HolyClaude AI Workstation Skill by ara.so — Daily 2026 Skills collection. HolyClaude is a containerized AI development workstation that bundles Claude Code CLI, a CloudCLI web UI, Chromium headless browser with Playwright, 5 AI CLIs (Claude, Gemini, OpenAI Codex, Cursor, TaskMaster AI), and 50+ dev tools into a single Docker image. One docker compose up replaces hours of manual setup. Installation Prerequisites Docker + Docker Compose installed Existing Anthropic account (Max/Pro subscription or API key) Quick Start mkdir holyclaude && cd holyclaude Create docker-compose.yaml : services : holyclaude : image : CoderLuii/HolyClaude : latest container_name : holyclaude hostname : holyclaude restart : unless - stopped shm_size : 2g ports : - "3001:3001" volumes : - ./data/claude : /root/.claude - ./data/config : /root/.config - ./projects : /workspace environment : - PUID=1000 - PGID=1000 docker compose up -d

Open http://localhost:3001

Image Variants

Full image — all tools pre-installed (recommended)

docker pull CoderLuii/HolyClaude:latest

Slim image — smaller download, tools installed on demand

docker pull CoderLuii/HolyClaude:slim

Pinned version for production stability

docker pull CoderLuii/HolyClaude:1.2.3 docker pull CoderLuii/HolyClaude:1.2.3-slim Full Docker Compose Configuration services : holyclaude : image : CoderLuii/HolyClaude : latest container_name : holyclaude hostname : holyclaude restart : unless - stopped shm_size : 2g

Required for Chromium

ports : - "3001:3001"

CloudCLI web UI

volumes : - ./data/claude : /root/.claude

Claude credentials & config (persisted)

- ./data/config : /root/.config

App config (persisted)

- ./projects : /workspace

Your project files

environment :

User/group IDs (match host user to avoid permission issues)

- PUID=1000 - PGID=1000

AI provider API keys (optional — can also set via web UI)

- ANTHROPIC_API_KEY=$ { ANTHROPIC_API_KEY } - GEMINI_API_KEY=$ { GEMINI_API_KEY } - OPENAI_API_KEY=$ { OPENAI_API_KEY } - CURSOR_API_KEY=$ { CURSOR_API_KEY }

NAS/SMB mount polling (enable if using Synology/QNAP)

- CHOKIDAR_USEPOLLING=true

Notification webhooks (optional)

- DISCORD_WEBHOOK_URL=$ { DISCORD_WEBHOOK_URL } - SLACK_WEBHOOK_URL=$ { SLACK_WEBHOOK_URL } security_opt : - seccomp : unconfined

Required for Chromium sandbox

Environment Variable Reference Variable Required Description PUID Recommended Host user ID (run id -u to find yours) PGID Recommended Host group ID (run id -g to find yours) ANTHROPIC_API_KEY Optional Anthropic API key (alternative to OAuth login) GEMINI_API_KEY Optional Google AI API key for Gemini CLI OPENAI_API_KEY Optional OpenAI API key for Codex CLI CURSOR_API_KEY Optional Cursor API key CHOKIDAR_USEPOLLING NAS only Set true for SMB/NFS mounts DISCORD_WEBHOOK_URL Optional Discord notifications SLACK_WEBHOOK_URL Optional Slack notifications Authentication Method 1: OAuth (Claude Max/Pro Subscription) Open http://localhost:3001 Create a CloudCLI account (10 seconds) Sign in with your Anthropic account via OAuth No API key needed — uses your existing subscription Method 2: API Key environment : - ANTHROPIC_API_KEY=$ { ANTHROPIC_API_KEY } Or paste the key directly in the CloudCLI web UI settings. Credential Persistence Credentials are stored in the bind-mounted volume: ./data/claude/ → /root/.claude/ ./data/config/ → /root/.config/ Credentials survive container restarts, updates, and recreation. Platform-Specific Configuration Linux (amd64/arm64) — Default

No extra config needed

shm_size : 2g macOS (Docker Desktop)

Works out of the box with Docker Desktop

shm_size : 2g Windows (WSL2 + Docker Desktop)

Requires WSL2 backend enabled in Docker Desktop

shm_size : 2g Synology / QNAP NAS environment : - CHOKIDAR_USEPOLLING=true

Fixes file watching on SMB mounts

volumes : - /volume1/docker/holyclaude/data/claude : /root/.claude - /volume1/docker/holyclaude/projects : /workspace Kubernetes (ARM64 / Oracle Cloud Graviton)

arm64 image is published alongside amd64

image : CoderLuii/HolyClaude : latest

multi-arch manifest auto-selects correct arch

What's Inside the Container

AI CLIs

CLI

Invocation

Key Provider

Claude Code

claude

Anthropic (

ANTHROPIC_API_KEY

or OAuth)

Gemini CLI

gemini

Google (

GEMINI_API_KEY

)

OpenAI Codex

codex

OpenAI (

OPENAI_API_KEY

)

Cursor

cursor

Cursor (

CURSOR_API_KEY

)

TaskMaster AI

task-master

Uses configured AI provider keys

Headless Browser Stack

Chromium

— pre-installed and configured

Xvfb

— virtual display on

:99

Playwright

— configured and ready

Shared memory

—

shm_size: 2g

pre-configured (fixes the 64MB Docker default)

Dev Tools (50+)

Languages

Node.js, Python 3, TypeScript, Bun, Deno

Package managers

npm, yarn, pnpm, pip, cargo

Database clients

PostgreSQL, MySQL, SQLite, Redis CLI

Cloud CLIs

AWS CLI, Google Cloud SDK, Azure CLI

Dev tools

GitHub CLI (
gh
), Git, curl, jq, ripgrep, fd
Process manager: s6-overlay (auto-restart, graceful shutdown) Working with Projects Mount your project directory volumes : - ./projects : /workspace

Or mount a specific project:

- /path/to/my - app : /workspace/my - app Inside the container

Access the container shell

docker exec -it holyclaude bash

Navigate to workspace

cd /workspace

Run Claude Code directly

claude

Run other AI CLIs

gemini codex Playwright / Headless Browser Usage Playwright is pre-configured. Use it from Claude Code tasks or directly: // playwright.config.ts — already works inside the container import { defineConfig } from '@playwright/test' ; export default defineConfig ( { use : { // Chromium is pre-installed, no download needed browserName : 'chromium' , launchOptions : { args : [ '--no-sandbox' , '--disable-setuid-sandbox' , '--disable-dev-shm-usage' , // Use /tmp instead of /dev/shm ] , } , } , } ) ; // Direct Playwright usage inside container import { chromium } from 'playwright' ; const browser = await chromium . launch ( { args : [ '--no-sandbox' , '--disable-setuid-sandbox' , '--disable-dev-shm-usage' , ] , } ) ; const page = await browser . newPage ( ) ; await page . goto ( 'https://example.com' ) ; const screenshot = await page . screenshot ( { path : '/workspace/screenshot.png' } ) ; await browser . close ( ) ;

Run Playwright tests inside container

docker exec -it holyclaude bash -c "cd /workspace && npx playwright test"

Run with headed mode via Xvfb

docker exec -it holyclaude bash -c "DISPLAY=:99 npx playwright test --headed" Updating HolyClaude

Pull latest image

docker compose pull

Recreate container with new image (zero data loss — data is in bind mounts)

docker compose up -d

Or explicit recreation

docker compose down && docker compose up -d Pinned Version Strategy

For production: pin to a specific version

image : CoderLuii/HolyClaude : 1.2.3

Update by changing the tag and running:

docker compose up

d Data & Persistence holyclaude/ ├── docker-compose.yaml ├── data/ │ ├── claude/ # Claude credentials, .claude.json, history │ └── config/ # CloudCLI and app configuration └── projects/ # Your workspace (mount your code here) All credentials and config survive: Container restarts docker compose down && up Image updates via docker compose pull Container recreation Common Patterns Pattern: Multiple Projects volumes : - ./data/claude : /root/.claude - ./data/config : /root/.config - ~/code/project - a : /workspace/project - a - ~/code/project - b : /workspace/project - b - ~/code/project - c : /workspace/project - c Pattern: Read-only API Keys via .env file

.env (never commit this)

ANTHROPIC_API_KEY

sk-ant- .. . GEMINI_API_KEY = AIza .. . OPENAI_API_KEY = sk- .. .

docker-compose.yaml

services : holyclaude : env_file : .env Pattern: Custom Port ports : - "8080:3001"

Access via http://localhost:8080

Pattern: Remote Server Access ports : - "0.0.0.0:3001:3001"

Accessible from network

Then access via http://your-server-ip:3001

Pattern: Nginx Reverse Proxy services : holyclaude : image : CoderLuii/HolyClaude : latest

Don't expose ports directly — nginx handles it

expose : - "3001" networks : - web nginx : image : nginx : alpine ports : - "443:443" volumes : - ./nginx.conf : /etc/nginx/conf.d/default.conf - ./certs : /etc/nginx/certs networks : - web networks : web : Troubleshooting Container won't start

Check logs

docker compose logs holyclaude

Check if port 3001 is already in use

lsof -i :3001 Chromium crashes / headless browser fails

Ensure shm_size is set (CRITICAL)

shm_size : 2g

Ensure seccomp is unconfined

security_opt : - seccomp : unconfined

Verify display is available inside container

docker exec holyclaude bash -c "echo $DISPLAY "

Should output: :99

Permission denied errors on bind mounts environment : - PUID=1000

Must match your host user: `id -u`

- PGID=1000

Must match your host group: `id -g`

Fix existing permissions on host

sudo chown -R 1000 :1000 ./data ./projects File watching broken on NAS / SMB mounts environment : - CHOKIDAR_USEPOLLING=true Claude Code installer hangs This is pre-solved in HolyClaude — the container sets the correct WORKDIR ownership. If you're building a custom image on top:

Ensure WORKDIR is not root-owned before running Claude Code installer

RUN chown -R node:node /app WORKDIR /app SQLite locks on NAS mount volumes :

Move SQLite databases to a local volume, not NAS mount

- holyclaude - db : /root/.local/share/holyclaude - /nas/mount : /workspace

NAS mount only for project files

volumes : holyclaude-db : Claude Code authentication lost after restart

Ensure this volume is mounted (credentials live here)

volumes : - ./data/claude : /root/.claude Process keeps dying / not restarting HolyClaude uses s6-overlay for process supervision. Check service status: docker exec holyclaude s6-svstat /run/service/cloudcli docker exec holyclaude s6-svstat /run/service/xvfb Building Locally git clone https://github.com/CoderLuii/HolyClaude.git cd HolyClaude

Build full image

docker build -t holyclaude:local .

Build slim image

docker build -t holyclaude:local-slim --target slim .

Build for specific platform

docker buildx build --platform linux/arm64 -t holyclaude:arm64 .

Run your local build

docker run -d \ --name holyclaude \ --shm-size = 2g \ -p 3001 :3001 \ -v $( pwd ) /data/claude:/root/.claude \ holyclaude:local Quick Reference

Start

docker compose up -d

Stop

docker compose down

View logs (live)

docker compose logs -f holyclaude

Shell access

docker exec -it holyclaude bash

Update to latest

docker compose pull && docker compose up -d

Restart only the container

docker compose restart holyclaude

Check resource usage

docker stats holyclaude

安装

Open http://localhost:3001

Full image — all tools pre-installed (recommended)

Slim image — smaller download, tools installed on demand

Pinned version for production stability

Required for Chromium

CloudCLI web UI

Claude credentials & config (persisted)

App config (persisted)

Your project files

User/group IDs (match host user to avoid permission issues)

AI provider API keys (optional — can also set via web UI)

NAS/SMB mount polling (enable if using Synology/QNAP)

Notification webhooks (optional)

Required for Chromium sandbox

No extra config needed

Works out of the box with Docker Desktop

Requires WSL2 backend enabled in Docker Desktop

Fixes file watching on SMB mounts

arm64 image is published alongside amd64

multi-arch manifest auto-selects correct arch

Or mount a specific project:

Access the container shell

Navigate to workspace

Run Claude Code directly

Run other AI CLIs

Run Playwright tests inside container

Run with headed mode via Xvfb

Pull latest image

Recreate container with new image (zero data loss — data is in bind mounts)

Or explicit recreation

For production: pin to a specific version

Update by changing the tag and running:

docker compose up

.env (never commit this)

ANTHROPIC_API_KEY

docker-compose.yaml

Access via http://localhost:8080

Accessible from network

Then access via http://your-server-ip:3001

Recommend putting behind nginx/Caddy with HTTPS for production

Don't expose ports directly — nginx handles it

Check logs

Check if port 3001 is already in use

Ensure shm_size is set (CRITICAL)

Ensure seccomp is unconfined

Verify display is available inside container

Should output: :99

Must match your host user: id -u

Must match your host group: id -g

Fix existing permissions on host

Ensure WORKDIR is not root-owned before running Claude Code installer

Move SQLite databases to a local volume, not NAS mount

NAS mount only for project files

Ensure this volume is mounted (credentials live here)

Build full image

Build slim image

Build for specific platform

Run your local build

Start

Stop

View logs (live)

Shell access

Update to latest

Restart only the container

Check resource usage

Must match your host user: `id -u`

Must match your host group: `id -g`