Integration with K8s cluster (or construct)

[cachemoney]

I am trying to do as much research as I can on openRig, But I would like to run the rig in a K8s pod. I see that you have "Pod" abstraction already in place. Is it conceivable, to run an openrig spec as a k8s pod? Or is there a possibility of abstracting openrig into K8s?

[mvschwarz]

Thanks, @cachemoney, for the question. The shared word is a fair thing to wonder about, but the two pods are different things. In OpenRig, a pod is a group of agents inside one rig that share context. It isn't a container or a scheduling unit, so an OpenRig spec doesn't map onto a Kubernetes pod.

What OpenRig runs on today: one daemon plus agents in tmux, on a macOS or Linux machine you control (or WSL2 on Windows), with Node.js 22 or 24. Docker comes in only for a rig's own services: a spec's services block starts Docker Compose services before the agents launch. We haven't tried running a team inside a Kubernetes pod.

What would you want from Kubernetes here: isolation, scheduling, scale, or running the agents next to other services in your cluster? The answer depends a lot on which of those matters, so it would help to hear what you're after.

[cachemoney]

ok, I think I understand. I was mainly interested in running in K8s mainly for isolation. But it seems that Docker is already integrated and used as a way to run agents in a sandbox?

[mvschwarz]

Thanks, @cachemoney, for following up with what you're after. It makes the question easier to answer.

No, Docker isn't used to sandbox the agents. In a rig spec, Docker is only for extra services a rig runs alongside its agents, never for the agents themselves: the optional services block starts Docker Compose services before any agent launches (see "Services Block" in the rig spec reference). The agents run directly on your machine in tmux, as we mentioned earlier.

The isolation available comes from each coding agent's own sandbox and permission settings, which OpenRig applies when it launches the agent. It isn't container isolation. For example, OpenRig starts Codex in Codex's own workspace-write sandbox by default, and you can choose the permission mode for each agent, which the docs call a seat. The getting-started guide covers both, in "Have your agent configure permissions" and "Per-seat permission mode".

We haven't documented or tested running OpenRig itself (the daemon and its agents together) inside a container, so we can't say how well that works.