml
          git add chart/Chart.yaml
          git commit -m "chore: release version ${{ steps.version.outputs.version }}"
      - name: Create and Push Tag
        run: |
          git tag -a "${{ steps.version.outputs.tag }}" -m "Release ${{ steps.version.outputs.tag }}"
          git push origin main
          git push origin "${{ steps.version.outputs.tag }}"
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and Push Docker Image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64
      - name: Package Helm Chart
        run: |
          helm registry login ghcr.io \
            --username ${{ github.actor }} \
            --password ${{ secrets.GITHUB_TOKEN }}
          helm package chart/
          helm push devcontainer-${{ steps.version.outputs.version }}.tgz oci://ghcr.io/cpfarhood/charts
      - name: Generate Release Notes
        id: notes
        run: |
          # Get commits since last tag
          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
          if [ -z "$PREV_TAG" ]; then
            COMMITS=$(git log --pretty=format:"- %s (%h)" HEAD)
          else
            COMMITS=$(git log --pretty=format:"- %s (%h)" ${PREV_TAG}..HEAD)
          fi
          cat << EOF > release-notes.md
          ## 🚀 Release ${{ steps.version.outputs.version }}
          ### Changes
          ${COMMITS}
          ### Docker Image
          \`\`\`bash
          docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}
          \`\`\`
          ### Helm Chart
          \`\`\`bash
          helm install devcontainer oci://ghcr.io/cpfarhood/charts/devcontainer --version ${{ steps.version.outputs.version }}
          \`\`\`
          EOF
          echo "notes<<EOF" >> $GITHUB_OUTPUT
          cat release-notes.md >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT
      - name: Create GitHub Release
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ steps.version.outputs.tag }}
          release_name: Release ${{ steps.version.outputs.tag }}
          body: ${{ steps.notes.outputs.notes }}
          draft: false
          prerelease: false
@@ -0,0 +1,51 @@
 name: Release
 on:
  push:
    tags:
      - 'v*'
 permissions:
  contents: write
  packages: write
 jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Generate Release Notes
        id: notes
        run: |
          # Get the tag message or generate from commits
          TAG_MESSAGE=$(git tag -l --format='%(contents)' ${{ github.ref_name }})
          if [ -z "$TAG_MESSAGE" ]; then
            # Generate from commit messages since last tag
            PREV_TAG=$(git describe --tags --abbrev=0 ${{ github.ref_name }}^ 2>/dev/null || echo "")
            if [ -z "$PREV_TAG" ]; then
              COMMITS=$(git log --pretty=format:"- %s (%h)" ${{ github.ref_name }})
            else
              COMMITS=$(git log --pretty=format:"- %s (%h)" ${PREV_TAG}..${{ github.ref_name }})
            fi
            NOTES="## Changes\n\n${COMMITS}\n\n## Docker Image\n\n\`\`\`bash\ndocker pull ghcr.io/${{ github.repository }}:${{ github.ref_name }}\n\`\`\`"
          else
            NOTES="${TAG_MESSAGE}\n\n## Docker Image\n\n\`\`\`bash\ndocker pull ghcr.io/${{ github.repository }}:${{ github.ref_name }}\n\`\`\`"
          fi
          echo "notes<<EOF" >> $GITHUB_OUTPUT
          echo -e "$NOTES" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT
      - name: Create Release
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          tag_name: ${{ github.ref_name }}
          release_name: Release ${{ github.ref_name }}
          body: ${{ steps.notes.outputs.notes }}
          draft: false
          prerelease: false
@@ -0,0 +1,259 @@
 # Release Process
 This document describes how to create releases for this project.
 ## Semantic Versioning
 We follow [Semantic Versioning 2.0.0](https://semver.org/):
 - **MAJOR** version (v2.0.0): Incompatible API/breaking changes
 - **MINOR** version (v1.1.0): New features, backwards compatible
 - **PATCH** version (v1.0.1): Bug fixes, backwards compatible
 ## Creating a Release
 ### Method 1: Using GitHub CLI (Recommended)
 ```bash
 # Ensure you're on main branch and up to date
 git checkout main
 git pull
 # Create and push a tag
 VERSION="v1.0.0"  # Change this
 git tag -a "$VERSION" -m "Release $VERSION
 ## What's New
 - Feature 1
 - Feature 2
 - Bug fix 1
 ## Docker Image
 \`\`\`bash
 docker pull ghcr.io/cpfarhood/devcontainer:$VERSION
 \`\`\`
 "
 git push origin "$VERSION"
 # The GitHub Actions workflow will automatically:
 # 1. Build the Docker image
 # 2. Push to ghcr.io with multiple tags
 # 3. Create a GitHub release with notes
 ```
 ### Method 2: Using Git Tags Only
 ```bash
 git checkout main
 git pull
 # Create annotated tag
 git tag -a v1.0.0 -m "Release v1.0.0"
 # Push tag
 git push origin v1.0.0
 ```
 ### Method 3: Using GitHub Web UI
 1. Go to https://github.com/cpfarhood/devcontainer/releases
 2. Click "Draft a new release"
 3. Click "Choose a tag"
 4. Type the new version (e.g., `v1.0.0`)
 5. Click "Create new tag on publish"
 6. Fill in the release title and description
 7. Click "Publish release"
 ## What Happens Automatically
 When you push a version tag (`v*`), GitHub Actions will:
 1. **Build Docker image** with multiple tags:
   - `ghcr.io/cpfarhood/devcontainer:v1.2.3` (exact version)
   - `ghcr.io/cpfarhood/devcontainer:1.2` (minor version)
   - `ghcr.io/cpfarhood/devcontainer:1` (major version)
   - `ghcr.io/cpfarhood/devcontainer:latest` (if on default branch)
 2. **Create GitHub Release** with:
   - Auto-generated release notes from commits
   - Docker pull command in the description
 ## Version Bump Guidelines
 ### Patch Release (v1.0.X)
 - Bug fixes
 - Documentation updates
 - Minor dependency updates
 - No new features
 - No breaking changes
 **Example:** v1.0.1
 ```bash
 git tag -a v1.0.1 -m "Release v1.0.1 - Bug fixes"
 git push origin v1.0.1
 ```
 ### Minor Release (v1.X.0)
 - New features
 - New optional configuration variables
 - Enhancements to existing features
 - Backwards compatible
 - No breaking changes
 **Example:** v1.1.0
 ```bash
 git tag -a v1.1.0 -m "Release v1.1.0 - New Happy Coder features"
 git push origin v1.1.0
 ```
 ### Major Release (vX.0.0)
 - Breaking changes
 - Required configuration changes
 - Removal of deprecated features
 - Incompatible API changes
 **Example:** v2.0.0
 ```bash
 git tag -a v2.0.0 -m "Release v2.0.0 - Breaking: New storage architecture"
 git push origin v2.0.0
 ```
 ## Pre-releases
 For alpha, beta, or release candidates:
 ```bash
 # Alpha
 git tag -a v1.1.0-alpha.1 -m "Release v1.1.0-alpha.1"
 git push origin v1.1.0-alpha.1
 # Beta
 git tag -a v1.1.0-beta.1 -m "Release v1.1.0-beta.1"
 git push origin v1.1.0-beta.1
 # Release Candidate
 git tag -a v1.1.0-rc.1 -m "Release v1.1.0-rc.1"
 git push origin v1.1.0-rc.1
 ```
 ## Release Checklist
 Before creating a release:
 - [ ] All tests pass
 - [ ] Documentation is up to date
 - [ ] CHANGELOG.md is updated (if you maintain one)
 - [ ] Version number follows semver
 - [ ] On main/master branch
 - [ ] All changes are committed
 - [ ] Tag message includes release notes
 ## Docker Image Tags
 Each release creates multiple Docker tags for flexibility:
 | Git Tag | Docker Tags Created |
 |---------|---------------------|
 | v1.2.3 | `:v1.2.3`, `:1.2`, `:1`, `:latest` |
 | v2.0.0 | `:v2.0.0`, `:2.0`, `:2`, `:latest` |
 | v1.2.4-beta.1 | `:v1.2.4-beta.1`, `:1.2-beta` |
 **Usage examples:**
 ```bash
 # Specific version (recommended for production)
 docker pull ghcr.io/cpfarhood/devcontainer:v1.2.3
 # Minor version (gets patches automatically)
 docker pull ghcr.io/cpfarhood/devcontainer:1.2
 # Major version (gets minor updates and patches)
 docker pull ghcr.io/cpfarhood/devcontainer:1
 # Latest (always gets newest stable release)
 docker pull ghcr.io/cpfarhood/devcontainer:latest
 ```
 ## Viewing Releases
 - **GitHub Releases:** https://github.com/cpfarhood/devcontainer/releases
 - **Docker Images:** https://github.com/cpfarhood/devcontainer/pkgs/container/devcontainer
 - **Git Tags:** `git tag -l`
 ## Deleting a Release
 If you need to delete a bad release:
 ```bash
 # Delete local tag
 git tag -d v1.0.0
 # Delete remote tag
 git push origin :refs/tags/v1.0.0
 # Delete GitHub release (use web UI or gh CLI)
 gh release delete v1.0.0
 ```
 **Note:** Docker images pushed to ghcr.io cannot be easily deleted. It's better to create a new patch version.
 ## First Release
 For the initial v1.0.0 release:
 ```bash
 git checkout main
 git pull
 git tag -a v1.0.0 -m "Release v1.0.0 - Initial Release
 ## Features
 - Antigravity IDE with web-based VNC access
 - Happy Coder AI assistant integration
 - Automatic GitHub repository cloning
 - Persistent home directory with ReadWriteMany PVC
 - Secure non-root execution (claude user, UID 1000)
 - Support for private repositories with GitHub token
 - HTTPRoute (Gateway API) support
 - Multi-platform Docker images
 - Comprehensive deployment documentation
 ## Docker Image
 \`\`\`bash
 docker pull ghcr.io/cpfarhood/devcontainer:v1.0.0
 \`\`\`
 ## Deployment
 See DEPLOYMENT.md for complete deployment instructions.
 "
 git push origin v1.0.0
 ```
 ## Example Release Workflow
 ```bash
 # 1. Finish your feature/fix on a branch
 git checkout feature/new-feature
 git commit -m "feat: Add new feature"
 git push
 # 2. Create PR and merge to main
 gh pr create
 # ... get approval and merge ...
 # 3. Pull latest main
 git checkout main
 git pull
 # 4. Create release tag
 git tag -a v1.1.0 -m "Release v1.1.0 - New feature"
 git push origin v1.1.0
 # 5. Wait for GitHub Actions
 # - Check: https://github.com/cpfarhood/devcontainer/actions
 # 6. Verify release
 # - GitHub: https://github.com/cpfarhood/devcontainer/releases
 # - Docker: docker pull ghcr.io/cpfarhood/devcontainer:v1.1.0
 ```
@@ -1,36 +1,29 @@
 {
  "mcpServers": {
    "github": {
-      "type": "http",
+      "command": "github-mcp-server",
-      "url": "https://api.githubcopilot.com/mcp/",
+      "args": ["stdio"],
-      "headers": {
+      "env": {
-        "Authorization": "Bearer ${GITHUB_TOKEN}"
+        "GITHUB_PERSONAL_ACCESS_TOKEN": "${CLAUDE_GITHUB_TOKEN}"
      }
    },
-    "kubernetes": {
+    "kubernetes (local)": {
-      "type": "sse",
+      "command": "npx",
-      "url": "http://localhost:8080/sse"
+      "args": [
        "-y",
        "kubernetes-mcp-server@latest"
      ]
    },
-    "flux": {
+    "flux (local)":{
-      "type": "sse",
+      "command":"flux-operator-mcp",
-      "url": "http://localhost:8081/sse"
+      "args":["serve"],
      "env":{
        "KUBECONFIG":"/Users/cpfarhood/.kube/config"
      }
    },
    "playwright": {
-      "type": "sse",
+      "command": "npx",
-      "url": "http://localhost:8086/sse"
+      "args": ["-y", "@playwright/mcp@latest"]
    },
    "pgtuner": {
      "type": "sse",
      "url": "http://localhost:8085/sse"
    },
    "fetch": {
      "type": "sse",
      "url": "http://localhost:8082/sse"
    },
    "sequentialthinking": {
      "type": "sse",
      "url": "http://localhost:8083/sse"
    }
  }
 }
@@ -4,12 +4,11 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 ## Project Overview
-The Dev Container is a Docker-based cloud development environment that provides:
+Antigravity is a Docker-based cloud development environment that provides:
 - Web-based GUI IDE (VSCode/Antigravity) via VNC on port 5800
- Claude Code, Happy Coder, OpenCode, and Crush AI coding agents (terminal-based)
+- Happy Coder AI assistant integration
 - Automatic GitHub repository cloning on startup
 - Kubernetes-native deployment with persistent home storage
 - MCP (Model Context Protocol) sidecars for AI assistant integrations
 The stack is primarily **Bash scripts + YAML** — there is no Node.js package, compiled language, or test framework.
@@ -20,7 +19,7 @@ The stack is primarily **Bash scripts + YAML** — there is no Node.js package,
 ```bash
 make build                              # Build Docker image
 make build REGISTRY=ghcr.io/myuser IMAGE_TAG=v1.0  # Custom registry/tag
-docker build -t ghcr.io/cpfarhood/devcontainer:latest .  # Direct build
+docker build -t ghcr.io/cpfarhood/antigravity:latest .  # Direct build
 ```
 ### Running Locally
@@ -34,14 +33,12 @@ make clean   # Remove volumes
 ### Kubernetes Deployment
 ```bash
-GITHUB_REPO="https://github.com/user/repo" make helm-deploy  # Deploy with Helm
+make k8s-deploy          # Deploy via kustomize
-make helm-delete          # Tear down Helm release
+kubectl apply -k k8s/    # Direct kustomize apply
-make helm-port-forward    # Forward port 5800 to localhost
+make k8s-delete          # Tear down
-make helm-logs            # Stream container logs
+make k8s-port-forward    # Forward port 5800 to localhost
-make helm-shell           # Open interactive shell in pod
+make k8s-logs            # Stream container logs
-
+make k8s-shell           # Open interactive shell in pod
 # Or use Helm directly
 helm install mydev ./chart --set name=mydev --set githubRepo=https://github.com/user/repo
 ```
 ### Other Useful Targets
@@ -58,114 +55,26 @@ make push   # Push image to registry (build first)
 ```
 Container start
  → scripts/startapp.sh
-    → scripts/init-repo.sh
+    → scripts/init-repo.sh (clone GITHUB_REPO, start Happy Coder)
-      → Configure git user & credentials
+    → launch VSCode as user `claude` in /workspace
      → Clone GITHUB_REPO (if set)
    → Launch VSCode as user `user` in /workspace
 ```
 ### Key Files
 | File | Purpose |
 |------|---------|
-| `Dockerfile` | Image definition — installs Chrome, Node.js, VSCode, Claude Code, Happy Coder, OpenCode, Crush; creates non-root user (UID 1000) |
+| `Dockerfile` | Image definition — installs Chrome, Node.js, VSCode, Happy Coder; creates non-root user `claude` (UID 1000) |
-| `scripts/init-repo.sh` | Configures git credentials, clones GitHub repo |
+| `scripts/init-repo.sh` | Clones GitHub repo, authenticates with token, starts Happy Coder background service |
 | `scripts/startapp.sh` | Calls init-repo.sh then opens VSCode in the workspace |
-| `chart/` | Helm chart for Kubernetes deployment |
+| `k8s/statefulset.yaml` | StatefulSet + headless Service; mounts `/home` (PVC) and `/workspace` (emptyDir) |
-| `chart/templates/deployment.yaml` | Deployment spec — main container + MCP sidecar containers |
+| `k8s/configmap.yaml` | `GITHUB_REPO`, `HAPPY_SERVER_URL`, `HAPPY_WEBAPP_URL` |
-| `chart/templates/rbac.yaml` | ServiceAccount, Role/ClusterRole based on `clusterAccess` value |
+| `k8s/httproute.yaml` | Gateway API HTTPRoute for external browser access |
-| `chart/templates/pvc.yaml` | PersistentVolumeClaim for user home |
+| `k8s/secrets-example.yaml` | Template for SealedSecrets (GitHub token, VNC password) |
 | `chart/templates/service.yaml` | ClusterIP Service (VNC + optional SSH) |
 | `chart/values.yaml` | Default Helm values |
 | `.mcp.json` | MCP server connection config (GitHub Copilot, Kubernetes, Flux, Fetch, Sequential Thinking, Playwright, pgtuner) |
 | `Makefile` | Build/deploy automation |
 ### MCP Sidecars
 MCP (Model Context Protocol) servers run as sidecar containers in the pod, enabling AI assistants to interact with various services:
 | Sidecar | Image | Version | Port | Endpoint | Default |
 |---------|-------|---------|------|----------|---------|
 | `kubernetes-mcp` | `quay.io/containers/kubernetes_mcp_server` | v0.0.57 | 8080 | `http://localhost:8080/sse` | Enabled |
 | `flux-mcp` | `ghcr.io/controlplaneio-fluxcd/flux-operator-mcp` | v0.41.1 | 8081 | `http://localhost:8081/sse` | Enabled |
 | `fetch-mcp` | `mcp/fetch` | latest | 8082 | `http://localhost:8082/sse` | Enabled |
 | `sequentialthinking-mcp` | `mcp/sequentialthinking` | latest | 8083 | `http://localhost:8083/sse` | Enabled |
 | `homeassistant-mcp` | `ghcr.io/homeassistant-ai/ha-mcp` | stable | 8087 | `http://localhost:8087/sse` | Disabled |
 | `pgtuner-mcp` | `dog830228/pgtuner_mcp` | latest | 8085 | `http://localhost:8085/sse` | Disabled |
 | `playwright-mcp` | `mcr.microsoft.com/playwright/mcp` | latest | 8086 | `http://localhost:8086/sse` | Enabled |
 **Note:**
 - GitHub MCP is accessed via the Copilot API (`https://api.githubcopilot.com/mcp/`), not as a sidecar
 - Kubernetes and Flux sidecars require `clusterAccess` != `none` to be deployed (they need RBAC permissions)
 - Kubernetes and Flux sidecars inherit the pod's ServiceAccount RBAC permissions
 - Fetch sidecar provides web content fetching capabilities and HTML to markdown conversion
 - Sequential thinking sidecar enables structured thinking and problem-solving processes
 - Home Assistant sidecar requires `HOMEASSISTANT_URL` and `HOMEASSISTANT_TOKEN` in the env secret
 - PostgreSQL tuner sidecar requires `DATABASE_URI` in the env secret (PostgreSQL connection string)
 - Playwright sidecar provides browser automation and web testing capabilities
 #### Enabling/Disabling MCP Servers
 To control MCP sidecars, set the `enabled` flag in your values override:
 ```yaml
 # Disable all MCP sidecars
 mcp:
  sidecars:
    kubernetes:
      enabled: false
    flux:
      enabled: false
    fetch:
      enabled: false
    sequentialthinking:
      enabled: false
    homeassistant:
      enabled: false
    pgtuner:
      enabled: false
    playwright:
      enabled: false
 # Or selectively enable/disable
 mcp:
  sidecars:
    kubernetes:
      enabled: true  # Keep Kubernetes MCP enabled
    flux:
      enabled: false # Disable Flux MCP
    fetch:
      enabled: true  # Enable Fetch MCP for web content fetching
    sequentialthinking:
      enabled: true  # Enable Sequential Thinking MCP for problem-solving
    homeassistant:
      enabled: true  # Enable Home Assistant MCP (requires secrets)
    pgtuner:
      enabled: true  # Enable PostgreSQL tuner MCP (requires DATABASE_URI)
    playwright:
      enabled: true  # Enable Playwright MCP for browser automation
 ```
 When deploying via Helm:
 ```bash
 # Quick start (recommended)
 cp chart/values-quickstart.yaml my-values.yaml
 # Edit name and githubRepo in my-values.yaml
 helm install my-devcontainer ./chart -f my-values.yaml
 # Using --set flags
 helm install my-devcontainer ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/user/repo \
  --set mcp.sidecars.kubernetes.enabled=false
 # Full customization
 helm install my-devcontainer ./chart -f custom-values.yaml
 ```
 ### Storage Model
- `/config` — ReadWriteMany PVC (persists across pod restarts, holds user config/dotfiles)
+- `/home` — ReadWriteMany PVC (persists across pod restarts, holds user config/dotfiles)
 - `/workspace` — emptyDir by default (ephemeral; can be changed to PVC)
 ### Environment Variables
@@ -174,10 +83,7 @@ helm install my-devcontainer ./chart -f custom-values.yaml
 - `GITHUB_REPO` — URL of repository to clone into `/workspace`
 **Optional:**
- `GITHUB_TOKEN` — PAT for private repo access (automatically configures git credentials)
+- `GITHUB_TOKEN` — PAT for private repo access
 - `GIT_USER_NAME` — Git user name for commits (default: "DevContainer User")
 - `GIT_USER_EMAIL` — Git user email for commits (default: "devcontainer@example.com")
 - `GITLAB_HOST` — GitLab hostname if using GitLab with same token
 - `VNC_PASSWORD` — VNC web interface password
 - `DISPLAY_WIDTH` / `DISPLAY_HEIGHT` — VNC resolution
 - `USER_ID` / `GROUP_ID` — Override UID/GID (default 1000)
@@ -186,16 +92,16 @@ helm install my-devcontainer ./chart -f custom-values.yaml
 ### CI/CD
- **`build-and-push.yaml`** — Builds and pushes to GHCR on every push to `main`, version tags (`v*`), and PRs. For version tags, also creates GitHub Release with Helm chart after Docker build completes. Tags: `latest` (main), semver, branch name, commit SHA.
+- **`build-and-push.yaml`** — Builds and pushes to GHCR on every push to `main`, version tags (`v*`), and PRs. Tags: `latest` (main), semver, branch name, commit SHA.
 - **`release.yaml`** — Creates a GitHub Release with docker pull instructions when a version tag is pushed.
 - **`dependabot.yml`** — Weekly updates for GitHub Actions and Docker base image.
 Image registry: `ghcr.io/cpfarhood/devcontainer`
 ## Kubernetes Notes
- Deployed via Helm chart (`chart/`), published as OCI artifact to GHCR, reconciled by Flux
+- Uses Kustomize (`kubectl apply -k k8s/`)
- Storage class is `ceph-filesystem` by default — change via `storage.className` in values
+- Storage class is `ceph-filesystem` by default — change in `statefulset.yaml` for other clusters
 - Resource limits: 1–4 CPU, 2–8Gi memory
 - Health checks (liveness/readiness probes) on port 5800
- Secrets: optional env Secret (`devcontainer-{name}-secrets-env`) for `GITHUB_TOKEN`, `VNC_PASSWORD`, etc.
+- Secrets managed via SealedSecrets (see `k8s/secrets-example.yaml`)
 - RBAC: controlled by `clusterAccess` value (`none`, `readonlyns`, `readwritens`, `readonly`, `readwrite`)
@@ -1,449 +1,436 @@
 # Deployment Guide
-This guide provides step-by-step instructions for deploying the Antigravity Dev Container using Helm.
+This guide provides step-by-step instructions for deploying the Antigravity Dev Container to Kubernetes.
 ## Prerequisites
- Kubernetes cluster (1.19+)
+- Kubernetes cluster with Gateway API support
 - `kubectl` configured to access your cluster
 - `helm` CLI installed (3.0+)
 - ReadWriteMany storage class available (e.g., `ceph-filesystem`, `nfs-client`, `efs-sc`)
 - Sealed Secrets controller installed (for secret encryption)
 - GitHub Container Registry access (images are public)
-## Quick Start
+## Required Configuration Variables
-### 1. Clone the Repository
+Before deploying, you need to provide the following configuration:
 ### 1. Storage Configuration
 **Variable:** `storageClassName`
 **Location:** `k8s/statefulset.yaml` (line ~117)
 **Description:** The ReadWriteMany storage class name in your cluster
 **Example values:**
 - `ceph-filesystem` (Rook-Ceph)
 - `nfs-client` (NFS)
 - `efs-sc` (AWS EFS)
 - `azurefile` (Azure Files)
 - `filestore` (GCP Filestore)
 **How to find your storage class:**
 ```bash
 kubectl get storageclass
 ```
 Look for a storage class that supports `ReadWriteMany` access mode.
 ### 2. GitHub Repository (Required)
 **Variable:** `github-repo`
 **Location:** `k8s/configmap.yaml` (line ~9)
 **Description:** The GitHub repository URL to clone on container startup
 **Format:** `https://github.com/username/repository`
 **Example:** `https://github.com/cpfarhood/my-project`
 ### 3. GitHub Token (Optional, for private repos)
 **Variable:** `github-token`
 **Location:** `k8s/secrets-example.yaml` (sealed secret)
 **Description:** GitHub Personal Access Token for cloning private repositories
 **Format:** `ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`
 **Required:** Only if cloning a private repository
 **How to create a GitHub token:**
 1. Go to https://github.com/settings/tokens
 2. Click "Generate new token (classic)"
 3. Select scopes: `repo` (for private repos)
 4. Generate and copy the token
 ### 4. VNC Password (Optional)
 **Variable:** `vnc-password`
 **Location:** `k8s/secrets-example.yaml` (sealed secret)
 **Description:** Password for accessing the VNC web interface
 **Format:** Any string (recommend 12+ characters)
 **Required:** Optional, but recommended for security
 ### 5. Gateway Configuration (Required for external access)
 **Variables:**
 - `parentRefs.name` - Your Gateway resource name
 - `parentRefs.namespace` - Namespace where Gateway is deployed
 - `hostnames` - Domain name for accessing the container
 **Location:** `k8s/httproute.yaml`
 **Example:**
 ```yaml
 parentRefs:
 - name: cilium-gateway  # Your Gateway name
  namespace: kube-system  # Your Gateway namespace
 hostnames:
 - "devcontainer.example.com"  # Your domain
 ```
 ### 6. Namespace (Optional)
 **Variable:** `namespace`
 **Location:** `k8s/kustomization.yaml` (line ~5)
 **Description:** Kubernetes namespace to deploy into
 **Default:** `default`
 **Example:** `devcontainer`, `development`, `team-workspaces`
 ### 7. Container Image (Optional)
 **Variable:** `image`
 **Location:** `k8s/statefulset.yaml` (line ~32)
 **Description:** Docker image to use
 **Default:** `ghcr.io/cpfarhood/devcontainer:latest`
 **Format:** `registry/repository:tag`
 ### 8. Resource Limits (Optional)
 **Variables:**
 - `resources.requests.memory` (default: `2Gi`)
 - `resources.requests.cpu` (default: `1000m`)
 - `resources.limits.memory` (default: `8Gi`)
 - `resources.limits.cpu` (default: `4000m`)
 **Location:** `k8s/statefulset.yaml` (lines ~98-103)
 ### 9. Happy Coder Configuration (Optional)
 **Variables:**
 - `happy-server-url` - Custom Happy server URL
 - `happy-webapp-url` - Custom Happy webapp URL
 **Location:** `k8s/configmap.yaml` (lines ~12-13, commented out)
 **Default:** Uses Happy's default servers
 **When to set:** Only if using a self-hosted Happy instance
 ## Deployment Steps
 ### Step 1: Clone the Repository
 ```bash
 git clone https://github.com/cpfarhood/devcontainer.git
 cd devcontainer
 ```
-### 2. Create Secret (Optional)
+### Step 2: Configure Storage Class
-For private repos or VNC password:
+Edit `k8s/statefulset.yaml` and find the `volumeClaimTemplates` section (around line 117):
 ```bash
-kubectl create secret generic devcontainer-mydev-secrets-env \
+# Find your storage class
-  --from-literal=GITHUB_TOKEN='ghp_...' \
+kubectl get storageclass
-  --from-literal=VNC_PASSWORD='changeme' \
+
-  --from-literal=ANTHROPIC_API_KEY='sk-ant-...'
+# Edit the file
 vi k8s/statefulset.yaml
 ```
-### 3. Deploy with Helm
+Change `storageClassName` to match your cluster:
-
+```yaml
-```bash
+volumeClaimTemplates:
-# Basic deployment
+- metadata:
-helm install mydev ./chart \
+    name: userhome
-  --set name=mydev \
+  spec:
-  --set githubRepo=https://github.com/youruser/yourrepo
+    accessModes: [ "ReadWriteMany" ]
-
+    storageClassName: "ceph-filesystem"  # ← Change this
-# With custom storage class
+    resources:
-helm install mydev ./chart \
+      requests:
-  --set name=mydev \
+        storage: 10Gi
  --set githubRepo=https://github.com/youruser/yourrepo \
  --set storage.className=nfs-client
 # With cluster access for kubectl
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/youruser/yourrepo \
  --set clusterAccess=readwritens
 ```
-### 4. Access the Container
+### Step 3: Configure GitHub Repository
 Edit `k8s/configmap.yaml`:
 ```bash
-# Port forward
+vi k8s/configmap.yaml
-kubectl port-forward deployment/devcontainer-mydev 5800:5800
+```
 Set your repository URL:
 ```yaml
 data:
  github-repo: "https://github.com/yourusername/yourrepo"
 ```
 ### Step 4: Configure Gateway (HTTPRoute)
 Edit `k8s/httproute.yaml`:
 ```bash
 # Find your Gateway
 kubectl get gateway -A
 # Edit the file
 vi k8s/httproute.yaml
 ```
 Update with your Gateway details:
 ```yaml
 spec:
  parentRefs:
  - name: your-gateway-name        # ← Change this
    namespace: your-gateway-namespace  # ← Change this
  hostnames:
  - "devcontainer.yourdomain.com"  # ← Change this
 ```
 ### Step 5: Create Secrets
 Create the secrets for GitHub token and VNC password:
 ```bash
 # Create the secret
 kubectl create secret generic antigravity-secrets \
  --from-literal=github-token='ghp_your_token_here' \
  --from-literal=vnc-password='your_vnc_password' \
  --dry-run=client -o yaml | \
  kubeseal --format=yaml > k8s/sealedsecrets.yaml
 # Verify the sealed secret was created
 cat k8s/sealedsecrets.yaml
 ```
 **If you don't have Sealed Secrets controller:**
 Option 1: Install Sealed Secrets
 ```bash
 kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.24.0/controller.yaml
 ```
 Option 2: Use plain secrets (not recommended for production)
 ```bash
 kubectl create secret generic antigravity-secrets \
  --from-literal=github-token='ghp_your_token_here' \
  --from-literal=vnc-password='your_vnc_password'
 ```
 ### Step 6: Review Configuration (Optional)
 Review and adjust optional settings:
 **Namespace:**
 ```bash
 vi k8s/kustomization.yaml
 # Change line 5: namespace: default
 ```
 **Resource limits:**
 ```bash
 vi k8s/statefulset.yaml
 # Adjust lines 98-103 for your needs
 ```
 ### Step 7: Deploy to Kubernetes
 ```bash
 # Deploy everything
 kubectl apply -k k8s/
 # Or if you changed the namespace
 kubectl apply -k k8s/ -n your-namespace
 ```
 ### Step 8: Verify Deployment
 ```bash
 # Check StatefulSet
 kubectl get statefulset antigravity
 # Check Pod
 kubectl get pods -l app=antigravity
 # Check PVC
 kubectl get pvc -l app=antigravity
 # Check HTTPRoute
 kubectl get httproute antigravity
 # View logs
 kubectl logs antigravity-0
 ```
 ### Step 9: Access the Container
 **Option A: Via HTTPRoute (external access)**
 ```bash
 # Open in browser
 open https://devcontainer.yourdomain.com
 ```
 **Option B: Via Port Forward (local access)**
 ```bash
 # Port forward to localhost
 kubectl port-forward statefulset/antigravity 5800:5800
 # Open in browser
 open http://localhost:5800
 ```
-## Deployment Options
+## Configuration Summary
-### Using Values File
+Here's a quick checklist of all variables you need to set:
-Create a custom `values.yaml`:
+### Required Variables
-```yaml
+| Variable | File | Line | Example Value |
-name: mydev
+|----------|------|------|---------------|
-githubRepo: https://github.com/youruser/yourrepo
+| `storageClassName` | `k8s/statefulset.yaml` | ~117 | `ceph-filesystem` |
-ide: vscode
+| `github-repo` | `k8s/configmap.yaml` | ~9 | `https://github.com/user/repo` |
-ssh: false
+| `parentRefs.name` | `k8s/httproute.yaml` | ~8 | `cilium-gateway` |
 | `parentRefs.namespace` | `k8s/httproute.yaml` | ~9 | `kube-system` |
 | `hostnames` | `k8s/httproute.yaml` | ~10 | `devcontainer.example.com` |
-# Storage
+### Optional Variables
 storage:
  size: 32Gi
  className: ceph-filesystem
-# Resources
+| Variable | File | Line | Default | When to Change |
-resources:
+|----------|------|------|---------|----------------|
-  requests:
+| `namespace` | `k8s/kustomization.yaml` | ~5 | `default` | If deploying to different namespace |
-    memory: "4Gi"
+| `github-token` | Sealed secret | N/A | None | For private repos |
-    cpu: "2000m"
+| `vnc-password` | Sealed secret | N/A | None | For VNC security |
-  limits:
+| `image` | `k8s/statefulset.yaml` | ~32 | `ghcr.io/cpfarhood/devcontainer:latest` | For specific version or custom build |
-    memory: "16Gi"
+| `resources.*` | `k8s/statefulset.yaml` | ~98-103 | 2Gi/8Gi RAM, 1/4 CPU | Based on workload needs |
-    cpu: "8000m"
+| `happy-server-url` | `k8s/configmap.yaml` | ~12 | Default Happy server | For self-hosted Happy |
-
+| `happy-webapp-url` | `k8s/configmap.yaml` | ~13 | Default Happy webapp | For self-hosted Happy |
 # Kubernetes access
 clusterAccess: readwritens
 # MCP sidecars
 mcpSidecars:
  kubernetes:
    enabled: true
  flux:
    enabled: false
 ```
 Deploy:
 ```bash
 helm install mydev ./chart -f values.yaml
 ```
 ### SSH Access Setup
 Enable SSH and add your public key:
 ```bash
 # Create secret with SSH key
 kubectl create secret generic devcontainer-mydev-secrets-env \
  --from-literal=SSH_AUTHORIZED_KEYS='ssh-ed25519 AAAA...'
 # Deploy with SSH enabled
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/youruser/yourrepo \
  --set ssh=true
 # Connect via SSH
 kubectl port-forward deployment/devcontainer-mydev 2222:22
 ssh -p 2222 user@localhost
 ```
 ### MCP Sidecar Configuration
 Control MCP servers for AI-assisted operations.
 **Important:** Kubernetes and Flux MCP sidecars are only deployed when:
 1. They are enabled in values (`mcpSidecars.<name>.enabled: true`)
 2. AND `clusterAccess` is not `none` (they need RBAC permissions to function)
 ```bash
 # Disable all MCP sidecars
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/youruser/yourrepo \
  --set mcpSidecars.kubernetes.enabled=false \
  --set mcpSidecars.flux.enabled=false \
  --set mcpSidecars.homeassistant.enabled=false
 # Enable only Kubernetes MCP
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/youruser/yourrepo \
  --set mcpSidecars.kubernetes.enabled=true \
  --set mcpSidecars.flux.enabled=false
 # Enable Home Assistant MCP (requires credentials)
 kubectl create secret generic devcontainer-mydev-secrets-env \
  --from-literal=homeassistant-url='http://homeassistant.local:8123' \
  --from-literal=homeassistant-token='your_long_lived_token'
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/youruser/yourrepo \
  --set mcpSidecars.homeassistant.enabled=true
 ```
 ### Cluster Access Levels
 Configure Kubernetes RBAC permissions:
 | Value | Scope | Permissions | Use Case |
 |-------|-------|-------------|----------|
 | `none` | No access | None | Default, isolated development |
 | `readonlyns` | Namespace | Read-only | View resources in namespace |
 | `readwritens` | Namespace | Full access | Deploy apps in namespace |
 | `readonly` | Cluster-wide | Read-only | View all cluster resources |
 | `readwrite` | Cluster-wide | Full access | Cluster administration |
 ```bash
 # Example: Full access within namespace
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/youruser/yourrepo \
  --set clusterAccess=readwritens
 ```
 ## Ingress Configuration
 ### Using Gateway API HTTPRoute
 Create an HTTPRoute for external access:
 ```yaml
 apiVersion: gateway.networking.k8s.io/v1beta1
 kind: HTTPRoute
 metadata:
  name: devcontainer-mydev
 spec:
  parentRefs:
  - name: your-gateway
    namespace: your-gateway-namespace
  hostnames:
  - devcontainer.example.com
  rules:
  - backendRefs:
    - name: devcontainer-mydev
      port: 5800
 ```
 ### Using Traditional Ingress
 Create an Ingress resource:
 ```yaml
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: devcontainer-mydev
 spec:
  rules:
  - host: devcontainer.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: devcontainer-mydev
            port:
              number: 5800
 ```
 ## Advanced Configurations
 ### Custom Happy Coder Endpoints
 For self-hosted Happy instances:
 ```bash
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/youruser/yourrepo \
  --set happyServerUrl=https://your-happy-server.com \
  --set happyWebappUrl=https://your-happy-webapp.com
 ```
 ### Custom Display Resolution
 ```bash
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/youruser/yourrepo \
  --set display.width=2560 \
  --set display.height=1440
 ```
 ### Different IDE Options
 ```bash
 # Use Google Antigravity
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/youruser/yourrepo \
  --set ide=antigravity
 # SSH-only mode (no GUI)
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/youruser/yourrepo \
  --set ide=none \
  --set ssh=true
 ```
 ## Helm Operations
 ### List Deployments
 ```bash
 helm list
 ```
 ### Upgrade Deployment
 ```bash
 # Change values
 helm upgrade mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/youruser/newrepo
 # Upgrade with new chart version
 git pull
 helm upgrade mydev ./chart
 ```
 ### Uninstall
 ```bash
 helm uninstall mydev
 # Note: PVC persists by default
 kubectl delete pvc userhome-mydev
 ```
 ### Rollback
 ```bash
 # View history
 helm history mydev
 # Rollback to previous version
 helm rollback mydev
 # Rollback to specific revision
 helm rollback mydev 3
 ```
 ## Troubleshooting
-### Pod Not Starting
+### Pod not starting
 **Check events:**
 ```bash
-# Check pod status
+kubectl describe pod antigravity-0
 kubectl get pods -l app.kubernetes.io/instance=mydev
 # Describe pod for events
 kubectl describe pod -l app.kubernetes.io/instance=mydev
 # Check logs
 kubectl logs deployment/devcontainer-mydev
 ```
-### Repository Not Cloning
+**Common issues:**
 - Storage class doesn't support ReadWriteMany
 - PVC not binding (check storage class exists)
 - Image pull errors (check image name)
 ### Repository not cloning
 **Check logs:**
 ```bash
-# Check init logs
+kubectl logs antigravity-0 | grep -A 10 "Repository Initialization"
 kubectl logs deployment/devcontainer-mydev | grep "Repository Initialization"
 # Verify secret exists
 kubectl get secret devcontainer-mydev-secrets-env
 # Check environment
 kubectl exec deployment/devcontainer-mydev -- env | grep GITHUB
 ```
-### VNC Not Accessible
+**Common issues:**
 - Invalid GitHub URL
 - Private repo without token
 - Token doesn't have correct permissions
 ### HTTPRoute not working
 **Check HTTPRoute:**
 ```bash
-# Check service
+kubectl describe httproute antigravity
 kubectl get svc devcontainer-mydev
 kubectl describe svc devcontainer-mydev
 # Test with port-forward
 kubectl port-forward deployment/devcontainer-mydev 5800:5800
 ```
-### MCP Sidecar Issues
+**Common issues:**
 - Gateway name/namespace incorrect
 - Domain not pointing to Gateway
 - TLS certificate not issued
 ### VNC not accessible
 **Check service:**
 ```bash
-# Check all containers
+kubectl get svc antigravity
-kubectl get pod -l app.kubernetes.io/instance=mydev -o jsonpath='{.items[0].spec.containers[*].name}'
+kubectl describe svc antigravity
 # Check MCP container logs
 kubectl logs deployment/devcontainer-mydev -c kubernetes-mcp
 kubectl logs deployment/devcontainer-mydev -c flux-mcp
 kubectl logs deployment/devcontainer-mydev -c homeassistant-mcp
 # Verify RBAC permissions (for Kubernetes/Flux MCP)
 kubectl auth can-i --list --as system:serviceaccount:default:devcontainer-mydev
 # Check Home Assistant MCP credentials
 kubectl get secret devcontainer-mydev-secrets-env -o jsonpath='{.data.homeassistant-url}' | base64 -d
 # Verify the URL is accessible from the pod
 kubectl exec deployment/devcontainer-mydev -- curl -s http://homeassistant.local:8123/api/
 ```
-### Storage Issues
+**Port forward test:**
 ```bash
-# Check PVC
+kubectl port-forward antigravity-0 5800:5800
-kubectl get pvc userhome-mydev
+# Try accessing http://localhost:5800
 kubectl describe pvc userhome-mydev
 # Check available storage classes
 kubectl get storageclass
 # Verify ReadWriteMany support
 kubectl get storageclass <class-name> -o yaml | grep -i accessmodes
 ```
-## Best Practices
+## Quick Deploy Example
-### Production Deployment
+Complete deployment with all values filled in:
 1. **Use specific image tags** instead of `latest`:
   ```bash
   helm install mydev ./chart --set image.tag=v1.0.0
   ```
 2. **Set resource limits** appropriately:
   ```yaml
   resources:
     requests:
       memory: "4Gi"
       cpu: "2000m"
     limits:
       memory: "8Gi"
       cpu: "4000m"
   ```
 3. **Enable VNC password**:
   ```bash
   kubectl create secret generic devcontainer-mydev-secrets-env \
     --from-literal=VNC_PASSWORD='strong-password-here'
   ```
 4. **Use dedicated namespace**:
   ```bash
   kubectl create namespace dev-environments
   helm install mydev ./chart -n dev-environments
   ```
 5. **Configure appropriate cluster access**:
   - Use `readonlyns` or `readwritens` for namespace-scoped work
   - Avoid `readwrite` cluster-wide access unless necessary
 ### Multi-User Deployment
 For teams, create separate deployments per user:
 ```bash
-# User 1
+# 1. Set your values
-helm install alice-dev ./chart \
+STORAGE_CLASS="ceph-filesystem"
-  --set name=alice-dev \
+GITHUB_REPO="https://github.com/myuser/myproject"
-  --set githubRepo=https://github.com/alice/project
+GITHUB_TOKEN="ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
 VNC_PASSWORD="my-secure-password-123"
 GATEWAY_NAME="cilium-gateway"
 GATEWAY_NAMESPACE="kube-system"
 DOMAIN="devcontainer.example.com"
-# User 2
+# 2. Update storage class
-helm install bob-dev ./chart \
+sed -i "s/storageClassName: .*/storageClassName: \"$STORAGE_CLASS\"/" k8s/statefulset.yaml
-  --set name=bob-dev \
+
-  --set githubRepo=https://github.com/bob/project
+# 3. Update GitHub repo
 sed -i "s|github-repo: .*|github-repo: \"$GITHUB_REPO\"|" k8s/configmap.yaml
 # 4. Update Gateway
 sed -i "s/- name: gateway/- name: $GATEWAY_NAME/" k8s/httproute.yaml
 sed -i "s/namespace: gateway-system/namespace: $GATEWAY_NAMESPACE/" k8s/httproute.yaml
 sed -i "s/antigravity.example.com/$DOMAIN/" k8s/httproute.yaml
 # 5. Create sealed secret
 kubectl create secret generic antigravity-secrets \
  --from-literal=github-token="$GITHUB_TOKEN" \
  --from-literal=vnc-password="$VNC_PASSWORD" \
  --dry-run=client -o yaml | \
  kubeseal --format=yaml > k8s/sealedsecrets.yaml
 # 6. Deploy
 kubectl apply -k k8s/
 # 7. Watch deployment
 kubectl get pods -l app=antigravity -w
 ```
-### Backup and Recovery
+## Updates and Maintenance
-The home directory persists on PVC. To backup:
+### Updating the Image
 The image is automatically built and pushed to ghcr.io on every commit to main.
 **To use latest:**
 ```bash
 kubectl set image statefulset/antigravity \
  antigravity=ghcr.io/cpfarhood/devcontainer:latest
 ```
 **To use specific version:**
 ```bash
 kubectl set image statefulset/antigravity \
  antigravity=ghcr.io/cpfarhood/devcontainer:v1.0.0
 ```
 ### Changing Repository
 Edit the ConfigMap and restart:
 ```bash
 kubectl edit configmap antigravity-config
 # Change github-repo value
 kubectl rollout restart statefulset/antigravity
 ```
 ### Scaling
 ```bash
-# Create backup pod
+# Scale to multiple instances (each gets own home PVC)
-kubectl run backup --image=busybox --restart=Never --rm -i --tty \
+kubectl scale statefulset antigravity --replicas=3
  -- tar czf - -C /home . | gzip > home-backup.tar.gz
 ```
 ## Support
 For issues or questions:
 - GitHub Issues: https://github.com/cpfarhood/devcontainer/issues
- Documentation: https://github.com/cpfarhood/devcontainer
+- Documentation: https://github.com/cpfarhood/devcontainer
@@ -1,7 +1,7 @@
 FROM jlesage/baseimage-gui:ubuntu-22.04-v4
 # Set environment variables
-ENV APP_NAME="Dev Container" \
+ENV APP_NAME="Antigravity Dev Container" \
    KEEP_APP_RUNNING=1 \
    DISPLAY_WIDTH=1920 \
    DISPLAY_HEIGHT=1080 \
@@ -25,37 +25,13 @@ RUN apt-get update && apt-get install -y \
    sudo \
    && rm -rf /var/lib/apt/lists/*
-# Install Chrome and xdg-utils (needed for xdg-open to work in VNC)
+# Install Chrome
 RUN wget -q -O - https://dl.google.com/linux/linux_signing_key.pub | gpg --dearmor -o /usr/share/keyrings/google-chrome-keyring.gpg && \
    echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome-keyring.gpg] http://dl.google.com/linux/chrome/deb/ stable main" > /etc/apt/sources.list.d/google-chrome.list && \
    apt-get update && \
-    apt-get install -y google-chrome-stable xdg-utils && \
+    apt-get install -y google-chrome-stable && \
    rm -rf /var/lib/apt/lists/*
 # Chrome wrapper: adds flags required for running inside a Docker container.
 # xdg-open (used by Claude Code on Linux) respects $BROWSER, so pointing it
 # here ensures the OAuth popup works without manual --no-sandbox invocations.
 # Cleans up crash lock files and suppresses the crash-restore bubble so that
 # sessions/cookies survive unclean pod shutdowns (SIGKILL).
 RUN printf '#!/bin/bash\n\
 CHROME_DIR="/config/userdata/.config/google-chrome"\n\
 mkdir -p "$CHROME_DIR"\n\
 # Remove stale lock files left by unclean container shutdown\n\
 rm -f "$CHROME_DIR/SingletonLock" "$CHROME_DIR/SingletonSocket" "$CHROME_DIR/SingletonCookie"\n\
 # Mark the previous session as clean so Chrome does not clear cookies\n\
 PREFS="$CHROME_DIR/Default/Preferences"\n\
 if [ -f "$PREFS" ]; then\n\
  sed -i '\''s/"exit_type":"Crashed"/"exit_type":"Normal"/g; s/"exited_cleanly":false/"exited_cleanly":true/g'\'' "$PREFS"\n\
 fi\n\
 exec /usr/bin/google-chrome-stable \\\n\
  --no-sandbox \\\n\
  --disable-dev-shm-usage \\\n\
  --disable-gpu \\\n\
  --disable-session-crashed-bubble \\\n\
  --user-data-dir="$CHROME_DIR" \\\n\
  "$@"\n' > /usr/local/bin/google-chrome && \
    chmod +x /usr/local/bin/google-chrome
 # Install Node.js (LTS version for Happy Coder)
 RUN curl -fsSL https://deb.nodesource.com/setup_lts.x | bash - && \
    apt-get install -y nodejs && \
@@ -64,61 +40,15 @@ RUN curl -fsSL https://deb.nodesource.com/setup_lts.x | bash - && \
 # Install Happy Coder and Claude Code globally
 RUN npm install -g happy-coder @anthropic-ai/claude-code
-# Install OpenCode AI coding agent
+# Install Antigravity (Google's Project IDX / Cloud Code alternative)
-RUN OPENCODE_VERSION=$(curl -sL https://api.github.com/repos/opencode-ai/opencode/releases/latest | jq -r '.tag_name') && \
+# Note: Antigravity might be packaged differently - adjust as needed
-    curl -fsSL "https://github.com/opencode-ai/opencode/releases/download/${OPENCODE_VERSION}/opencode-linux-x86_64.tar.gz" | \
+# For now, we'll use VSCode with Project IDX extensions as a placeholder
    tar -xz -C /usr/local/bin opencode && \
    chmod +x /usr/local/bin/opencode
 # Install Crush AI coding agent (OpenCode successor by Charm)
 RUN CRUSH_VERSION=$(curl -sL https://api.github.com/repos/charmbracelet/crush/releases/latest | jq -r '.tag_name' | sed 's/^v//') && \
    curl -fsSL "https://github.com/charmbracelet/crush/releases/download/v${CRUSH_VERSION}/crush_${CRUSH_VERSION}_Linux_x86_64.tar.gz" | \
    tar -xz --strip-components=1 -C /usr/local/bin "crush_${CRUSH_VERSION}_Linux_x86_64/crush" && \
    chmod +x /usr/local/bin/crush
 # Install VSCode
 RUN wget -qO- https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor -o /usr/share/keyrings/packages.microsoft.gpg && \
    echo "deb [arch=amd64 signed-by=/usr/share/keyrings/packages.microsoft.gpg] https://packages.microsoft.com/repos/code stable main" > /etc/apt/sources.list.d/vscode.list && \
    apt-get update && \
    apt-get install -y code && \
    rm -rf /var/lib/apt/lists/*
 # Install Google Antigravity IDE
 RUN mkdir -p /etc/apt/keyrings && \
    curl -fsSL https://us-central1-apt.pkg.dev/doc/repo-signing-key.gpg | \
      gpg --dearmor --yes -o /etc/apt/keyrings/antigravity-repo-key.gpg && \
    echo "deb [signed-by=/etc/apt/keyrings/antigravity-repo-key.gpg] https://us-central1-apt.pkg.dev/projects/antigravity-auto-updater-dev/ antigravity-debian main" \
      > /etc/apt/sources.list.d/antigravity.list && \
    # Clear package cache to force fresh repository data
    rm -rf /var/lib/apt/lists/* && \
    apt-get update && \
    # Show available versions for debugging
    apt-cache policy antigravity && \
    # Install latest version
    apt-get install -y --no-install-recommends antigravity && \
    # Display installed version
    dpkg -l | grep antigravity && \
    rm -rf /var/lib/apt/lists/*
 # Pre-configure Antigravity to skip onboarding/setup on first run
 RUN mkdir -p /etc/skel/.config/antigravity/User/globalStorage && \
    echo '{"antigravityUnifiedStateSync.seenNuxOneTimeMigration": true, "antigravityUnifiedStateSync.browserOnboarding.completed": true, "antigravityUnifiedStateSync.hasOnboardingCompleted": true, "browserOnboarding.hasSeenWelcome": true, "antigravityUnifiedStateSync.browserPreferences.hasAddedLocalhostToAllowlist": true, "antigravityUnifiedStateSync.oauthToken.hasLegacyMigrated": true, "antigravityUnifiedStateSync.auth.tokenSyncEnabled": true, "antigravityUnifiedStateSync.auth.cloudSyncEnabled": true, "theme": "vs-dark"}' \
      > /etc/skel/.config/antigravity/User/globalStorage/storage.json && \
    echo '{"workbench.startupEditor": "none", "workbench.welcomePage.walkthroughs.openOnInstall": false, "workbench.tips.enabled": false, "extensions.ignoreRecommendations": true, "telemetry.telemetryLevel": "off", "update.mode": "none", "extensions.autoUpdate": false, "extensions.autoCheckUpdates": false, "workbench.enableExperiments": true, "workbench.settings.enableNaturalLanguageSearch": true, "antigravity.onboarding.completed": true, "antigravity.browserOnboarding.completed": true, "antigravity.setup.completed": true, "antigravity.ai.enabled": true, "antigravity.ai.autoComplete.enabled": true, "antigravity.ai.chat.enabled": true, "antigravity.ai.codeActions.enabled": true, "antigravity.ai.explainCode.enabled": true, "antigravity.ai.generateCode.enabled": true, "antigravity.ai.optimizeCode.enabled": true, "antigravity.ai.autoSuggest.enabled": true, "antigravity.telemetry.crashReporter": "on", "antigravity.ai.acceptTerms": true, "antigravity.auth.syncState": true, "antigravity.auth.enableTokenSync": true, "antigravity.ai.enableCloudSync": true, "antigravity.settings.sync": true}' \
      > /etc/skel/.config/antigravity/User/settings.json && \
    # Validate Antigravity installation
    /usr/share/antigravity/antigravity --version || echo "WARNING: Antigravity version check failed"
 # Install OpenSSH server (for SSH IDE mode)
 RUN apt-get update && \
    apt-get install -y openssh-server && \
    rm -rf /var/lib/apt/lists/* && \
    mkdir -p /var/run/sshd && \
    sed -i 's/#PubkeyAuthentication yes/PubkeyAuthentication yes/' /etc/ssh/sshd_config && \
    sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config && \
    sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config && \
    echo "PermitRootLogin no" >> /etc/ssh/sshd_config
 # Create user user with specific UID/GID
 RUN groupadd -g 1000 user && \
    useradd -u 1000 -g 1000 -m -s /bin/bash user && \
@@ -133,18 +63,16 @@ COPY --chmod=755 scripts/startapp.sh /startapp.sh
 COPY --chmod=755 scripts/init-repo.sh /usr/local/bin/init-repo
 # Fix app user shell after baseimage-gui creates it at runtime
 COPY --chmod=755 scripts/cont-init-user.sh /etc/cont-init.d/20-fix-user-shell.sh
 COPY --chmod=755 scripts/cont-init-sshd.sh /etc/cont-init.d/25-start-sshd.sh
 # Set working directory
 WORKDIR /workspace
 # Configure container to run as user user
-ENV HOME=/config/userdata \
+ENV HOME=/home/user \
-    USER=user \
+    USER=user
    BROWSER=/usr/local/bin/google-chrome
 # Expose VNC port (baseimage-gui default)
 EXPOSE 5800
 # Set app name for baseimage-gui
-RUN set-cont-env APP_NAME "Dev Container"
+RUN set-cont-env APP_NAME "Antigravity"
@@ -44,40 +44,26 @@ clean: stop
 	@echo "Cleaning up..."
 	rm -rf ./home ./workspace
-# Helm deployment
+# Kubernetes deployment
-RELEASE_NAME ?= mydev
+k8s-deploy:
-NAMESPACE ?= default
+	@echo "Deploying to Kubernetes..."
 	kubectl apply -k k8s/
-helm-deploy:
+k8s-delete:
-	@echo "Deploying with Helm (release: $(RELEASE_NAME))..."
+	@echo "Deleting from Kubernetes..."
-	@if [ -z "$(GITHUB_REPO)" ]; then \
+	kubectl delete -k k8s/
 		echo "ERROR: GITHUB_REPO environment variable is required"; \
 		echo "Usage: GITHUB_REPO=https://github.com/user/repo make helm-deploy"; \
 		exit 1; \
 	fi
 	helm upgrade --install $(RELEASE_NAME) ./chart \
 		--namespace $(NAMESPACE) \
 		--set name=$(RELEASE_NAME) \
 		--set githubRepo="$(GITHUB_REPO)" \
 		--set image.repository=$(REGISTRY)/$(IMAGE_NAME) \
 		--set image.tag=$(IMAGE_TAG)
-helm-delete:
+k8s-logs:
-	@echo "Deleting Helm release $(RELEASE_NAME)..."
+	@echo "Showing logs..."
-	helm uninstall $(RELEASE_NAME) --namespace $(NAMESPACE)
+	kubectl logs -f antigravity-0
 	@echo "Note: PVC persists. To delete: kubectl delete pvc userhome-$(RELEASE_NAME) -n $(NAMESPACE)"
-helm-logs:
+k8s-shell:
-	@echo "Showing logs for $(RELEASE_NAME)..."
+	@echo "Opening shell..."
-	kubectl logs -f deployment/devcontainer-$(RELEASE_NAME) -n $(NAMESPACE)
+	kubectl exec -it antigravity-0 -- bash
-helm-shell:
+k8s-port-forward:
-	@echo "Opening shell in $(RELEASE_NAME)..."
+	@echo "Port forwarding to localhost:5800..."
-	kubectl exec -it deployment/devcontainer-$(RELEASE_NAME) -n $(NAMESPACE) -- bash
+	kubectl port-forward antigravity-0 5800:5800
 helm-port-forward:
 	@echo "Port forwarding $(RELEASE_NAME) to localhost:5800..."
 	kubectl port-forward deployment/devcontainer-$(RELEASE_NAME) 5800:5800 -n $(NAMESPACE)
 # Show help
 help:
@@ -92,29 +78,24 @@ help:
 	@echo "  stop               - Stop running container"
 	@echo "  clean              - Clean up containers and volumes"
 	@echo ""
-	@echo "Helm/Kubernetes Targets:"
+	@echo "Kubernetes Targets:"
-	@echo "  helm-deploy        - Deploy with Helm chart (requires GITHUB_REPO)"
+	@echo "  k8s-deploy         - Deploy to Kubernetes"
-	@echo "  helm-delete        - Delete Helm release"
+	@echo "  k8s-delete         - Delete from Kubernetes"
-	@echo "  helm-logs          - Show container logs"
+	@echo "  k8s-logs           - Show container logs"
-	@echo "  helm-shell         - Open shell in container"
+	@echo "  k8s-shell          - Open shell in container"
-	@echo "  helm-port-forward  - Port forward to localhost"
+	@echo "  k8s-port-forward   - Port forward to localhost"
 	@echo ""
 	@echo "Variables:"
 	@echo "  REGISTRY           - Docker registry (default: ghcr.io/cpfarhood)"
 	@echo "  IMAGE_NAME         - Image name (default: antigravity)"
 	@echo "  IMAGE_TAG          - Image tag (default: latest)"
 	@echo "  RELEASE_NAME       - Helm release name (default: mydev)"
 	@echo "  NAMESPACE          - Kubernetes namespace (default: default)"
 	@echo "  GITHUB_REPO        - GitHub repository URL (required for helm-deploy)"
 	@echo ""
 	@echo "Environment Variables for 'make run':"
 	@echo "  GITHUB_REPO        - GitHub repository URL"
 	@echo "  GITHUB_TOKEN       - GitHub token (optional)"
 	@echo "  VNC_PASSWORD       - VNC password (optional)"
 	@echo ""
-	@echo "Examples:"
+	@echo "Example:"
 	@echo "  make build"
 	@echo "  make push REGISTRY=ghcr.io/myuser IMAGE_TAG=v1.0"
 	@echo "  GITHUB_REPO=https://github.com/user/repo make run"
 	@echo "  GITHUB_REPO=https://github.com/user/repo make helm-deploy"
 	@echo "  RELEASE_NAME=alice-dev GITHUB_REPO=https://github.com/alice/project make helm-deploy"
@@ -1,441 +1,367 @@
-# Dev Container
+# Antigravity Dev Container
 ![Build and Push](https://github.com/cpfarhood/devcontainer/actions/workflows/build-and-push.yaml/badge.svg)
-A containerized cloud development environment with web-based GUI access, featuring:
+A containerized development environment with GUI access, featuring:
- **VSCode or Google Antigravity** via browser-based VNC (port 5800)
+- **Antigravity** (VSCode/Cloud IDE) via web browser
- **SSH access** option (OpenSSH on port 22, additive with any IDE)
+- **Happy Coder** - AI-powered development assistant
- **Claude Code**, **Happy Coder**, **OpenCode**, and **Crush** AI coding agents (terminal-based)
+- **Automatic GitHub repo cloning**
- **Automatic GitHub repo cloning** on startup
+- **Persistent user home directory**
- **Persistent home directory** via ReadWriteMany PVC
+- **Secure non-root execution**
- **Kubernetes-native** Helm chart deployment
+
 ## Features
 ### GUI Access
 - Web-based VNC interface (port 5800)
 - Full desktop environment in your browser
 - Secure connections with optional password protection
 ### Development Tools
 - Antigravity IDE (VSCode-based)
 - Happy Coder AI assistant
 - Git integration
 - Node.js and npm
 - Python 3
 - Chrome browser
 ### Security
 - Runs as non-root user `claude` (UID 1000, GID 1000)
 - Secure VNC connections
 - Token-based GitHub authentication
 - Isolated workspace
 ### Persistence
 - ReadWriteMany PVC for `/home` (user data persists)
 - Workspace mounted at `/workspace`
 - Repository cloned on first startup
 ## Documentation
 - **[DEPLOYMENT.md](DEPLOYMENT.md)** - Complete deployment guide with step-by-step instructions
 - **[VARIABLES.md](VARIABLES.md)** - Reference for all configuration variables
 - **[README.md](README.md)** - This file (overview and quick start)
 ## Quick Start
-### Option A: Quickstart (Recommended)
+**👉 For detailed deployment instructions, see [DEPLOYMENT.md](DEPLOYMENT.md)**
-For 80% of users, use the simplified quickstart values:
+### 1. Get the Image
 The image is automatically built and published to GitHub Container Registry on every push to main.
 ```bash
-# Copy and customize the quickstart template
+# Pull the latest image
-cp chart/values-quickstart.yaml my-values.yaml
+docker pull ghcr.io/cpfarhood/devcontainer:latest
-# Edit my-values.yaml to set your name and repository:
+# Or pull a specific version
-# name: mydev
+docker pull ghcr.io/cpfarhood/devcontainer:v1.0.0
 # githubRepo: https://github.com/youruser/yourrepo
 # Deploy with minimal configuration
 helm install mydev ./chart -f my-values.yaml
 ```
-### Option B: One-Command Deploy
+**Building locally (optional):**
 ```bash
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/youruser/yourrepo
 ```
 ### Option C: Full Configuration
 ### 1. Create a secret
 The secret is picked up automatically via `envFrom`. Keys recognised:
 | Key | Purpose |
 |-----|---------|
 | `GITHUB_TOKEN` | PAT for private repo access (`repo` scope) |
 | `VNC_PASSWORD` | Password for the VNC web UI |
 | `ANTHROPIC_API_KEY` | API key — alternative to browser-based Claude login |
 | `SSH_AUTHORIZED_KEYS` | Public key(s) for SSH access (required when `ssh: true`) |
 | `HOMEASSISTANT_URL` | Home Assistant URL (required when `mcp.sidecars.homeassistant.enabled: true`) |
 | `HOMEASSISTANT_TOKEN` | Home Assistant long-lived access token (required when `mcp.sidecars.homeassistant.enabled: true`) |
 | `DATABASE_URI` | PostgreSQL connection string (required when `mcp.sidecars.pgtuner.enabled: true`) |
 | `PGTUNER_EXCLUDE_USERIDS` | Comma-separated PostgreSQL user OIDs to exclude from monitoring (optional) |
 ```bash
 kubectl create secret generic devcontainer-mydev-secrets-env \
  --from-literal=GITHUB_TOKEN='ghp_...' \
  --from-literal=VNC_PASSWORD='changeme'
 ```
 Or use SealedSecrets:
 ```bash
 kubectl create secret generic devcontainer-mydev-secrets-env \
  --from-literal=GITHUB_TOKEN='ghp_...' \
  --from-literal=VNC_PASSWORD='changeme' \
  --dry-run=client -o yaml | \
  kubeseal --format=yaml | kubectl apply -f -
 ```
 ### 2. Deploy with Helm
 ```bash
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/youruser/yourrepo
 ```
 ### 3. Access
 ```bash
 # Local port-forward
 kubectl port-forward deployment/devcontainer-mydev 5800:5800
 open http://localhost:5800
 ```
 Or configure an ingress / Gateway API HTTPRoute pointing at port 5800.
 ### 4. Authenticate Claude
 On first launch, open a terminal in the VSCode GUI and run:
 ```bash
 claude
 ```
 A Chrome browser window will open inside VNC for the Claude Max OAuth login. Credentials are stored on the home PVC and persist across pod restarts.
 ---
 ## Helm Chart Reference
 The Helm chart uses a logical organization with these main sections:
 - **Basic Configuration**: name, image, githubRepo
 - **Access & Interface**: IDE, SSH, display, user settings
 - **Infrastructure**: storage, resources, cluster access
 - **Integrations**: Happy Coder, MCP sidecars
 - **Smart Defaults**: auto-detection and profiles
 📖 **Documentation**:
 - [USAGE.md](chart/USAGE.md) - Comprehensive examples and scenarios
 - [values-quickstart.yaml](chart/values-quickstart.yaml) - Minimal configuration
 - [values.schema.json](chart/values.schema.json) - IDE validation support
 ### Core values
 | Value | Default | Description |
 |-------|---------|-------------|
 | `name` | `""` | Instance name — used in all resource names (`devcontainer-{name}`) |
 | `githubRepo` | `""` | Repository to clone into `/workspace` on startup |
 | `ide.type` | `vscode` | IDE to launch — `vscode`, `antigravity`, or `none` (see below) |
 | `ssh.enabled` | `false` | Also start an OpenSSH server on port 22 (additive, any IDE) |
 | `image.repository` | `ghcr.io/cpfarhood/devcontainer` | Container image |
 | `image.tag` | `latest` | Image tag |
 ### IDE choice
 `ide.type` controls what GUI is launched in the VNC session:
 | Value | Port | Description |
 |-------|------|-------------|
 | `vscode` (default) | 5800 (VNC) | VSCode desktop via browser-based VNC |
 | `antigravity` | 5800 (VNC) | Google Antigravity (VSCode fork with AI) via VNC |
 | `none` | — | No IDE; container stays alive (useful when `ssh: true`) |
 ### SSH access
 `ssh.enabled: true` starts OpenSSH on port 22 **in addition to** the IDE. It works with any `ide.type` value:
 ```bash
 # SSH-only (no VNC)
 helm install mydev ./chart --set name=mydev --set ide.type=none --set ssh.enabled=true
 # VSCode in VNC + SSH access at the same time
 helm install mydev ./chart --set name=mydev --set ssh.enabled=true
 ```
 Add your public key to the env secret:
 ```bash
 kubectl create secret generic devcontainer-mydev-secrets-env \
  --from-literal=GITHUB_TOKEN='ghp_...' \
  --from-literal=SSH_AUTHORIZED_KEYS='ssh-ed25519 AAAA...'
 ```
 Then connect:
 ```bash
 kubectl port-forward deployment/devcontainer-mydev 2222:22
 ssh -p 2222 user@localhost
 ```
 ### Happy Coder
 | Value | Default | Description |
 |-------|---------|-------------|
 | `happy.serverUrl` | `https://happy.farh.net` | Happy Coder server endpoint |
 | `happy.webappUrl` | `https://happy-coder.farh.net` | Happy Coder webapp URL |
 | `happy.homeDir` | `/config/userdata/.happy` | Happy runtime state directory (persists on the home PVC) |
 | `happy.experimental` | `true` | Enable experimental Happy features |
 ### Kubernetes cluster access
 The `clusterAccess` value provisions a ServiceAccount, Role/ClusterRole, and binding so the devcontainer pod can interact with the Kubernetes API. The default is `none` — no RBAC resources are created.
 | Value | Scope | Verbs |
 |-------|-------|-------|
 | `none` (default) | — | no access |
 | `readonlyns` | release namespace | `get`, `list`, `watch` |
 | `readwritens` | release namespace | `*` |
 | `readonly` | cluster-wide | `get`, `list`, `watch` |
 | `readwrite` | cluster-wide | `*` |
 ```bash
 # Give the pod read-only access to its own namespace
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/youruser/yourrepo \
  --set clusterAccess=readonlyns
 ```
 With any non-`none` value, a `ServiceAccount` named `devcontainer-{name}` is created and set as the pod's `serviceAccountName`, so `kubectl` and any in-cluster API calls use it automatically.
 ### MCP Sidecars
 The devcontainer includes MCP (Model Context Protocol) servers as sidecar containers that enable AI assistants to interact with various services:
 | Sidecar | Default | Purpose |
 |---------|---------|---------|
 | `mcp.sidecars.kubernetes.enabled` | `true` | Kubernetes API access via MCP |
 | `mcp.sidecars.flux.enabled` | `true` | Flux GitOps operations via MCP |
 | `mcp.sidecars.homeassistant.enabled` | `false` | Home Assistant smart home control via MCP |
 | `mcp.sidecars.pgtuner.enabled` | `false` | PostgreSQL performance tuning and analysis via MCP |
 | `mcp.sidecars.playwright.enabled` | `true` | Browser automation and web testing via MCP |
 **Notes:**
 - GitHub MCP is accessed via the Copilot API (`https://api.githubcopilot.com/mcp/`), not as a sidecar
 - Kubernetes and Flux sidecars require `clusterAccess` != `none` to be deployed (automatically disabled when no cluster access)
 - Kubernetes and Flux sidecars inherit the pod's ServiceAccount RBAC permissions (controlled by `clusterAccess`)
 - Home Assistant sidecar requires `HOMEASSISTANT_URL` and `HOMEASSISTANT_TOKEN` in the env secret
 - PostgreSQL tuner sidecar requires `DATABASE_URI` in the env secret (PostgreSQL connection string)
 - Playwright sidecar provides browser automation and web testing capabilities
 **Disable MCP sidecars:**
 ```bash
 # Disable multiple sidecars
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/youruser/yourrepo \
  --set mcp.sidecars.kubernetes.enabled=false \
  --set mcp.sidecars.flux.enabled=false \
  --set mcp.sidecars.playwright.enabled=false
 # Or selectively disable
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/youruser/yourrepo \
  --set mcp.sidecars.flux.enabled=false  # Disable only Flux MCP
 ```
 **Enable Home Assistant MCP:**
 ```bash
 # Create secret with Home Assistant credentials
 kubectl create secret generic devcontainer-mydev-secrets-env \
  --from-literal=GITHUB_TOKEN='ghp_...' \
  --from-literal=HOMEASSISTANT_URL='http://homeassistant.local:8123' \
  --from-literal=HOMEASSISTANT_TOKEN='your_long_lived_access_token'
 # Deploy with Home Assistant MCP enabled
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/youruser/yourrepo \
  --set mcp.sidecars.homeassistant.enabled=true
 ```
 **Enable PostgreSQL Tuner MCP:**
 ```bash
 # Create secret with PostgreSQL connection string
 kubectl create secret generic devcontainer-mydev-secrets-env \
  --from-literal=GITHUB_TOKEN='ghp_...' \
  --from-literal=DATABASE_URI='postgresql://user:password@postgres.example.com:5432/dbname'
 # Deploy with PostgreSQL tuner MCP enabled
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/youruser/yourrepo \
  --set mcp.sidecars.pgtuner.enabled=true
 ```
 **Custom MCP configuration:**
 ```yaml
 # values.yaml override
 mcp:
  sidecars:
    kubernetes:
      enabled: true
      image:
        repository: quay.io/containers/kubernetes_mcp_server
        tag: v0.0.57
      port: 8080
      resources:
        requests:
          memory: "64Mi"
          cpu: "50m"
        limits:
          memory: "256Mi"
          cpu: "500m"
    flux:
      enabled: false  # Disabled in this example
    homeassistant:
      enabled: true
      image:
        repository: ghcr.io/homeassistant-ai/ha-mcp
        tag: stable
      port: 8087
    pgtuner:
      enabled: true
      image:
        repository: dog830228/pgtuner_mcp
        tag: latest
      port: 8085
    playwright:
      enabled: true
      image:
        repository: mcr.microsoft.com/playwright/mcp
        tag: latest
      port: 8086
      resources:
        requests:
          memory: "128Mi"
          cpu: "100m"
        limits:
          memory: "512Mi"
          cpu: "1000m"
 ```
 ### Display and resources
 | Value | Default | Description |
 |-------|---------|-------------|
 | `display.width` | `1920` | VNC width (px) |
 | `display.height` | `1080` | VNC height (px) |
 | `display.secureConnection` | `0` | Set to `1` if TLS is not terminated upstream |
 | `user.id` | `1000` | UID for the app user |
 | `user.groupId` | `1000` | GID for the app user |
 | `storage.size` | `32Gi` | Home PVC size |
 | `storage.className` | `ceph-filesystem` | StorageClass (must be ReadWriteMany) |
 | `shm.sizeLimit` | `2Gi` | `/dev/shm` size (memory-backed; used by Electron apps) |
 | `resources.requests.memory` | `2Gi` | |
 | `resources.requests.cpu` | `1000m` | |
 | `resources.limits.memory` | `8Gi` | |
 | `resources.limits.cpu` | `4000m` | |
 | `envSecretName` | `devcontainer-{name}-secrets-env` | Override the secret name |
 ---
 ## Architecture
 ### Startup flow
 ```
 Container start
  → cont-init.d/20-fix-user-shell.sh   — fix shell/home on baseimage-gui app user
  → cont-init.d/25-start-sshd.sh       — start sshd if SSH=true
  → /startapp.sh  (runs as app user, UID 1000)
      → init-repo.sh
          → clone / pull GITHUB_REPO into /workspace/{repo}
      → IDE=vscode:      code --new-window --wait /workspace/{repo}
        IDE=antigravity:  antigravity --no-sandbox --user-data-dir ~/.config/antigravity ... /workspace/{repo}
        IDE=none:         sleep infinity
      (SSH=true: sshd also running as root on port 22; host keys persisted on PVC)
 ```
 ### Storage
 | Mount | Source | Persistence |
 |-------|--------|-------------|
 | `/config` | ReadWriteMany PVC (`userhome-{name}`) | Survives pod restarts — stores Claude credentials, dotfiles, git config |
 | `/workspace` | `emptyDir` | Ephemeral — repo is re-cloned on each pod start |
 Happy Coder's runtime state (`HAPPY_HOME_DIR`) is kept in `/config/userdata/.happy` on the persistent home PVC, so auth credentials and settings survive pod restarts when manually started.
 ---
 ## Troubleshooting
 ### Happy Coder (manual startup)
 Happy daemon is not started automatically. Launch it manually when needed:
 ```bash
 # Start Happy Coder daemon manually
 happy daemon start
 # Check daemon status
 happy daemon status
 # View daemon logs
 ls ~/.happy/logs/
 # Stop daemon if needed
 happy daemon stop
 ```
 ### Claude not authenticated
 Browser-based OAuth login is the primary method (works inside VNC via the Chrome wrapper). If you prefer API key auth:
 ```bash
 kubectl patch secret devcontainer-mydev-secrets-env \
  --type='json' \
  -p='[{"op":"add","path":"/data/ANTHROPIC_API_KEY","value":"'$(echo -n "sk-ant-..." | base64)'"}]'
 ```
 Then restart the pod to pick up the new env var.
 ### VNC not loading
 ```bash
 kubectl port-forward deployment/devcontainer-mydev 5800:5800
 kubectl logs deployment/devcontainer-mydev
 kubectl describe pod -l app.kubernetes.io/instance=mydev
 ```
 ### Pod not picking up new image after upgrade
 The chart uses `image.tag: latest`. Kubernetes won't restart the pod on a Helm upgrade unless the Deployment spec changes. Force a restart manually:
 ```bash
 kubectl rollout restart deployment/devcontainer-mydev
 ```
 ### Repository not cloning
 ```bash
 kubectl logs deployment/devcontainer-mydev | grep "Repository Initialization"
 kubectl exec deployment/devcontainer-mydev -- env | grep GITHUB
 ```
 ---
 ## Local Docker run
 ```bash
 docker run -d \
  -p 5800:5800 \
  -e GITHUB_REPO="https://github.com/youruser/yourrepo" \
  -e GITHUB_TOKEN="ghp_..." \
  -e VNC_PASSWORD="changeme" \
  -v $(pwd)/home:/home \
  ghcr.io/cpfarhood/devcontainer:latest
 ```
 ---
 ## Building
 ```bash
 docker build -t ghcr.io/cpfarhood/devcontainer:latest .
 docker push ghcr.io/cpfarhood/devcontainer:latest
 ```
-The image is also built and pushed automatically by CI on every push to `main` and on version tags (`v*`).
+### 2. Configure Secrets
---
+Edit `k8s/secrets-example.yaml` and create a sealed secret:
 ```bash
 kubectl create secret generic antigravity-secrets \
  --from-literal=github-token='ghp_your_token' \
  --from-literal=vnc-password='your_password' \
  --dry-run=client -o yaml | \
  kubeseal --format=yaml > k8s/sealedsecrets.yaml
 ```
 ### 3. Configure Repository
 Edit `k8s/configmap.yaml`:
 ```yaml
 data:
  github-repo: "https://github.com/yourusername/yourrepo"
 ```
 ### 4. Deploy to Kubernetes
 ```bash
 kubectl apply -k k8s/
 ```
 ### 5. Access the Interface
 ```bash
 # Port forward for local access
 kubectl port-forward statefulset/antigravity 5800:5800
 # Open in browser
 open http://localhost:5800
 ```
 Or configure HTTPRoute (Gateway API) for external access via your domain.
 ## Environment Variables
 ### Required
 - `GITHUB_REPO` - GitHub repository URL to clone
 ### Optional
 - `GITHUB_TOKEN` - GitHub Personal Access Token (for private repos)
 - `VNC_PASSWORD` - Password for VNC access
 - `USER_ID` - UID for claude user (default: 1000)
 - `GROUP_ID` - GID for claude user (default: 1000)
 - `DISPLAY_WIDTH` - VNC display width (default: 1920)
 - `DISPLAY_HEIGHT` - VNC display height (default: 1080)
 ### Happy Coder Configuration (Optional)
 - `HAPPY_SERVER_URL` - Custom Happy server URL (default: https://api.cluster-fluster.com)
 - `HAPPY_WEBAPP_URL` - Custom Happy webapp URL (default: https://app.happy.engineering)
 - `HAPPY_HOME_DIR` - Happy data directory (default: /home/claude/.happy)
 - `HAPPY_EXPERIMENTAL` - Enable experimental features (default: true in container)
 ## Architecture
 ```
 ┌─────────────────────────────────────┐
 │  Web Browser (Port 5800)            │
 └──────────────┬──────────────────────┘
               │
               ▼
 ┌─────────────────────────────────────┐
 │  VNC Web Interface                  │
 │  (jlesage/baseimage-gui)            │
 └──────────────┬──────────────────────┘
               │
               ▼
 ┌─────────────────────────────────────┐
 │  Antigravity IDE                    │
 │  (VSCode + Extensions)              │
 │  Running as user: claude (1000)     │
 └──────────────┬──────────────────────┘
               │
               ▼
 ┌─────────────────────────────────────┐
 │  Happy Coder (Background Process)   │
 │  AI Development Assistant           │
 └─────────────────────────────────────┘
               │
               ▼
 ┌─────────────────────────────────────┐
 │  Workspace: /workspace/{repo}       │
 │  Home: /home/claude (RWX PVC)       │
 └─────────────────────────────────────┘
 ```
 ## Startup Flow
 1. **Container starts** - baseimage-gui initializes
 2. **init-repo.sh runs**:
   - Checks for `GITHUB_REPO` environment variable
   - Clones repository to `/workspace/{repo-name}` if not exists
   - Configures git credentials with `GITHUB_TOKEN`
   - Starts Happy Coder in background
 3. **startapp.sh runs**:
   - Opens Antigravity IDE in the cloned repository
   - Happy Coder is already running and accessible
 ## Happy Coder Integration
 Happy Coder runs as a background service and is accessible within the IDE:
 ```bash
 # Check Happy Coder status
 ps aux | grep happy-coder
 # View logs
 cat /tmp/happy-coder.log
 # Restart Happy Coder
 sudo -u claude bash -c "cd /workspace/your-repo && happy-coder &"
 ```
 ## Local Development
 ### Run with Docker Compose
 ```yaml
 version: '3.8'
 services:
  antigravity:
    build: .
    ports:
      - "5800:5800"
    environment:
      - GITHUB_REPO=https://github.com/yourusername/yourrepo
      - GITHUB_TOKEN=ghp_your_token
      - VNC_PASSWORD=yourpassword
      - HAPPY_EXPERIMENTAL=true
    volumes:
      - ./home:/home
      - ./workspace:/workspace
 ```
 ```bash
 docker-compose up
 ```
 ### Run with Docker
 ```bash
 docker run -d \
  -p 5800:5800 \
  -e GITHUB_REPO="https://github.com/yourusername/yourrepo" \
  -e GITHUB_TOKEN="ghp_your_token" \
  -e VNC_PASSWORD="yourpassword" \
  -e HAPPY_EXPERIMENTAL="true" \
  -v $(pwd)/home:/home \
  -v $(pwd)/workspace:/workspace \
  ghcr.io/cpfarhood/antigravity:latest
 ```
 ## Kubernetes Deployment
 ### With Flux
 See the animaniacs cluster configuration for GitOps deployment patterns.
 ### Standalone
 ```bash
 # Apply manifests
 kubectl apply -k k8s/
 # Check status
 kubectl get statefulset antigravity
 kubectl get pods -l app=antigravity
 # Access logs
 kubectl logs antigravity-0
 # Access shell
 kubectl exec -it antigravity-0 -- bash
 ```
 ## Troubleshooting
 ### Repository not cloning
 ```bash
 # Check logs
 kubectl logs antigravity-0 | grep "Repository Initialization"
 # Verify GITHUB_REPO is set
 kubectl exec antigravity-0 -- env | grep GITHUB
 # Check git credentials
 kubectl exec antigravity-0 -- cat /home/claude/.git-credentials
 ```
 ### Happy Coder not starting
 ```bash
 # Check Happy Coder logs
 kubectl exec antigravity-0 -- cat /tmp/happy-coder.log
 # Verify API key
 kubectl exec antigravity-0 -- env | grep HAPPY_CODER
 # Restart Happy Coder
 kubectl exec antigravity-0 -- sudo -u claude bash -c "cd /workspace/repo && happy-coder &"
 ```
 ### VNC not accessible
 ```bash
 # Check port forwarding
 kubectl port-forward antigravity-0 5800:5800
 # Verify service
 kubectl get svc antigravity
 # Check pod status
 kubectl describe pod antigravity-0
 ```
 ### Permission issues
 ```bash
 # Check ownership
 kubectl exec antigravity-0 -- ls -la /home/claude
 kubectl exec antigravity-0 -- ls -la /workspace
 # Fix ownership
 kubectl exec antigravity-0 -- chown -R claude:claude /home/claude
 kubectl exec antigravity-0 -- chown -R claude:claude /workspace
 ```
 ## Security Considerations
 1. **Secrets Management**: Use SealedSecrets or external secret managers
 2. **Network Policies**: Restrict ingress/egress as needed
 3. **RBAC**: Limit who can access the namespace
 4. **VNC Password**: Always set a strong VNC password
 5. **GitHub Token**: Use fine-grained tokens with minimal permissions
 6. **Container Security**: Runs as non-root user (claude:1000)
 ## Storage
 ### Home Directory (`/home`)
 - Mounted from ReadWriteMany PVC (`userhome`)
 - Persists user settings, credentials, history
 - Survives pod restarts
 ### Workspace (`/workspace`)
 - ephemeral emptyDir (can be changed to PVC)
 - Contains cloned repository
 - Rebuild on pod restart
 To persist workspace:
 1. Create a PVC for workspace
 2. Update `statefulset.yaml` to use PVC instead of emptyDir
 ## Customization
 ### Add More Tools
 Edit `Dockerfile`:
 ```dockerfile
 RUN apt-get update && apt-get install -y \
    your-package-here \
    && rm -rf /var/lib/apt/lists/*
 ```
 ### Change Display Resolution
 Set environment variables:
 ```yaml
 env:
  - name: DISPLAY_WIDTH
    value: "2560"
  - name: DISPLAY_HEIGHT
    value: "1440"
 ```
 ### Auto-clone Multiple Repos
 Modify `init-repo.sh` to support `GITHUB_REPOS` (comma-separated):
 ```bash
 IFS=',' read -ra REPOS <<< "$GITHUB_REPOS"
 for repo in "${REPOS[@]}"; do
  # Clone each repo
 done
 ```
 ## License
 MIT
 ## Credits
- Base image: [jlesage/docker-baseimage-gui](https://github.com/jlesage/docker-baseimage-gui)
+- Built on [jlesage/baseimage-gui](https://github.com/jlesage/docker-baseimage-gui)
- AI assistant: [Happy Coder](https://happy.engineering) + [Claude](https://claude.ai)
+- Uses [Happy Coder](https://happy.engineering)
 - Inspired by Google's Project IDX
@@ -1,444 +1,315 @@
-# Helm Chart Values Reference
+# Configuration Variables Reference
-Complete reference for all configurable values in the Antigravity Dev Container Helm chart.
+Quick reference for all configurable variables in this project.
-## Core Configuration
+## Required Variables
-### name
+These MUST be configured before deployment:
 ### Storage Class Name
 - **Variable:** `storageClassName`
 - **File:** `k8s/statefulset.yaml`
 - **Line:** ~117
 - **Type:** String
- **Default:** `""`
+- **Description:** ReadWriteMany storage class available in your cluster
- **Required:** Yes
+- **Example:** `ceph-filesystem`, `nfs-client`, `efs-sc`
- **Description:** Instance name used to generate resource names (`devcontainer-{name}`, `userhome-{name}`)
+- **How to find:** `kubectl get storageclass`
 - **Example:** `mydev`, `alice-dev`, `team-workspace`
-### githubRepo
+### GitHub Repository URL
 - **Variable:** `github-repo`
 - **File:** `k8s/configmap.yaml`
 - **Line:** ~9
 - **Type:** String (URL)
 - **Description:** Repository to clone on container startup
 - **Format:** `https://github.com/username/repository`
 - **Example:** `https://github.com/cpfarhood/my-project`
 ### Gateway Name
 - **Variable:** `parentRefs[0].name`
 - **File:** `k8s/httproute.yaml`
 - **Line:** ~8
 - **Type:** String
- **Default:** `""`
+- **Description:** Name of your Gateway resource
- **Required:** Yes
+- **How to find:** `kubectl get gateway -A`
 - **Description:** GitHub repository URL to clone into `/workspace`
 - **Example:** `https://github.com/username/repository`
-### ide
+### Gateway Namespace
 - **Variable:** `parentRefs[0].namespace`
 - **File:** `k8s/httproute.yaml`
 - **Line:** ~9
 - **Type:** String
- **Default:** `vscode`
+- **Description:** Namespace where Gateway is deployed
- **Options:** `vscode`, `antigravity`, `none`
+- **How to find:** `kubectl get gateway -A`
 - **Description:** IDE to launch inside the container
  - `vscode` — VSCode via VNC browser UI on port 5800
  - `antigravity` — Google Antigravity (VSCode fork) via VNC on port 5800
  - `none` — No IDE; useful when `ssh: true` is the sole access method
-### ssh
+### Domain Hostname
- **Type:** Boolean
+- **Variable:** `hostnames[0]`
- **Default:** `false`
+- **File:** `k8s/httproute.yaml`
- **Description:** Start an OpenSSH server on port 22 in addition to the IDE
+- **Line:** ~11
- **Note:** Requires `SSH_AUTHORIZED_KEYS` in env secret for key-based login
+- **Type:** String (FQDN)
 - **Description:** Domain name for accessing the container
 - **Example:** `devcontainer.example.com`
-## Image Configuration
+## Optional Variables
-### image.repository
+### GitHub Token
 - **Variable:** `github-token`
 - **File:** Sealed Secret
 - **Type:** String (GitHub PAT)
 - **Description:** Personal Access Token for private repos
 - **Required:** Only for private repositories
 - **Format:** `ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`
 - **Scopes:** `repo`
 ### Anthropic API Key
 - **Variable:** `ANTHROPIC_API_KEY`
 - **File:** Kubernetes Secret (referenced by `envSecretName`)
 - **Type:** String (Anthropic API key)
 - **Description:** API key for Claude Code / Happy Coder authentication. Browser-based OAuth login does not work inside the VNC session, so this key is **required** for Happy Coder to function.
 - **Required:** Yes (for Happy Coder / Claude Code)
 - **Format:** `sk-ant-api03-...`
 - **How to get:** https://console.anthropic.com/settings/keys
 ### VNC Password
 - **Variable:** `vnc-password`
 - **File:** Kubernetes Secret (referenced by `envSecretName`)
 - **Type:** String
- **Default:** `ghcr.io/cpfarhood/devcontainer`
+- **Description:** Password for VNC web interface
- **Description:** Container image repository
+- **Required:** Recommended for security
 - **Format:** Any string (12+ characters recommended)
-### image.tag
+### Namespace
 - **Variable:** `namespace`
 - **File:** `k8s/kustomization.yaml`
 - **Line:** ~5
 - **Type:** String
- **Default:** `latest`
+- **Description:** Kubernetes namespace for deployment
- **Description:** Container image tag
+- **Default:** `default`
 - **Best Practice:** Use specific version tags for production
-### image.pullPolicy
+### Container Image
- **Type:** String
+- **Variable:** `image`
- **Default:** `Always`
+- **File:** `k8s/statefulset.yaml`
- **Options:** `Always`, `IfNotPresent`, `Never`
+- **Line:** ~32
- **Description:** Image pull policy
+- **Type:** String (image reference)
 - **Description:** Docker image to deploy
 - **Default:** `ghcr.io/cpfarhood/devcontainer:latest`
 - **Format:** `registry/repository:tag`
-## Happy Coder Configuration
+### Memory Request
-
+- **Variable:** `resources.requests.memory`
-### happyServerUrl
+- **File:** `k8s/statefulset.yaml`
- **Type:** String
+- **Line:** ~99
- **Default:** `https://happy.farh.net`
+- **Type:** String (quantity)
 - **Description:** Happy Coder server endpoint
 - **When to Change:** Self-hosted Happy instance
 ### happyWebappUrl
 - **Type:** String
 - **Default:** `https://happy-coder.farh.net`
 - **Description:** Happy Coder webapp URL
 - **When to Change:** Self-hosted Happy instance
 ### happyHomeDir
 - **Type:** String
 - **Default:** `/config/userdata/.happy`
 - **Description:** Happy runtime state directory (persists on PVC)
 ### happyExperimental
 - **Type:** String
 - **Default:** `"true"`
 - **Description:** Enable experimental Happy features
 ## Display Configuration
 ### display.width
 - **Type:** String
 - **Default:** `"1920"`
 - **Description:** VNC display width in pixels
 ### display.height
 - **Type:** String
 - **Default:** `"1080"`
 - **Description:** VNC display height in pixels
 ### secureConnection
 - **Type:** String
 - **Default:** `"0"`
 - **Options:** `"0"`, `"1"`
 - **Description:** Set to `"0"` when TLS is terminated at the gateway layer
 ## User Configuration
 ### userId
 - **Type:** String
 - **Default:** `"1000"`
 - **Description:** UID for the app user
 ### groupId
 - **Type:** String
 - **Default:** `"1000"`
 - **Description:** GID for the app user
 ## Storage Configuration
 ### storage.size
 - **Type:** String
 - **Default:** `32Gi`
 - **Description:** Size of the persistent home directory
 - **Format:** Kubernetes quantity (e.g., `10Gi`, `100Gi`, `1Ti`)
 ### storage.className
 - **Type:** String
 - **Default:** `ceph-filesystem`
 - **Description:** StorageClass name (must support ReadWriteMany)
 - **Examples:** `ceph-filesystem`, `nfs-client`, `efs-sc`, `azurefile`
 ### shm.sizeLimit
 - **Type:** String
 - **Default:** `2Gi`
 - **Description:** `/dev/shm` size (memory-backed emptyDir for Electron apps)
 ## Resource Limits
 ### resources.requests.memory
 - **Type:** String
 - **Default:** `2Gi`
 - **Description:** Minimum memory to reserve
- **Format:** Kubernetes quantity
+- **Default:** `2Gi`
 - **Format:** `<number>Gi` or `<number>Mi`
-### resources.requests.cpu
+### Memory Limit
- **Type:** String
+- **Variable:** `resources.limits.memory`
- **Default:** `1000m`
+- **File:** `k8s/statefulset.yaml`
- **Description:** Minimum CPU to reserve
+- **Line:** ~102
- **Format:** Millicores (`1000m` = 1 CPU core)
+- **Type:** String (quantity)
 ### resources.limits.memory
 - **Type:** String
 - **Default:** `8Gi`
 - **Description:** Maximum memory allowed
- **Format:** Kubernetes quantity
+- **Default:** `8Gi`
 - **Format:** `<number>Gi` or `<number>Mi`
-### resources.limits.cpu
+### CPU Request
- **Type:** String
+- **Variable:** `resources.requests.cpu`
- **Default:** `4000m`
+- **File:** `k8s/statefulset.yaml`
 - **Line:** ~100
 - **Type:** String (quantity)
 - **Description:** Minimum CPU to reserve
 - **Default:** `1000m` (1 core)
 - **Format:** `<number>m` (millicores) or `<number>` (cores)
 ### CPU Limit
 - **Variable:** `resources.limits.cpu`
 - **File:** `k8s/statefulset.yaml`
 - **Line:** ~103
 - **Type:** String (quantity)
 - **Description:** Maximum CPU allowed
- **Format:** Millicores (`4000m` = 4 CPU cores)
+- **Default:** `4000m` (4 cores)
 - **Format:** `<number>m` (millicores) or `<number>` (cores)
-## Kubernetes Access
+### Storage Size
 - **Variable:** `storage` (under volumeClaimTemplates)
 - **File:** `k8s/statefulset.yaml`
 - **Line:** ~120
 - **Type:** String (quantity)
 - **Description:** Size of home directory PVC
 - **Default:** `10Gi`
 - **Format:** `<number>Gi` or `<number>Ti`
-### clusterAccess
+### Happy Server URL
 - **Variable:** `happy-server-url`
 - **File:** `k8s/configmap.yaml`
 - **Line:** ~12 (commented)
 - **Type:** String (URL)
 - **Description:** Custom Happy Coder server
 - **Default:** `https://api.cluster-fluster.com`
 - **When to set:** Self-hosted Happy instance only
 ### Happy Webapp URL
 - **Variable:** `happy-webapp-url`
 - **File:** `k8s/configmap.yaml`
 - **Line:** ~13 (commented)
 - **Type:** String (URL)
 - **Description:** Custom Happy Coder webapp
 - **Default:** `https://app.happy.engineering`
 - **When to set:** Self-hosted Happy instance only
 ### Display Width
 - **Variable:** `DISPLAY_WIDTH`
 - **File:** `k8s/statefulset.yaml`
 - **Line:** ~56
 - **Type:** String (number)
 - **Description:** VNC display width in pixels
 - **Default:** `1920`
 ### Display Height
 - **Variable:** `DISPLAY_HEIGHT`
 - **File:** `k8s/statefulset.yaml`
 - **Line:** ~58
 - **Type:** String (number)
 - **Description:** VNC display height in pixels
 - **Default:** `1080`
 ### User ID
 - **Variable:** `USER_ID`
 - **File:** `k8s/statefulset.yaml`
 - **Line:** ~51
 - **Type:** String (number)
 - **Description:** UID for claude user
 - **Default:** `1000`
 ### Group ID
 - **Variable:** `GROUP_ID`
 - **File:** `k8s/statefulset.yaml`
 - **Line:** ~53
 - **Type:** String (number)
 - **Description:** GID for claude user
 - **Default:** `1000`
 ### StatefulSet Replicas
 - **Variable:** `replicas`
 - **File:** `k8s/statefulset.yaml`
 - **Line:** ~21
 - **Type:** Integer
 - **Description:** Number of container instances
 - **Default:** `1`
 - **Note:** Each replica gets own home PVC
 ## Environment Variables (Runtime)
 These are set at runtime, not in configuration files:
 ### GITHUB_REPO
 - **Type:** String (URL)
 - **Description:** Repository URL (from ConfigMap)
 - **Required:** Yes
 - **Source:** ConfigMap `antigravity.github-repo`
 ### GITHUB_TOKEN
 - **Type:** String
- **Default:** `none`
+- **Description:** GitHub PAT (from Secret)
- **Options:**
+- **Required:** No (only for private repos)
-  - `none` — No cluster access
+- **Source:** Secret `antigravity.github-token`
  - `readonlyns` — Read-only access to release namespace
  - `readwritens` — Full access to release namespace
  - `readonly` — Read-only access cluster-wide
  - `readwrite` — Full access cluster-wide
 - **Description:** RBAC permissions for the pod's ServiceAccount
-## Secrets
+### VNC_PASSWORD
 ### envSecretName
 - **Type:** String
- **Default:** `""` (auto-generates as `devcontainer-{name}-secrets-env`)
+- **Description:** VNC password (from Secret)
- **Description:** Name of existing Secret containing environment variables
+- **Required:** No
- **Keys Recognized:**
+- **Source:** Secret `antigravity.vnc-password`
  - `GITHUB_TOKEN` — PAT for private repo access
  - `VNC_PASSWORD` — Password for VNC web UI
  - `ANTHROPIC_API_KEY` — API key for Claude
  - `SSH_AUTHORIZED_KEYS` — Public keys for SSH access
  - `homeassistant-url` — Home Assistant base URL (e.g., http://homeassistant.local:8123)
  - `homeassistant-token` — Home Assistant long-lived access token
-## MCP Sidecars
+### HAPPY_SERVER_URL
 - **Type:** String (URL)
 - **Description:** Happy server URL (from ConfigMap)
 - **Required:** No
 - **Source:** ConfigMap `antigravity.happy-server-url`
-### mcpSidecars.kubernetes.enabled
+### HAPPY_WEBAPP_URL
- **Type:** Boolean
+- **Type:** String (URL)
 - **Description:** Happy webapp URL (from ConfigMap)
 - **Required:** No
 - **Source:** ConfigMap `antigravity.happy-webapp-url`
 ### HAPPY_HOME_DIR
 - **Type:** String (path)
 - **Description:** Happy data directory
 - **Required:** No
 - **Default:** `/home/claude/.happy`
 - **Source:** Hardcoded in StatefulSet
 ### HAPPY_EXPERIMENTAL
 - **Type:** String (boolean)
 - **Description:** Enable Happy experimental features
 - **Required:** No
 - **Default:** `true`
- **Description:** Enable Kubernetes MCP server sidecar
+- **Source:** Hardcoded in StatefulSet
-### mcpSidecars.kubernetes.image.repository
+## Variable Groups by Use Case
 - **Type:** String
 - **Default:** `quay.io/containers/kubernetes_mcp_server`
 - **Description:** Kubernetes MCP server image
-### mcpSidecars.kubernetes.image.tag
+### Minimal Deployment
- **Type:** String
+Only these variables are required for basic deployment:
- **Default:** `latest`
+1. `storageClassName`
- **Description:** Kubernetes MCP server image tag
+2. `github-repo`
 3. `parentRefs.name`
 4. `parentRefs.namespace`
 5. `hostnames`
-### mcpSidecars.kubernetes.port
+### Private Repository Deployment
- **Type:** Integer
+Add these for private repos:
- **Default:** `8080`
+1. All minimal deployment variables
- **Description:** Port for Kubernetes MCP server
+2. `github-token` (sealed secret)
-### mcpSidecars.kubernetes.resources
+### Production Deployment
- **Type:** Object
+Recommended for production:
- **Default:**
+1. All private repository variables
-  ```yaml
+2. `vnc-password` (sealed secret)
-  requests:
+3. `resources.requests.*` (adjusted for workload)
-    memory: "64Mi"
+4. `resources.limits.*` (adjusted for workload)
-    cpu: "50m"
+5. `namespace` (dedicated namespace)
  limits:
    memory: "256Mi"
    cpu: "500m"
  ```
 - **Description:** Resource limits for Kubernetes MCP sidecar
-### mcpSidecars.flux.enabled
+### Multi-User Deployment
- **Type:** Boolean
+For multiple users:
- **Default:** `true`
+1. All production deployment variables
- **Description:** Enable Flux MCP server sidecar
+2. `replicas` (set to number of users)
 3. Larger `storage` size for home PVCs
-### mcpSidecars.flux.image.repository
+## Quick Copy Templates
 - **Type:** String
 - **Default:** `ghcr.io/controlplaneio-fluxcd/flux-operator-mcp`
 - **Description:** Flux MCP server image
 ### mcpSidecars.flux.image.tag
 - **Type:** String
 - **Default:** `v0.41.1`
 - **Description:** Flux MCP server image tag
 ### mcpSidecars.flux.port
 - **Type:** Integer
 - **Default:** `8081`
 - **Description:** Port for Flux MCP server
 ### mcpSidecars.flux.resources
 - **Type:** Object
 - **Default:**
  ```yaml
  requests:
    memory: "64Mi"
    cpu: "50m"
  limits:
    memory: "256Mi"
    cpu: "500m"
  ```
 - **Description:** Resource limits for Flux MCP sidecar
 ### mcpSidecars.homeassistant.enabled
 - **Type:** Boolean
 - **Default:** `false`
 - **Description:** Enable Home Assistant MCP server sidecar
 - **Note:** Requires `homeassistant-url` and `homeassistant-token` in env secret
 ### mcpSidecars.homeassistant.image.repository
 - **Type:** String
 - **Default:** `ghcr.io/homeassistant-ai/ha-mcp`
 - **Description:** Home Assistant MCP server image
 ### mcpSidecars.homeassistant.image.tag
 - **Type:** String
 - **Default:** `stable`
 - **Description:** Home Assistant MCP server image tag
 - **Options:** `stable` (recommended), `latest` (dev builds), `v{version}` (specific version)
 ### mcpSidecars.homeassistant.port
 - **Type:** Integer
 - **Default:** `8087`
 - **Description:** Port for Home Assistant MCP server (SSE mode)
 ### mcpSidecars.homeassistant.resources
 - **Type:** Object
 - **Default:**
  ```yaml
  requests:
    memory: "64Mi"
    cpu: "50m"
  limits:
    memory: "256Mi"
    cpu: "500m"
  ```
 - **Description:** Resource limits for Home Assistant MCP sidecar
 ## Usage Examples
 ### Minimal Configuration
 ### Minimal Required Variables
 ```yaml
-name: mydev
+# k8s/statefulset.yaml
-githubRepo: https://github.com/user/repo
+storageClassName: "CHANGE_ME"  # Line ~117
 # k8s/configmap.yaml
 github-repo: "CHANGE_ME"  # Line ~9
 # k8s/httproute.yaml
 parentRefs:
 - name: CHANGE_ME  # Line ~8
  namespace: CHANGE_ME  # Line ~9
 hostnames:
 - "CHANGE_ME"  # Line ~11
 ```
-### Production Configuration
+### With Secrets
 ```bash
 kubectl create secret generic antigravity-secrets \
  --from-literal=GITHUB_TOKEN='CHANGE_ME' \
  --from-literal=VNC_PASSWORD='CHANGE_ME' \
  --from-literal=ANTHROPIC_API_KEY='sk-ant-api03-...' \
  --dry-run=client -o yaml | \
  kubeseal --format=yaml > k8s/sealedsecrets.yaml
 ```
 ### With Resource Adjustments
 ```yaml
-name: prod-workspace
+# k8s/statefulset.yaml (lines ~98-103)
 githubRepo: https://github.com/company/application
 ide: vscode
 ssh: true
 image:
  tag: v1.0.0
 storage:
  size: 100Gi
  className: ceph-filesystem
 resources:
  requests:
-    memory: "4Gi"
+    memory: "CHANGE_ME"  # e.g., 4Gi
-    cpu: "2000m"
+    cpu: "CHANGE_ME"     # e.g., 2000m
  limits:
-    memory: "16Gi"
+    memory: "CHANGE_ME"  # e.g., 16Gi
-    cpu: "8000m"
+    cpu: "CHANGE_ME"     # e.g., 8000m
 clusterAccess: readwritens
 mcpSidecars:
  kubernetes:
    enabled: true
  flux:
    enabled: false
 ```
 ### Development Team Configuration
 ```yaml
 name: team-dev
 githubRepo: https://github.com/team/project
 ide: antigravity
 display:
  width: "2560"
  height: "1440"
 storage:
  size: 50Gi
  className: nfs-client
 clusterAccess: readonly
 happyServerUrl: https://happy.internal.company.com
 happyWebappUrl: https://happy-app.internal.company.com
 ```
 ### Smart Home Development Configuration
 ```yaml
 name: smarthome-dev
 githubRepo: https://github.com/user/home-automation
 ide: vscode
 clusterAccess: readwritens
 mcpSidecars:
  kubernetes:
    enabled: true
  flux:
    enabled: false
  homeassistant:
    enabled: true
    image:
      tag: stable
 # Requires secrets:
 # homeassistant-url: http://homeassistant.local:8123
 # homeassistant-token: <long-lived-access-token>
 ```
 ## Helm CLI Examples
 ### Using --set Flags
 ```bash
 # Basic deployment
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/user/repo
 # With multiple values
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/user/repo \
  --set ide=antigravity \
  --set storage.size=50Gi \
  --set clusterAccess=readwritens \
  --set mcpSidecars.flux.enabled=false
 ```
 ### Using Values File
 Create `custom-values.yaml`:
 ```yaml
 name: mydev
 githubRepo: https://github.com/user/repo
 storage:
  size: 50Gi
 clusterAccess: readwritens
 ```
 Deploy:
 ```bash
 helm install mydev ./chart -f custom-values.yaml
 ```
 ### Combining Methods
 ```bash
 helm install mydev ./chart \
  -f base-values.yaml \
  -f prod-values.yaml \
  --set githubRepo=https://github.com/user/repo \
  --set image.tag=v2.0.0
 ```
 ## Value Precedence
 Values are applied in order of precedence (highest to lowest):
 1. `--set` flags on command line
 2. `-f` values files (later files override earlier)
 3. `chart/values.yaml` defaults
 ## Environment Variables
 These environment variables are set in the container based on chart values:
 | Environment Variable | Source Value | Description |
 |---------------------|--------------|-------------|
 | `GITHUB_REPO` | `githubRepo` | Repository to clone |
 | `GITHUB_TOKEN` | Secret: `github-token` | PAT for private repos |
 | `VNC_PASSWORD` | Secret: `vnc-password` | VNC access password |
 | `ANTHROPIC_API_KEY` | Secret: `anthropic-api-key` | Claude API key |
 | `SSH_AUTHORIZED_KEYS` | Secret: `ssh-authorized-keys` | SSH public keys |
 | `HAPPY_SERVER_URL` | `happyServerUrl` | Happy server endpoint |
 | `HAPPY_WEBAPP_URL` | `happyWebappUrl` | Happy webapp URL |
 | `HAPPY_HOME_DIR` | `happyHomeDir` | Happy data directory |
 | `HAPPY_EXPERIMENTAL` | `happyExperimental` | Experimental features |
 | `DISPLAY_WIDTH` | `display.width` | VNC width |
 | `DISPLAY_HEIGHT` | `display.height` | VNC height |
 | `SECURE_CONNECTION` | `secureConnection` | TLS termination |
 | `USER_ID` | `userId` | App user UID |
 | `GROUP_ID` | `groupId` | App user GID |
 | `IDE` | `ide` | IDE to launch |
 | `SSH` | `ssh` | SSH server enabled |
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: devcontainer
-description: Dev Container with AI coding agents and MCP sidecars
+description: Antigravity Dev Container with Happy Coder AI assistant
 type: application
-version: 0.4.11
+version: 0.1.1
 appVersion: "latest"
@@ -1,381 +0,0 @@
 # Dev Container Helm Chart Usage Guide
 This guide provides common usage patterns and examples for the Dev Container Helm chart.
 ## Quick Start
 ### 1. Minimal Installation (Recommended)
 Use the quickstart values for the simplest setup:
 ```bash
 # Copy and customize quickstart values
 cp values-quickstart.yaml my-values.yaml
 # Edit my-values.yaml to set your name and repo:
 # name: myproject
 # githubRepo: https://github.com/youruser/yourproject
 # Install
 helm install myproject ./chart -f my-values.yaml
 ```
 ### 2. One-Command Installation
 ```bash
 helm install mydev ./chart \
  --set name=mydev \
  --set githubRepo=https://github.com/youruser/yourrepo
 ```
 ## Common Use Cases
 ### Development Environment
 **Scenario**: Standard development with GitHub integration
 ```yaml
 name: dev-environment
 githubRepo: https://github.com/company/project
 ide:
  type: vscode
 mcp:
  sidecars:
    kubernetes:
      enabled: true
    playwright:
      enabled: true
    flux:
      enabled: false    # Disable if not using Flux
 ```
 ### Team Workspace
 **Scenario**: Shared development environment with more resources
 ```yaml
 name: team-workspace
 githubRepo: https://github.com/company/project
 resources:
  requests:
    memory: "4Gi"
    cpu: "2000m"
  limits:
    memory: "16Gi"
    cpu: "8000m"
 storage:
  size: 64Gi
 ssh:
  enabled: true         # Enable SSH access for team
 clusterAccess: readwrite # Full cluster access
 ```
 ### Kubernetes Admin Environment
 **Scenario**: Platform engineering with full cluster access
 ```yaml
 name: k8s-admin
 githubRepo: https://github.com/company/k8s-configs
 clusterAccess: readwrite
 mcp:
  sidecars:
    kubernetes:
      enabled: true
    flux:
      enabled: true
    pgtuner:
      enabled: true     # Database administration
    playwright:
      enabled: false    # Save resources
 ```
 ### AI/ML Development
 **Scenario**: AI development with browser automation
 ```yaml
 name: ai-playground
 githubRepo: https://github.com/company/ai-project
 resources:
  requests:
    memory: "8Gi"       # More memory for ML workloads
    cpu: "4000m"
  limits:
    memory: "32Gi"
    cpu: "16000m"
 storage:
  size: 128Gi           # Large datasets
 mcp:
  sidecars:
    playwright:
      enabled: true     # Web scraping, testing
    kubernetes:
      enabled: false    # Save resources
    flux:
      enabled: false
 ```
 ### Lightweight Environment
 **Scenario**: Resource-constrained setup
 ```yaml
 name: lightweight
 githubRepo: https://github.com/youruser/small-project
 resources:
  requests:
    memory: "1Gi"
    cpu: "500m"
  limits:
    memory: "2Gi"
    cpu: "1000m"
 storage:
  size: 8Gi
 mcp:
  sidecars:
    kubernetes:
      enabled: false
    flux:
      enabled: false
    playwright:
      enabled: false
    # Only keep essential sidecars enabled
 ```
 ## Secret Configuration
 ### Basic Secrets
 ```bash
 # GitHub access only
 kubectl create secret generic devcontainer-mydev-secrets-env \
  --from-literal=GITHUB_TOKEN='ghp_...' \
  --from-literal=VNC_PASSWORD='changeme'
 ```
 ### Extended Secrets
 ```bash
 # Full feature set
 kubectl create secret generic devcontainer-mydev-secrets-env \
  --from-literal=GITHUB_TOKEN='ghp_...' \
  --from-literal=VNC_PASSWORD='changeme' \
  --from-literal=SSH_AUTHORIZED_KEYS='ssh-ed25519 AAAA...' \
  --from-literal=HOMEASSISTANT_URL='http://homeassistant.local:8123' \
  --from-literal=HOMEASSISTANT_TOKEN='eyJ...' \
  --from-literal=DATABASE_URI='postgresql://user:pass@postgres:5432/db'
 ```
 ## Storage Configuration
 ### Different Storage Classes
 ```yaml
 # For different Kubernetes distributions
 storage:
  className: ""           # Auto-detect (recommended)
  # className: longhorn   # Longhorn
  # className: nfs-client # NFS
  # className: fast-ssd   # Custom fast storage
 ```
 ### Storage Sizes by Use Case
 ```yaml
 # Small projects
 storage:
  size: 8Gi
 # Standard development
 storage:
  size: 32Gi
 # Large projects / datasets
 storage:
  size: 128Gi
 # Team environments
 storage:
  size: 256Gi
 ```
 ## Access Patterns
 ### VNC Only (Default)
 ```yaml
 ide:
  type: vscode
 # Access via: kubectl port-forward deployment/devcontainer-mydev 5800:5800
 ```
 ### SSH Only
 ```yaml
 ide:
  type: none
 ssh:
  enabled: true
 # Access via: kubectl port-forward deployment/devcontainer-mydev 2222:22
 # ssh -p 2222 user@localhost
 ```
 ### Both VNC and SSH
 ```yaml
 ide:
  type: vscode
 ssh:
  enabled: true
 # VNC: kubectl port-forward deployment/devcontainer-mydev 5800:5800
 # SSH: kubectl port-forward deployment/devcontainer-mydev 2222:22
 ```
 ## Resource Profiles
 ### Small (1-2 developers)
 ```yaml
 resources:
  requests:
    memory: "1Gi"
    cpu: "500m"
  limits:
    memory: "4Gi"
    cpu: "2000m"
 ```
 ### Medium (standard development)
 ```yaml
 resources:
  requests:
    memory: "2Gi"
    cpu: "1000m"
  limits:
    memory: "8Gi"
    cpu: "4000m"
 ```
 ### Large (intensive workloads)
 ```yaml
 resources:
  requests:
    memory: "4Gi"
    cpu: "2000m"
  limits:
    memory: "16Gi"
    cpu: "8000m"
 ```
 ### XLarge (AI/ML, data processing)
 ```yaml
 resources:
  requests:
    memory: "8Gi"
    cpu: "4000m"
  limits:
    memory: "32Gi"
    cpu: "16000m"
 ```
 ## MCP Sidecar Combinations
 ### Minimal (basic development)
 ```yaml
 mcp:
  sidecars:
    kubernetes:
      enabled: false
    flux:
      enabled: false
    playwright:
      enabled: true     # Keep for web testing
 ```
 ### Standard (full-stack development)
 ```yaml
 mcp:
  sidecars:
    kubernetes:
      enabled: true
    flux:
      enabled: false
    playwright:
      enabled: true
 ```
 ### DevOps/Platform (infrastructure work)
 ```yaml
 mcp:
  sidecars:
    kubernetes:
      enabled: true
    flux:
      enabled: true
    pgtuner:
      enabled: true
    playwright:
      enabled: false
 ```
 ### All Features
 ```yaml
 mcp:
  sidecars:
    kubernetes:
      enabled: true
    flux:
      enabled: true
    homeassistant:
      enabled: true
    pgtuner:
      enabled: true
    playwright:
      enabled: true
 ```
 ## Troubleshooting
 ### Values Validation
 Your IDE should automatically validate values.yaml against the schema. If not:
 ```bash
 # Manual validation (if you have a JSON schema validator)
 helm template ./chart -f values.yaml > /dev/null
 ```
 ### Common Issues
 **Resource Limits**: Start with smaller resource requests and increase as needed.
 **Storage Class**: Use `className: ""` for auto-detection.
 **GitHub Access**: Ensure GITHUB_TOKEN has `repo` scope.
 **MCP Sidecars**: Disable unused sidecars to save resources.
 ### Getting Help
 1. Check the main [README.md](../README.md) for detailed documentation
 2. Review [values.yaml](values.yaml) for all available options
 3. Use [values-quickstart.yaml](values-quickstart.yaml) as a starting point
@@ -1,96 +1,28 @@
 {{/*
 Resource name prefix: devcontainer-{name}
 */}}
-{{- define "devcontainer.fullname" -}}
+{{- define "antigravity.fullname" -}}
 {{- printf "devcontainer-%s" .Values.name }}
 {{- end }}
 {{/*
 PVC name: userhome-{name}
 */}}
-{{- define "devcontainer.pvcName" -}}
+{{- define "antigravity.pvcName" -}}
 {{- printf "userhome-%s" .Values.name }}
 {{- end }}
 {{/*
 Secret name for env vars, default to devcontainer-{name}-secrets-env
 */}}
-{{- define "devcontainer.envSecretName" -}}
+{{- define "antigravity.envSecretName" -}}
 {{- .Values.envSecretName | default (printf "devcontainer-%s-secrets-env" .Values.name) }}
 {{- end }}
 {{/*
 Common labels
 */}}
-{{- define "devcontainer.labels" -}}
+{{- define "antigravity.labels" -}}
 app: devcontainer
 instance: {{ .Values.name }}
 {{- end }}
 {{/*
 Smart resource sizing based on enabled features
 */}}
 {{- define "devcontainer.smartResources" -}}
 {{- $baseMemory := "2Gi" }}
 {{- $baseCpu := "1000m" }}
 {{- $limitMemory := "8Gi" }}
 {{- $limitCpu := "4000m" }}
 {{/* Adjust for enabled MCP sidecars */}}
 {{- if .Values.mcp.sidecars.playwright.enabled }}
  {{- $baseMemory = "3Gi" }}
  {{- $limitMemory = "12Gi" }}
 {{- end }}
 {{/* Adjust for IDE type */}}
 {{- if eq .Values.ide.type "antigravity" }}
  {{- $baseMemory = "4Gi" }}
  {{- $limitMemory = "16Gi" }}
 {{- end }}
 requests:
  memory: {{ .Values.resources.requests.memory | default $baseMemory | quote }}
  cpu: {{ .Values.resources.requests.cpu | default $baseCpu | quote }}
 limits:
  memory: {{ .Values.resources.limits.memory | default $limitMemory | quote }}
  cpu: {{ .Values.resources.limits.cpu | default $limitCpu | quote }}
 {{- end }}
 {{/*
 Auto-detect environment type and set smart defaults
 */}}
 {{- define "devcontainer.smartDefaults" -}}
 {{- $isDev := or (contains "dev" .Values.name) (contains "test" .Values.name) (contains "local" .Values.name) }}
 {{- $isProd := or (contains "prod" .Values.name) (contains "production" .Values.name) }}
 {{- $isTeam := or (contains "team" .Values.name) (contains "shared" .Values.name) }}
 {{/* Development environment - enable more sidecars, smaller resources */}}
 {{- if $isDev }}
 development: true
 {{/* Production environment - conservative defaults, fewer sidecars */}}
 {{- else if $isProd }}
 production: true
 {{/* Team environment - enable SSH, more resources */}}
 {{- else if $isTeam }}
 team: true
 {{- end }}
 {{- end }}
 {{/*
 Smart MCP sidecar selection based on cluster access
 */}}
 {{- define "devcontainer.mcpDefaults" -}}
 {{- if eq .Values.clusterAccess "none" }}
  {{/* No cluster access - disable k8s/flux sidecars */}}
  kubernetes:
    enabled: false
  flux:
    enabled: false
 {{- else }}
  {{/* Has cluster access - enable k8s sidecars */}}
  kubernetes:
    enabled: true
  flux:
    enabled: {{ ne .Values.clusterAccess "readonly" }}
 {{- end }}
 {{- end }}
@@ -1,98 +1,62 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "devcontainer.fullname" . }}
+  name: {{ include "antigravity.fullname" . }}
  labels:
-    {{- include "devcontainer.labels" . | nindent 4 }}
+    {{- include "antigravity.labels" . | nindent 4 }}
 spec:
  replicas: 1
  selector:
    matchLabels:
-      {{- include "devcontainer.labels" . | nindent 6 }}
+      {{- include "antigravity.labels" . | nindent 6 }}
  template:
    metadata:
      labels:
-        {{- include "devcontainer.labels" . | nindent 8 }}
+        {{- include "antigravity.labels" . | nindent 8 }}
    spec:
      {{- if ne (.Values.clusterAccess | default "none") "none" }}
      serviceAccountName: {{ include "devcontainer.fullname" . }}
      {{- end }}
      securityContext:
        fsGroup: 1000
        fsGroupChangePolicy: "OnRootMismatch"
      {{- if and .Values.ide.type (eq .Values.ide.type "antigravity") }}
      initContainers:
        - name: setup-userdata
          image: busybox:latest
          command: ['sh', '-c']
          args:
            - |
              echo "Setting up userdata directory..."
              mkdir -p /config/userdata
              chown 1000:1000 /config/userdata
              chmod 755 /config/userdata
              echo "Userdata directory setup complete"
          volumeMounts:
            - name: userhome
              mountPath: /config
          securityContext:
            runAsUser: 0
            runAsGroup: 0
      {{- end }}
      containers:
        - name: devcontainer
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          ports:
            {{- if ne (.Values.ide.type | default "vscode") "none" }}
            - containerPort: 5800
              name: vnc-web
              protocol: TCP
            {{- end }}
            {{- if .Values.ssh.enabled }}
            - containerPort: 22
              name: ssh
              protocol: TCP
            {{- end }}
          env:
            - name: IDE
              value: {{ .Values.ide.type | default "vscode" | quote }}
            - name: SSH
              value: {{ .Values.ssh.enabled | toString | quote }}
            - name: USER_ID
-              value: {{ .Values.user.id | quote }}
+              value: {{ .Values.userId | quote }}
            - name: GROUP_ID
-              value: {{ .Values.user.groupId | quote }}
+              value: {{ .Values.groupId | quote }}
            - name: DISPLAY_WIDTH
              value: {{ .Values.display.width | quote }}
            - name: DISPLAY_HEIGHT
              value: {{ .Values.display.height | quote }}
            - name: SECURE_CONNECTION
-              value: {{ .Values.display.secureConnection | quote }}
+              value: {{ .Values.secureConnection | quote }}
            - name: HAPPY_HOME_DIR
-              value: {{ .Values.happy.homeDir | quote }}
+              value: {{ .Values.happyHomeDir | quote }}
            - name: HAPPY_EXPERIMENTAL
-              value: {{ .Values.happy.experimental | quote }}
+              value: {{ .Values.happyExperimental | quote }}
            - name: HAPPY_SERVER_URL
-              value: {{ .Values.happy.serverUrl | quote }}
+              value: {{ .Values.happyServerUrl | quote }}
            - name: HAPPY_WEBAPP_URL
-              value: {{ .Values.happy.webappUrl | quote }}
+              value: {{ .Values.happyWebappUrl | quote }}
            - name: GITHUB_REPO
              value: {{ .Values.githubRepo | quote }}
          envFrom:
            - secretRef:
-                name: {{ include "devcontainer.envSecretName" . }}
+                name: {{ include "antigravity.envSecretName" . }}
                optional: true
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
          volumeMounts:
            - name: userhome
-              mountPath: /config
+              mountPath: /home
            - name: workspace
              mountPath: /workspace
            - name: shm
              mountPath: /dev/shm
          {{- if ne (.Values.ide.type | default "vscode") "none" }}
          livenessProbe:
            httpGet:
              path: /
@@ -105,218 +69,9 @@ spec:
              port: 5800
            initialDelaySeconds: 10
            periodSeconds: 5
          {{- else if .Values.ssh.enabled }}
          livenessProbe:
            tcpSocket:
              port: 22
            initialDelaySeconds: 15
            periodSeconds: 10
          readinessProbe:
            tcpSocket:
              port: 22
            initialDelaySeconds: 5
            periodSeconds: 5
          {{- end }}
        {{- if and .Values.mcp.sidecars.kubernetes.enabled (ne .Values.clusterAccess "none") }}
        - name: kubernetes-mcp
          image: "{{ .Values.mcp.sidecars.kubernetes.image.repository }}:{{ .Values.mcp.sidecars.kubernetes.image.tag }}"
          args:
            - --port
            - {{ .Values.mcp.sidecars.kubernetes.port | quote }}
          ports:
            - containerPort: {{ .Values.mcp.sidecars.kubernetes.port }}
              name: k8s-mcp
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /healthz
              port: {{ .Values.mcp.sidecars.kubernetes.port }}
            initialDelaySeconds: 10
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /healthz
              port: {{ .Values.mcp.sidecars.kubernetes.port }}
            initialDelaySeconds: 5
            periodSeconds: 5
          resources:
            {{- toYaml .Values.mcp.sidecars.kubernetes.resources | nindent 12 }}
        {{- end }}
        {{- if and .Values.mcp.sidecars.flux.enabled (ne .Values.clusterAccess "none") }}
        - name: flux-mcp
          image: "{{ .Values.mcp.sidecars.flux.image.repository }}:{{ .Values.mcp.sidecars.flux.image.tag }}"
          args:
            - serve
            - --transport=sse
            - --port={{ .Values.mcp.sidecars.flux.port }}
          ports:
            - containerPort: {{ .Values.mcp.sidecars.flux.port }}
              name: flux-mcp
              protocol: TCP
          livenessProbe:
            tcpSocket:
              port: {{ .Values.mcp.sidecars.flux.port }}
            initialDelaySeconds: 10
            periodSeconds: 10
          readinessProbe:
            tcpSocket:
              port: {{ .Values.mcp.sidecars.flux.port }}
            initialDelaySeconds: 5
            periodSeconds: 5
          resources:
            {{- toYaml .Values.mcp.sidecars.flux.resources | nindent 12 }}
        {{- end }}
        {{- if .Values.mcp.sidecars.fetch.enabled }}
        - name: fetch-mcp
          image: "{{ .Values.mcp.sidecars.fetch.image.repository }}:{{ .Values.mcp.sidecars.fetch.image.tag }}"
          imagePullPolicy: Always
          command: ["fastmcp", "run", "--transport", "sse", "--host", "0.0.0.0", "--port", "{{ .Values.mcp.sidecars.fetch.port }}"]
          ports:
            - name: fetch
              containerPort: {{ .Values.mcp.sidecars.fetch.port }}
          livenessProbe:
            tcpSocket:
              port: {{ .Values.mcp.sidecars.fetch.port }}
            initialDelaySeconds: 10
            periodSeconds: 10
          readinessProbe:
            tcpSocket:
              port: {{ .Values.mcp.sidecars.fetch.port }}
            initialDelaySeconds: 5
            periodSeconds: 5
          resources:
            {{- toYaml .Values.mcp.sidecars.fetch.resources | nindent 12 }}
        {{- end }}
        {{- if .Values.mcp.sidecars.sequentialthinking.enabled }}
        - name: sequentialthinking-mcp
          image: "{{ .Values.mcp.sidecars.sequentialthinking.image.repository }}:{{ .Values.mcp.sidecars.sequentialthinking.image.tag }}"
          imagePullPolicy: Always
          command: ["fastmcp", "run", "--transport", "sse", "--host", "0.0.0.0", "--port", "{{ .Values.mcp.sidecars.sequentialthinking.port }}"]
          ports:
            - name: seqthinking
              containerPort: {{ .Values.mcp.sidecars.sequentialthinking.port }}
          livenessProbe:
            tcpSocket:
              port: {{ .Values.mcp.sidecars.sequentialthinking.port }}
            initialDelaySeconds: 10
            periodSeconds: 10
          readinessProbe:
            tcpSocket:
              port: {{ .Values.mcp.sidecars.sequentialthinking.port }}
            initialDelaySeconds: 5
            periodSeconds: 5
          resources:
            {{- toYaml .Values.mcp.sidecars.sequentialthinking.resources | nindent 12 }}
        {{- end }}
        {{- if .Values.mcp.sidecars.homeassistant.enabled }}
        - name: homeassistant-mcp
          image: "{{ .Values.mcp.sidecars.homeassistant.image.repository }}:{{ .Values.mcp.sidecars.homeassistant.image.tag }}"
          imagePullPolicy: Always
          command: ["fastmcp", "run", "--transport", "sse", "--host", "0.0.0.0", "--port", "{{ .Values.mcp.sidecars.homeassistant.port }}"]
          ports:
            - name: homeassistant
              containerPort: {{ .Values.mcp.sidecars.homeassistant.port }}
          env:
            - name: HOMEASSISTANT_URL
              valueFrom:
                secretKeyRef:
                  name: {{ include "devcontainer.envSecretName" . }}
                  key: HOMEASSISTANT_URL
                  optional: true
            - name: HOMEASSISTANT_TOKEN
              valueFrom:
                secretKeyRef:
                  name: {{ include "devcontainer.envSecretName" . }}
                  key: HOMEASSISTANT_TOKEN
                  optional: true
          livenessProbe:
            tcpSocket:
              port: {{ .Values.mcp.sidecars.homeassistant.port }}
            initialDelaySeconds: 10
            periodSeconds: 10
          readinessProbe:
            tcpSocket:
              port: {{ .Values.mcp.sidecars.homeassistant.port }}
            initialDelaySeconds: 5
            periodSeconds: 5
          resources:
            {{- toYaml .Values.mcp.sidecars.homeassistant.resources | nindent 12 }}
        {{- end }}
        {{- if .Values.mcp.sidecars.pgtuner.enabled }}
        - name: pgtuner-mcp
          image: "{{ .Values.mcp.sidecars.pgtuner.image.repository }}:{{ .Values.mcp.sidecars.pgtuner.image.tag }}"
          imagePullPolicy: Always
          command: ["python", "-m", "pgtuner_mcp", "--mode", "sse", "--host", "0.0.0.0", "--port", "{{ .Values.mcp.sidecars.pgtuner.port }}"]
          ports:
            - name: pgtuner
              containerPort: {{ .Values.mcp.sidecars.pgtuner.port }}
          env:
            - name: DATABASE_URI
              valueFrom:
                secretKeyRef:
                  name: {{ include "devcontainer.envSecretName" . }}
                  key: DATABASE_URI
                  optional: true
            - name: PGTUNER_EXCLUDE_USERIDS
              valueFrom:
                secretKeyRef:
                  name: {{ include "devcontainer.envSecretName" . }}
                  key: PGTUNER_EXCLUDE_USERIDS
                  optional: true
          livenessProbe:
            tcpSocket:
              port: {{ .Values.mcp.sidecars.pgtuner.port }}
            initialDelaySeconds: 10
            periodSeconds: 10
          readinessProbe:
            tcpSocket:
              port: {{ .Values.mcp.sidecars.pgtuner.port }}
            initialDelaySeconds: 5
            periodSeconds: 5
          resources:
            {{- toYaml .Values.mcp.sidecars.pgtuner.resources | nindent 12 }}
        {{- end }}
        {{- if .Values.mcp.sidecars.playwright.enabled }}
        - name: playwright-mcp
          image: "{{ .Values.mcp.sidecars.playwright.image.repository }}:{{ .Values.mcp.sidecars.playwright.image.tag }}"
          imagePullPolicy: Always
          command: ["node"]
          args:
            - cli.js
            - --headless
            - --browser
            - chromium
            - --no-sandbox
            - --host
            - 0.0.0.0
            - --port
            - {{ .Values.mcp.sidecars.playwright.port | quote }}
          ports:
            - name: playwright
              containerPort: {{ .Values.mcp.sidecars.playwright.port }}
          livenessProbe:
            tcpSocket:
              port: {{ .Values.mcp.sidecars.playwright.port }}
            initialDelaySeconds: 15
            periodSeconds: 10
          readinessProbe:
            tcpSocket:
              port: {{ .Values.mcp.sidecars.playwright.port }}
            initialDelaySeconds: 10
            periodSeconds: 5
          resources:
            {{- toYaml .Values.mcp.sidecars.playwright.resources | nindent 12 }}
          securityContext:
            runAsUser: 1000
            runAsGroup: 1000
        {{- end }}
      volumes:
        - name: workspace
          emptyDir: {}
        - name: shm
          emptyDir:
            medium: Memory
            sizeLimit: {{ .Values.shm.sizeLimit }}
        - name: userhome
          persistentVolumeClaim:
-            claimName: {{ include "devcontainer.pvcName" . }}
+            claimName: {{ include "antigravity.pvcName" . }}
@@ -1,9 +1,9 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ include "devcontainer.pvcName" . }}
+  name: {{ include "antigravity.pvcName" . }}
  labels:
-    {{- include "devcontainer.labels" . | nindent 4 }}
+    {{- include "antigravity.labels" . | nindent 4 }}
 spec:
  accessModes:
    - ReadWriteMany
@@ -1,97 +0,0 @@
 {{- $access := .Values.clusterAccess | default "none" }}
 {{- $name   := include "devcontainer.fullname" . }}
 {{- $ns     := .Release.Namespace }}
 {{- $labels := include "devcontainer.labels" . }}
 {{- if ne $access "none" }}
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: {{ $name }}
  namespace: {{ $ns }}
  labels:
    {{- $labels | nindent 4 }}
 {{- if or (eq $access "readonlyns") (eq $access "readwritens") }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  name: {{ $name }}
  namespace: {{ $ns }}
  labels:
    {{- $labels | nindent 4 }}
 rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs:
    {{- if eq $access "readonlyns" }}
      - get
      - list
      - watch
    {{- else }}
      - "*"
    {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  name: {{ $name }}
  namespace: {{ $ns }}
  labels:
    {{- $labels | nindent 4 }}
 subjects:
  - kind: ServiceAccount
    name: {{ $name }}
    namespace: {{ $ns }}
 roleRef:
  kind: Role
  name: {{ $name }}
  apiGroup: rbac.authorization.k8s.io
 {{- end }}
 {{- if or (eq $access "readonly") (eq $access "readwrite") }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
  name: {{ $name }}
  labels:
    {{- $labels | nindent 4 }}
 rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs:
    {{- if eq $access "readonly" }}
      - get
      - list
      - watch
    {{- else }}
      - "*"
    {{- end }}
  - nonResourceURLs: ["*"]
    verbs:
    {{- if eq $access "readonly" }}
      - get
    {{- else }}
      - "*"
    {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
  name: {{ $name }}
  labels:
    {{- $labels | nindent 4 }}
 subjects:
  - kind: ServiceAccount
    name: {{ $name }}
    namespace: {{ $ns }}
 roleRef:
  kind: ClusterRole
  name: {{ $name }}
  apiGroup: rbac.authorization.k8s.io
 {{- end }}
 {{- end }}
@@ -1,22 +1,14 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "devcontainer.fullname" . }}
+  name: {{ include "antigravity.fullname" . }}
  labels:
-    {{- include "devcontainer.labels" . | nindent 4 }}
+    {{- include "antigravity.labels" . | nindent 4 }}
 spec:
  ports:
    {{- if ne (.Values.ide.type | default "vscode") "none" }}
    - port: 5800
      name: vnc-web
      protocol: TCP
      targetPort: vnc-web
    {{- end }}
    {{- if .Values.ssh.enabled }}
    - port: 22
      name: ssh
      protocol: TCP
      targetPort: ssh
    {{- end }}
  selector:
-    {{- include "devcontainer.labels" . | nindent 4 }}
+    {{- include "antigravity.labels" . | nindent 4 }}
@@ -1,58 +0,0 @@
 # =============================================================================
 # QUICKSTART VALUES - Just set these 3 essentials!
 # =============================================================================
 # Instance name (required)
 name: mydev
 # GitHub repository to clone (required)
 githubRepo: https://github.com/youruser/yourrepo
 # IDE choice (optional - defaults to vscode)
 # Options: vscode | antigravity | none
 ide:
  type: vscode
 # =============================================================================
 # COMMON CUSTOMIZATIONS (optional)
 # =============================================================================
 # Enable SSH access
 # ssh:
 #   enabled: true
 # Adjust resources for smaller/larger workloads
 # resources:
 #   requests:
 #     memory: "1Gi"    # Smaller
 #     cpu: "500m"
 #   limits:
 #     memory: "4Gi"    # Smaller
 #     cpu: "2000m"
 # Different storage size
 # storage:
 #   size: 16Gi         # Smaller
 # Disable some MCP sidecars to save resources
 # mcp:
 #   sidecars:
 #     kubernetes:
 #       enabled: false
 #     flux:
 #       enabled: false
 # =============================================================================
 # USAGE INSTRUCTIONS
 # =============================================================================
 # 1. Copy this file: cp values-quickstart.yaml my-values.yaml
 # 2. Edit the 'name' and 'githubRepo' fields above
 # 3. Deploy: helm install mydev ./chart -f my-values.yaml
 # 4. Access: kubectl port-forward deployment/devcontainer-mydev 5800:5800
 # 5. Open: http://localhost:5800
 # For secrets (GitHub token, passwords):
 # kubectl create secret generic devcontainer-mydev-secrets-env \
 #   --from-literal=GITHUB_TOKEN='ghp_...' \
 #   --from-literal=VNC_PASSWORD='changeme'
@@ -1,267 +0,0 @@
 {
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://github.com/cpfarhood/devcontainer/chart/values.schema.json",
  "title": "Dev Container Helm Chart Values Schema",
  "description": "Schema for validating values.yaml in the Dev Container Helm chart",
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Instance name used to generate resource names",
      "pattern": "^[a-z0-9][a-z0-9-]*[a-z0-9]$",
      "minLength": 1,
      "maxLength": 63
    },
    "image": {
      "type": "object",
      "properties": {
        "repository": {
          "type": "string",
          "description": "Container image repository"
        },
        "tag": {
          "type": "string",
          "description": "Container image tag"
        },
        "pullPolicy": {
          "type": "string",
          "enum": ["Always", "IfNotPresent", "Never"],
          "description": "Image pull policy"
        }
      },
      "required": ["repository", "tag"]
    },
    "githubRepo": {
      "type": "string",
      "description": "GitHub repository URL to clone",
      "pattern": "^https://github\\.com/.+/.+$"
    },
    "ide": {
      "type": "object",
      "properties": {
        "type": {
          "type": "string",
          "enum": ["vscode", "antigravity", "none"],
          "description": "IDE to launch in the container"
        }
      },
      "required": ["type"]
    },
    "ssh": {
      "type": "object",
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Enable SSH server on port 22"
        }
      },
      "required": ["enabled"]
    },
    "display": {
      "type": "object",
      "properties": {
        "width": {
          "type": "string",
          "pattern": "^[0-9]+$",
          "description": "VNC display width in pixels"
        },
        "height": {
          "type": "string",
          "pattern": "^[0-9]+$",
          "description": "VNC display height in pixels"
        },
        "secureConnection": {
          "type": "string",
          "enum": ["0", "1"],
          "description": "Enable secure VNC connection"
        }
      },
      "required": ["width", "height", "secureConnection"]
    },
    "user": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "pattern": "^[0-9]+$",
          "description": "User ID (UID)"
        },
        "groupId": {
          "type": "string",
          "pattern": "^[0-9]+$",
          "description": "Group ID (GID)"
        }
      },
      "required": ["id", "groupId"]
    },
    "storage": {
      "type": "object",
      "properties": {
        "size": {
          "type": "string",
          "pattern": "^[0-9]+[KMGT]i$",
          "description": "Storage size (e.g., 32Gi)"
        },
        "className": {
          "type": "string",
          "description": "Storage class name (must support ReadWriteMany)"
        }
      },
      "required": ["size", "className"]
    },
    "resources": {
      "type": "object",
      "properties": {
        "requests": {
          "$ref": "#/$defs/resourceSpec"
        },
        "limits": {
          "$ref": "#/$defs/resourceSpec"
        }
      },
      "required": ["requests", "limits"]
    },
    "shm": {
      "type": "object",
      "properties": {
        "sizeLimit": {
          "type": "string",
          "pattern": "^[0-9]+[KMGT]i$",
          "description": "Shared memory size limit"
        }
      },
      "required": ["sizeLimit"]
    },
    "clusterAccess": {
      "type": "string",
      "enum": ["none", "readonlyns", "readwritens", "readonly", "readwrite"],
      "description": "Kubernetes cluster access level"
    },
    "happy": {
      "type": "object",
      "properties": {
        "serverUrl": {
          "type": "string",
          "format": "uri",
          "description": "Happy Coder server URL"
        },
        "webappUrl": {
          "type": "string",
          "format": "uri",
          "description": "Happy Coder webapp URL"
        },
        "homeDir": {
          "type": "string",
          "description": "Happy Coder home directory"
        },
        "experimental": {
          "type": "string",
          "enum": ["true", "false"],
          "description": "Enable experimental Happy features"
        }
      },
      "required": ["serverUrl", "webappUrl", "homeDir", "experimental"]
    },
    "mcp": {
      "type": "object",
      "properties": {
        "sidecars": {
          "type": "object",
          "properties": {
            "kubernetes": {
              "$ref": "#/$defs/mcpSidecar"
            },
            "flux": {
              "$ref": "#/$defs/mcpSidecar"
            },
            "homeassistant": {
              "$ref": "#/$defs/mcpSidecar"
            },
            "pgtuner": {
              "$ref": "#/$defs/mcpSidecar"
            },
            "playwright": {
              "$ref": "#/$defs/mcpSidecar"
            },
            "fetch": {
              "$ref": "#/$defs/mcpSidecar"
            },
            "sequentialthinking": {
              "$ref": "#/$defs/mcpSidecar"
            }
          },
          "additionalProperties": false
        }
      },
      "required": ["sidecars"]
    },
    "envSecretName": {
      "type": "string",
      "description": "Custom environment secret name"
    },
    "resourceProfile": {
      "type": "string",
      "enum": ["auto", "small", "medium", "large", "xlarge"],
      "description": "Resource profile preset"
    }
  },
  "required": ["name"],
  "$defs": {
    "resourceSpec": {
      "type": "object",
      "properties": {
        "memory": {
          "type": "string",
          "pattern": "^[0-9]+[KMGT]i$",
          "description": "Memory resource specification"
        },
        "cpu": {
          "type": "string",
          "pattern": "^[0-9]+m?$",
          "description": "CPU resource specification"
        }
      },
      "required": ["memory", "cpu"]
    },
    "mcpSidecar": {
      "type": "object",
      "properties": {
        "enabled": {
          "type": "boolean",
          "description": "Enable this MCP sidecar"
        },
        "image": {
          "type": "object",
          "properties": {
            "repository": {
              "type": "string"
            },
            "tag": {
              "type": "string"
            }
          },
          "required": ["repository", "tag"]
        },
        "port": {
          "type": "integer",
          "minimum": 1,
          "maximum": 65535,
          "description": "Port for the MCP sidecar"
        },
        "resources": {
          "type": "object",
          "properties": {
            "requests": {
              "$ref": "#/$defs/resourceSpec"
            },
            "limits": {
              "$ref": "#/$defs/resourceSpec"
            }
          },
          "required": ["requests", "limits"]
        }
      },
      "required": ["enabled", "image", "port", "resources"]
    }
  }
 }
@@ -1,11 +1,6 @@
 # =============================================================================
 # BASIC CONFIGURATION
 # =============================================================================
 # Instance name — used to generate resource names (devcontainer-{name}, userhome-{name})
 name: ""
 # Container image configuration
 image:
  repository: ghcr.io/cpfarhood/devcontainer
  tag: latest
@@ -14,40 +9,27 @@ image:
 # GitHub repository to clone into /workspace
 githubRepo: ""
-# =============================================================================
+# Happy Coder endpoints
-# ACCESS & INTERFACE
+happyServerUrl: "https://happy.farh.net"
-# =============================================================================
+happyWebappUrl: "https://happy-coder.farh.net"
 happyHomeDir: "/home/user/.happy"
 happyExperimental: "true"
-# IDE configuration
+# VNC display
 ide:
  # Options: vscode | antigravity | none
  type: vscode
 # SSH access configuration
 ssh:
  enabled: false
 # VNC display settings
 display:
  width: "1920"
  height: "1080"
  secureConnection: "0"  # Set to "1" when TLS is not terminated upstream
-# User configuration
+# Set to "0" when TLS is terminated at the gateway layer
-user:
+secureConnection: "0"
  id: "1000"
  groupId: "1000"
-# =============================================================================
+userId: "1000"
-# INFRASTRUCTURE & RESOURCES
+groupId: "1000"
 # =============================================================================
 # Storage configuration
 storage:
  size: 32Gi
  className: ceph-filesystem
 # Resource allocation
 resources:
  requests:
    memory: "2Gi"
@@ -56,151 +38,9 @@ resources:
    memory: "8Gi"
    cpu: "4000m"
-# Shared memory for Electron apps (Chrome, Antigravity)
+# Name of existing Secret containing env vars. Defaults to: devcontainer-{name}-secrets-env
-shm:
+# Recognized keys:
-  sizeLimit: 2Gi
+#   GITHUB_TOKEN      — PAT for private repo access
-
+#   VNC_PASSWORD      — password for the VNC web UI
-# Kubernetes cluster access via RBAC
+#   ANTHROPIC_API_KEY — required for Claude Code / Happy Coder auth (browser login won't work in VNC)
-# Options: none | readonlyns | readwritens | readonly | readwrite
+envSecretName: ""
 clusterAccess: none
 # =============================================================================
 # INTEGRATIONS
 # =============================================================================
 # Happy Coder AI assistant configuration
 happy:
  serverUrl: "https://happy.farh.net"
  webappUrl: "https://happy-coder.farh.net"
  homeDir: "/config/userdata/.happy"
  experimental: "true"
 # MCP (Model Context Protocol) server sidecars
 mcp:
  sidecars:
    # Kubernetes API access
    kubernetes:
      enabled: true
      image:
        repository: quay.io/containers/kubernetes_mcp_server
        tag: v0.0.57
      port: 8080
      resources:
        requests:
          memory: "64Mi"
          cpu: "50m"
        limits:
          memory: "256Mi"
          cpu: "500m"
    # Flux GitOps operations
    flux:
      enabled: true
      image:
        repository: ghcr.io/controlplaneio-fluxcd/flux-operator-mcp
        tag: v0.41.1
      port: 8081
      resources:
        requests:
          memory: "64Mi"
          cpu: "50m"
        limits:
          memory: "256Mi"
          cpu: "500m"
    # Web content fetching capabilities
    fetch:
      enabled: true
      image:
        repository: mcp/fetch
        tag: latest
      port: 8082
      resources:
        requests:
          memory: "64Mi"
          cpu: "50m"
        limits:
          memory: "256Mi"
          cpu: "500m"
    # Sequential thinking and problem-solving
    sequentialthinking:
      enabled: true
      image:
        repository: mcp/sequentialthinking
        tag: latest
      port: 8083
      resources:
        requests:
          memory: "64Mi"
          cpu: "50m"
        limits:
          memory: "256Mi"
          cpu: "500m"
    # Home Assistant smart home control
    homeassistant:
      enabled: false  # Requires HOMEASSISTANT_URL and HOMEASSISTANT_TOKEN
      image:
        repository: ghcr.io/homeassistant-ai/ha-mcp
        tag: stable
      port: 8087
      resources:
        requests:
          memory: "64Mi"
          cpu: "50m"
        limits:
          memory: "256Mi"
          cpu: "500m"
    # PostgreSQL performance tuning
    pgtuner:
      enabled: false  # Requires DATABASE_URI in secrets
      image:
        repository: dog830228/pgtuner_mcp
        tag: latest
      port: 8085
      resources:
        requests:
          memory: "64Mi"
          cpu: "50m"
        limits:
          memory: "256Mi"
          cpu: "500m"
    # Browser automation and web testing
    playwright:
      enabled: true
      image:
        repository: mcr.microsoft.com/playwright/mcp
        tag: latest
      port: 8086
      resources:
        requests:
          memory: "128Mi"
          cpu: "100m"
        limits:
          memory: "512Mi"
          cpu: "1000m"
 # =============================================================================
 # SMART DEFAULTS & AUTO-DETECTION
 # =============================================================================
 # Environment auto-detection based on name patterns
 # Automatically adjusts defaults for dev/test/prod/team environments
 autoDetect:
  environment: true       # Auto-detect dev/prod/team from name
  storageClass: true      # Auto-detect ReadWriteMany storage class
  resources: true         # Auto-size resources based on enabled features
 # Resource profiles (auto-selected based on environment and features)
 # Override specific values above to customize
 resourceProfile: auto    # auto | small | medium | large | xlarge
 # =============================================================================
 # ADVANCED CONFIGURATION
 # =============================================================================
 # Custom env secret name (defaults to: devcontainer-{name}-secrets-env)
 envSecretName: ""
@@ -2,29 +2,19 @@
 ## Key Architecture Facts
 - Image: `ghcr.io/cpfarhood/devcontainer:latest` (repo name is `devcontainer`, not `antigravity`)
- Deployed via Helm chart (`chart/`), not kustomize anymore
+- `imagePullPolicy: Always` in statefulset (set during initial deployment debugging)
 - Service must NOT be headless (`clusterIP: None`) — Cilium gateway can't route to headless services
 - `SECURE_CONNECTION=0` — TLS is terminated at the gateway, not the app
 - Container user is `user` (UID 1000) — baseimage-gui runs startapp.sh as `app` user, sudo is not available
 - HTTPRoute is managed by Authentik outpost, not in kustomization
-## Deployment Method
+## Cluster Patterns
- **Primary**: Helm chart in `chart/` directory
+- External gateway: `external` in `gateway-system`, handles `*.farh.net` on port 443 HTTPS only
- **Makefile targets**: `helm-deploy`, `helm-delete`, `helm-logs`, `helm-shell`, `helm-port-forward`
+- Hostnames must be exactly `*.farh.net` (not `*.subdomain.farh.net`) to match gateway listener
- **Old kustomize** (`k8s/` directory) has been removed — all deployments use Helm now
+- Authentik outpost Terraform lives in `../kubernetes/terraform/authentik-*-proxy/`
- Chart published as OCI artifact to GHCR, reconciled by Flux
+- Outpost config uses `external` gateway for public apps, `internal` for internal apps
 ## MCP Sidecars
 - **Kubernetes MCP** (v0.0.57, port 8080): Only deployed when enabled AND `clusterAccess` != `none`
 - **Flux MCP** (v0.41.1, port 8081): Only deployed when enabled AND `clusterAccess` != `none`
 - **Home Assistant MCP** (6.7.1, port 8087): Disabled by default, requires secrets:
  - `homeassistant-url`: Base URL like `http://homeassistant.local:8123`
  - `homeassistant-token`: Long-lived access token
 - **Playwright MCP**: External service, not a sidecar
 - Configure via `mcpSidecars.<name>.enabled` in values
 - **Version Strategy**: All MCP images use pinned versions for stability (no `latest` tags)
 ## Common Gotchas
 - `baseimage-gui` creates user dynamically — don't hardcode usernames in scripts, use numeric UID/GID
 - `chown /home` fails (PVC root not owned by container) — only chown subdirectories
 - `sudo` not available in startapp.sh — script already runs as correct user
 - MCP sidecars need appropriate secrets and RBAC permissions to function
@@ -1,45 +0,0 @@
 #!/bin/sh
 # Start OpenSSH server when SSH=true.
 # Runs as root during container initialisation (cont-init.d).
 [ "${SSH:-false}" = "true" ] || exit 0
 echo "=== SSH enabled: starting sshd ==="
 HOME_DIR="/config/userdata"
 HOST_KEY_STORE="$HOME_DIR/.ssh/host_keys"
 # Persist host keys on the home PVC so clients don't see a "host key
 # changed" warning after pod restarts.
 if [ -d "$HOST_KEY_STORE" ] && [ -n "$(ls "$HOST_KEY_STORE"/ssh_host_* 2>/dev/null)" ]; then
    # Restore previously generated host keys
    echo "Restoring SSH host keys from PVC..."
    cp "$HOST_KEY_STORE"/ssh_host_* /etc/ssh/
    chmod 600 /etc/ssh/ssh_host_*_key
    chmod 644 /etc/ssh/ssh_host_*_key.pub
 else
    # First boot: generate and save host keys to PVC
    echo "Generating SSH host keys (first boot)..."
    ssh-keygen -A 2>/dev/null || true
    mkdir -p "$HOST_KEY_STORE"
    cp /etc/ssh/ssh_host_* "$HOST_KEY_STORE/"
    chmod 700 "$HOST_KEY_STORE"
    chown -R 1000:1000 "$HOST_KEY_STORE"
    echo "SSH host keys saved to PVC."
 fi
 # Populate authorized_keys from env var (injected via Kubernetes secret)
 if [ -n "$SSH_AUTHORIZED_KEYS" ]; then
    mkdir -p "$HOME_DIR/.ssh"
    chmod 700 "$HOME_DIR/.ssh"
    printf '%s\n' "$SSH_AUTHORIZED_KEYS" > "$HOME_DIR/.ssh/authorized_keys"
    chmod 600 "$HOME_DIR/.ssh/authorized_keys"
    chown -R 1000:1000 "$HOME_DIR/.ssh"
    echo "SSH authorized keys configured."
 else
    echo "WARNING: SSH_AUTHORIZED_KEYS not set — you will not be able to log in."
 fi
 # Start sshd in background (root required to bind :22 and fork sessions)
 /usr/sbin/sshd -D &
 echo "sshd started (PID $!)"
@@ -3,4 +3,4 @@
 # baseimage-gui sets shell=/sbin/nologin and home=/dev/null, which
 # prevents VSCode from opening terminals.
 usermod -s /bin/bash app
-usermod -d /config/userdata app
+usermod -d /home/user app
@@ -1,65 +1,9 @@
 #!/bin/bash
-# Initialize repository
+# Initialize repository and start Happy Coder
 set -e
 echo "=== Repository Initialization ==="
 # Set up basic git configuration
 echo "Configuring git user settings..."
 # Use environment variables if provided, otherwise use defaults
 GIT_USER_NAME="${GIT_USER_NAME:-DevContainer User}"
 GIT_USER_EMAIL="${GIT_USER_EMAIL:-devcontainer@example.com}"
 git config --global user.name "$GIT_USER_NAME"
 git config --global user.email "$GIT_USER_EMAIL"
 # Set up git credentials early if GITHUB_TOKEN is provided
 # This ensures all git operations have proper authentication
 if [ -n "$GITHUB_TOKEN" ]; then
    echo "Setting up git credentials..."
    # Configure git to use credential store globally
    git config --global credential.helper store
    # Create or update the credentials file
    CREDENTIALS_FILE="/config/userdata/.git-credentials"
    # Support multiple git hosting providers
    # GitHub supports both oauth2 and token as username
    echo "https://oauth2:${GITHUB_TOKEN}@github.com" > "$CREDENTIALS_FILE"
    echo "https://${GITHUB_TOKEN}:x-oauth-basic@github.com" >> "$CREDENTIALS_FILE"
    echo "https://token:${GITHUB_TOKEN}@github.com" >> "$CREDENTIALS_FILE"
    # GitLab format (if same token works)
    if [ -n "$GITLAB_HOST" ]; then
        echo "https://oauth2:${GITHUB_TOKEN}@${GITLAB_HOST}" >> "$CREDENTIALS_FILE"
    fi
    chmod 600 "$CREDENTIALS_FILE"
    # Also create a symlink in the home directory if it doesn't exist
    # This handles cases where git might look in different locations
    if [ ! -f "$HOME/.git-credentials" ] && [ "$HOME" != "/config/userdata" ]; then
        ln -sf "$CREDENTIALS_FILE" "$HOME/.git-credentials"
    fi
    echo "Git credentials configured"
 else
    # Even without a token, ensure git has a proper credential helper configured
    # This prevents errors when credentials are added later
    echo "No GITHUB_TOKEN provided, configuring basic git settings..."
    git config --global credential.helper store
    # Create an empty credentials file with proper permissions
    CREDENTIALS_FILE="/config/userdata/.git-credentials"
    touch "$CREDENTIALS_FILE"
    chmod 600 "$CREDENTIALS_FILE"
    # Create symlink if needed
    if [ ! -f "$HOME/.git-credentials" ] && [ "$HOME" != "/config/userdata" ]; then
        ln -sf "$CREDENTIALS_FILE" "$HOME/.git-credentials"
    fi
 fi
 # Check if GITHUB_REPO is set
 if [ -z "$GITHUB_REPO" ]; then
    echo "GITHUB_REPO not set, skipping repository clone"
@@ -77,6 +21,14 @@ else
    if [ -d "$WORKSPACE_DIR/.git" ]; then
        echo "Repository already exists, pulling latest changes..."
        cd "$WORKSPACE_DIR"
        # Configure git to use token if provided
        if [ -n "$GITHUB_TOKEN" ]; then
            git config credential.helper store
            echo "https://oauth2:${GITHUB_TOKEN}@github.com" > /home/.git-credentials
            chmod 600 /home/.git-credentials
        fi
        git pull || echo "Pull failed, continuing anyway..."
    else
        echo "Cloning repository..."
@@ -87,6 +39,11 @@ else
            # Replace https://github.com/ with https://oauth2:token@github.com/
            CLONE_URL=$(echo "$GITHUB_REPO" | sed "s|https://github.com/|https://oauth2:${GITHUB_TOKEN}@github.com/|")
            git clone "$CLONE_URL" "$WORKSPACE_DIR"
            # Configure credentials for future use
            git config --global credential.helper store
            echo "https://oauth2:${GITHUB_TOKEN}@github.com" > /home/.git-credentials
            chmod 600 /home/.git-credentials
        else
            git clone "$GITHUB_REPO" "$WORKSPACE_DIR"
        fi
@@ -102,6 +59,20 @@ chown -R "$RUN_UID:$RUN_GID" "$WORKSPACE_DIR"
 mkdir -p "$HOME"
 chown "$RUN_UID:$RUN_GID" "$HOME"
 # Warn if ANTHROPIC_API_KEY is not set — browser-based Claude login won't work in VNC
 if [ -z "$ANTHROPIC_API_KEY" ]; then
    echo "WARNING: ANTHROPIC_API_KEY is not set."
    echo "  Claude Code cannot authenticate via browser inside this container."
    echo "  Add ANTHROPIC_API_KEY to your Kubernetes secret to enable Happy Coder."
 fi
 # Start Happy Coder daemon
 echo "Starting Happy Coder..."
 cd "$WORKSPACE_DIR"
 happy daemon start || echo "Happy Coder daemon failed to start, continuing anyway..."
 echo "Happy Coder daemon started"
 # Export workspace directory for startapp.sh
 echo "$WORKSPACE_DIR" > /tmp/workspace-dir
@@ -2,9 +2,9 @@
 # Start application script for baseimage-gui
 set -e
-echo "=== Starting Dev Container ==="
+echo "=== Starting Antigravity Dev Container ==="
-# Initialize repository
+# Initialize repository and Happy Coder
 /usr/local/bin/init-repo
 # Get workspace directory
@@ -14,27 +14,8 @@ else
    WORKSPACE_DIR="/workspace/default"
 fi
-IDE="${IDE:-vscode}"
+echo "Opening Antigravity in: $WORKSPACE_DIR"
 echo "IDE mode: $IDE"
 echo "Workspace: $WORKSPACE_DIR"
-case "$IDE" in
+# Start Antigravity (VSCode) in the workspace directory as claude user
-    antigravity)
+# The baseimage-gui will handle the GUI display
-        echo "Opening Google Antigravity in: $WORKSPACE_DIR"
+exec code --new-window --wait "$WORKSPACE_DIR"
        # --no-sandbox is required for Electron apps in Docker (no kernel sandbox available).
        # Explicit --user-data-dir and --extensions-dir pin config to the home PVC so
        # settings and the setup wizard state survive pod restarts.
        exec antigravity --no-sandbox \
            --user-data-dir "$HOME/.config/antigravity" \
            --extensions-dir "$HOME/.antigravity/extensions" \
            --new-window --wait "$WORKSPACE_DIR"
        ;;
    none)
        echo "IDE=none: no IDE launched, keeping container alive."
        exec sleep infinity
        ;;
    *)
        echo "Opening VSCode in: $WORKSPACE_DIR"
        exec code --new-window --wait "$WORKSPACE_DIR"
        ;;
 esac
@@ -1,46 +0,0 @@
 #!/bin/bash
 # Test script to verify git credentials configuration
 set -e
 echo "=== Git Credentials Test ==="
 # Check git configuration
 echo "1. Git user configuration:"
 git config --global user.name || echo "  ❌ user.name not set"
 git config --global user.email || echo "  ❌ user.email not set"
 echo ""
 echo "2. Git credential helper:"
 git config --global credential.helper || echo "  ❌ credential.helper not set"
 echo ""
 echo "3. Credentials file locations:"
 CREDENTIALS_FILE="/config/userdata/.git-credentials"
 if [ -f "$CREDENTIALS_FILE" ]; then
    echo "  ✓ $CREDENTIALS_FILE exists"
    echo "  Permissions: $(stat -c %a $CREDENTIALS_FILE)"
    echo "  Lines in file: $(wc -l < $CREDENTIALS_FILE)"
 else
    echo "  ❌ $CREDENTIALS_FILE does not exist"
 fi
 if [ -f "$HOME/.git-credentials" ]; then
    if [ -L "$HOME/.git-credentials" ]; then
        echo "  ✓ $HOME/.git-credentials is a symlink to $(readlink -f $HOME/.git-credentials)"
    else
        echo "  ✓ $HOME/.git-credentials exists (not a symlink)"
    fi
 else
    echo "  ❌ $HOME/.git-credentials does not exist"
 fi
 echo ""
 echo "4. Environment check:"
 echo "  HOME=$HOME"
 echo "  GITHUB_TOKEN=${GITHUB_TOKEN:+[SET]}"
 echo "  GIT_USER_NAME=${GIT_USER_NAME:-[NOT SET]}"
 echo "  GIT_USER_EMAIL=${GIT_USER_EMAIL:-[NOT SET]}"
 echo ""
 echo "=== Test Complete ==="