first commit

.dockerignore

@@ -0,0 +1,2 @@
+.git
+*.md

.gitignore

@@ -0,0 +1,5 @@
+# Per-user container name/settings — run `./claudaris config` to generate.
+/.env
+
+# Claude Code's auto-generated per-user permission cache.
+/.claude/settings.local.json

AGENTS.md

@@ -0,0 +1,101 @@
+# AGENTS.md
+
+## Purpose
+Docker scaffold for running Claude Code in an isolated container (see README.md).
+
+## Structure
+- `.env` — gitignored, per-user, written by `claudaris config`. Holds `NAME`
+  (image/container name — the default `claudaris` is meant to be overridden
+  per person, e.g. `chris-claude`, so multiple users can each run their own
+  container off this same repo), `DATA_DIR`, and `WORKSPACE_DIR`. `claudaris`
+  sources it if present.
+- `Dockerfile` — archlinux base image with bash, git, nodejs/npm, tmux, vim,
+  fastfetch, etc. `files/bash_aliases` is baked in at `/opt/dotfiles/bash_aliases`
+  and `files/bashrc` becomes the image's default `/root/.bashrc` — both are
+  rebuild-time defaults, but the host shadows both with its own single-file
+  bind mounts at runtime (see `claudaris start` below). Claude
+  Code is installed at build time straight into `/root` (`$HOME`), so a
+  rebuild always picks up the latest release. Staying logged in across
+  rebuilds is handled entirely by `claudaris start`, which bind-mounts two
+  individual host files onto `~/.claude/.credentials.json` (the OAuth token)
+  and `~/.claude.json` (account/onboarding state) — see `claudaris start`
+  below for why these are per-file mounts rather than a directory volume.
+  `git config --system --add safe.directory '*'` is set so git works on
+  `/projects` repos bind-mounted from the host (which the container, always
+  running as root, would otherwise treat as untrusted). `files/entrypoint.sh`
+  starts the tmux server and creates a `main` session, then polls and exits
+  once the session ends (tmux's defaults apply: `remain-on-exit` off,
+  `exit-empty` on, so a shell exiting — Ctrl+D, `exit`, crash — tears the
+  session down) rather than running forever; there's no `--restart` policy,
+  so a stopped container needs `claudaris connect` or `claudaris start` to
+  bring it back up (both do this automatically). `/etc/profile.d/nix_path.sh`
+  points `PATH` at `/root/.local/bin`. `files/tmux` is copied in as a
+  `/usr/local/bin/tmux` wrapper that shadows the real `tmux` binary so that
+  plain `docker exec -it "$NAME" tmux` runs `tmux new-session -A -s main`
+  (attaches to `main` if it exists, creates it otherwise) instead of always
+  starting a new session.
+- `claudaris` — single entry point with subcommands:
+  - `config` (alias `configure`) — interactive wizard prompting for `NAME`,
+    `DATA_DIR`, `WORKSPACE_DIR` (showing current/default values, enter to
+    keep) and writing them to `.env`. Re-run any time to update it.
+  - `build` — builds the image, tagged `$NAME` (see `.env` above).
+  - `start` — runs the container as `$NAME` with `--hostname "$NAME"` (so the
+    shell prompt reads `root@$NAME`, e.g. `root@claudaris`, instead of a
+    random container ID). `/root/.bashrc`, `/opt/dotfiles/bash_aliases`, and
+    the two auth files (`~/.claude/.credentials.json`, `~/.claude.json`) are
+    each bind-mounted individually — seeded once (empty, for the auth files;
+    from `files/bashrc`/`files/bash_aliases`, for the dotfiles) into
+    `$DATA_DIR/home/{.bashrc,bash_aliases}` and
+    `$DATA_DIR/claude/{credentials,claude}.json` on the host, so they can be
+    edited/persist without a rebuild — including a coworker dropping in their
+    own aliases. Individual-file mounts matter for the auth files
+    specifically: Claude Code likely saves them atomically (write a temp
+    file, then `rename()` over the target), and `rename()` onto a symlink
+    replaces the symlink instead of writing through it — silently breaking
+    persistence after the first write. A bind mount doesn't have that
+    failure mode, which is why these aren't just symlinked from a directory
+    volume the way an earlier version of this setup did it. `$WORKSPACE_DIR`
+    is mounted at `/projects`. Also offers an opt-in `/root/.ssh` mount
+    (read-only) for reaching other nodes: create `$DATA_DIR/ssh` on the host
+    and populate it before starting the container to enable it. `DATA_DIR`
+    defaults to `/data/$NAME`; `WORKSPACE_DIR` defaults to
+    `/home/$USER/projects` (override via `claudaris config`).
+  - `connect` — `docker start`s `$NAME` (a no-op if it's already running)
+    then attaches to its tmux session, so it also works right after the
+    container has auto-exited (see `Dockerfile`/entrypoint above).
+  - `remove` (aliases `stop`, `rm`) — stops and removes the container so
+    a subsequent `start` recreates it fresh.
+  - `help` — usage.
+- `files/` — plain (non-dot) source files `COPY`'d into the image at build
+  time: `bashrc`/`bash_aliases` (dotfiles — see `Dockerfile` above),
+  `entrypoint.sh`, and the `tmux` wrapper. Kept dotless so they're easy to
+  see/edit directly in a normal directory listing; the `Dockerfile` adds the
+  leading dot back on for `bashrc`'s destination. Both `bashrc` and
+  `bash_aliases` are also seeded onto the host by `claudaris start` so their
+  bind-mounted copies can diverge without a rebuild.
+- `README.md` — usage instructions.
+
+## Common commands
+```bash
+# build the image
+docker build -t "$NAME" .
+
+# start the container
+docker run -d \
+  --name "$NAME" \
+  --hostname "$NAME" \
+  -v "$DATA_DIR/home/.bashrc:/root/.bashrc" \
+  -v "$DATA_DIR/home/bash_aliases:/opt/dotfiles/bash_aliases" \
+  -v "$DATA_DIR/claude/credentials.json:/root/.claude/.credentials.json" \
+  -v "$DATA_DIR/claude/claude.json:/root/.claude.json" \
+  -v "$WORKSPACE_DIR:/projects" \
+  "$NAME"
+
+# attach to the running container's tmux session
+docker exec -it "$NAME" tmux
+```
+
+## Notes
+No test suite or CI — this is infra/config, not application code. Verify changes
+by rebuilding the image (`./claudaris build`) and exec'ing in
+(`./claudaris connect`) to confirm the container behaves as expected.

CLAUDE.md

@@ -0,0 +1,3 @@
+# Environment notes
+
+- Docker is not installed on this host and will not be installed. Do not attempt to run `docker` commands (e.g. to test the Dockerfile) — verify Dockerfile changes by inspection instead.

Dockerfile

@@ -0,0 +1,68 @@
+FROM archlinux:latest
+
+RUN pacman -Sy --noconfirm archlinux-keyring && \
+    pacman -Su --noconfirm && \
+    pacman -S --noconfirm --needed \
+        bash \
+        ca-certificates \
+        curl \
+        fastfetch \
+        fzf \
+        git \
+        lazygit \
+        less \
+        mariadb-clients \
+        nodejs \
+        npm \
+        openssh \
+        php \
+        pwgen \
+        python \
+        sqlite \
+        tmux \
+        tree \
+        unzip \
+        uv \
+        vim \
+        zoxide && \
+    pacman -Scc --noconfirm
+
+RUN printf '%s\n' \
+        'export PATH="/root/.local/bin:$PATH"' \
+        'eval "$(zoxide init bash)"' \
+        > /etc/profile.d/nix_path.sh && \
+    chmod 755 /etc/profile.d/nix_path.sh && \
+    echo '[ -f /etc/profile.d/nix_path.sh ] && . /etc/profile.d/nix_path.sh' >> /etc/bash.bashrc
+
+RUN git config --system user.name "code" && \
+    git config --system user.email "code@4lt.ca" && \
+    git config --system --add safe.directory '*'
+
+# Dotfiles
+COPY files/bash_aliases /opt/dotfiles/bash_aliases
+COPY files/bashrc /root/.bashrc
+
+# Install Claude Code straight into /root, so a rebuild always picks up the
+# latest release. Only the two files needed to stay logged in (not the CLI
+# itself) are persisted across rebuilds, via individual bind mounts set up
+# by `claudaris start` — see claudaris and AGENTS.md.
+WORKDIR /tmp
+
+RUN curl -fsSL https://claude.ai/install.sh | bash
+
+# Claude Code usage statusline plugin
+RUN PATH="/root/.local/bin:$PATH" bash -c \
+    'curl -fsSL https://raw.githubusercontent.com/leeguooooo/claude-code-usage-bar/main/web-install.sh | bash'
+
+# tmux wrapper
+COPY files/tmux /usr/local/bin/tmux
+COPY files/tmux.conf /etc/tmux.conf
+RUN chmod 755 /usr/local/bin/tmux
+
+# Container entrypoint
+COPY files/entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod 755 /usr/local/bin/entrypoint.sh
+
+WORKDIR /projects
+
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

README.md

@@ -0,0 +1,79 @@
+# claudaris
+
+Claudaris (klaw-DAR-iss): A moveable docker container for Claude code. using Arch btw.
+
+## Configure
+
+Run the interactive wizard and answer its prompts (press enter to keep a
+default):
+```
+./claudaris config
+```
+It writes `NAME`, `DATA_DIR`, and `WORKSPACE_DIR` to `.env` (gitignored —
+every user keeps their own), which every other command sources. `NAME`
+should be something unique to you (e.g. `chris-claude`) if more than one
+person is running a container from this same repo checkout. `DATA_DIR`
+defaults to `/data/$NAME`; `WORKSPACE_DIR` (the host dir mounted as
+`/projects` in the container) defaults to `/home/$USER/projects`.
+`config`/`configure` can be re-run any time to update `.env`.
+
+## Build container
+
+As root run build (always `--no-cache --pull`, so it picks up the latest Claude Code release):
+```
+sudo ./claudaris build
+```
+## Start the container
+
+Make sure the volumes are as you like and start the container.
+```
+sudo ./claudaris start
+```
+
+## Connect to the container
+
+```
+sudo ./claudaris connect
+```
+
+## Stop and remove the container
+
+```
+sudo ./claudaris remove
+```
+(aliases: `stop`, `rm`)
+
+## Optional: SSH access to other nodes
+
+To let the container SSH out to other machines, create `$DATA_DIR/ssh`
+on the host and populate it with keys/config *before* running `./claudaris start`. If
+present, it's bind-mounted read-only to `/root/.ssh`. It's off by default.
+
+## Notes
+
+Claude Code is installed at build time under `/root`, so a rebuild always
+picks up the latest release. Two files are bind-mounted individually to
+survive that: `~/.claude/.credentials.json` (the OAuth token) and
+`~/.claude.json` (account/onboarding state — Claude Code checks this too,
+so persisting the token alone isn't enough to avoid a re-login prompt after
+a rebuild). `./claudaris start` seeds both from empty on the host the first
+time it runs. Logging in once then survives rebuilds without carrying the
+CLI binary or the rest of `~/.claude` (settings, history, projects, caches)
+along with it.
+
+The container also stops itself once its tmux session ends (any shell
+exit — Ctrl+D, `exit`, crash) instead of running forever, and there's no
+Docker restart policy — `./claudaris connect` and `./claudaris start` both
+bring it back up automatically if you find it stopped.
+
+`.bashrc` and `bash_aliases` are both bind-mounted as single files so they can
+be tweaked per-host (e.g. a coworker importing their own aliases) without a
+rebuild. `./claudaris start` seeds them into `$DATA_DIR/home/.bashrc` and
+`$DATA_DIR/home/bash_aliases` from `files/bashrc` and `files/bash_aliases` the
+first time it runs, without overwriting later edits. Anything that needs to
+survive regardless (PATH, zoxide, git identity) lives in `/etc/...` inside
+the image instead of under `/root`.
+
+The container is started with `--hostname "$NAME"`, so the prompt reads
+`root@claudaris` (or whatever you set `NAME` to via `./claudaris config`)
+instead of a random container ID.

claudaris

@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+REPO_DIR="$(pwd)"
+
+# Run `./claudaris config` to set your own image/container name (so multiple
+# people can each run their own container from this repo) and other options.
+# It writes them to .env, which is gitignored and sourced here if present.
+NAME=claudaris
+[ -f .env ] && set -a && . .env && set +a
+
+usage() {
+  cat <<EOF
+Usage: ./claudaris <command>
+
+Commands:
+  config, configure  Interactive wizard to write .env with your settings
+  build              Build the container image (always --no-cache --pull)
+  start              Start (or create) the container
+  connect            Start the container if needed, then attach a tmux session
+  remove, stop, rm   Stop and remove the container
+  help               Show this message
+EOF
+}
+
+cmd_config() {
+  echo "claudaris config — press enter to keep the current/default value."
+  echo
+
+  read -r -p "NAME [$NAME]: " input
+  NAME="${input:-$NAME}"
+
+  local data_dir_default="${DATA_DIR:-/data/$NAME}"
+  read -r -p "DATA_DIR [$data_dir_default]: " input
+  DATA_DIR="${input:-$data_dir_default}"
+
+  local workspace_dir_default="${WORKSPACE_DIR:-/home/${USER:-$(id -un)}/projects}"
+  read -r -p "WORKSPACE_DIR [$workspace_dir_default]: " input
+  WORKSPACE_DIR="${input:-$workspace_dir_default}"
+
+  cat > .env <<EOF
+# Written by \`./claudaris config\` — gitignored, per-user.
+NAME=$NAME
+DATA_DIR=$DATA_DIR
+WORKSPACE_DIR=$WORKSPACE_DIR
+EOF
+
+  echo
+  echo "Wrote .env:"
+  cat .env
+}
+
+cmd_build() {
+  export BUILDX_NO_DEFAULT_ATTESTATIONS=1
+  docker build --no-cache --pull -t "$NAME" .
+}
+
+cmd_start() {
+  # Host directory for volume mount data, separate from the repo checkout.
+  DATA_DIR="${DATA_DIR:-/data/$NAME}"
+
+  # Host directory mounted as /projects (the project workspace) inside the
+  # container. Override via `./claudaris config` if it's not right for you.
+  WORKSPACE_DIR="${WORKSPACE_DIR:-/home/${USER:-$(id -un)}/projects}"
+
+  # Seed host copies of .bashrc and bash_aliases, without clobbering any
+  # customization already made on this host. Both are bind-mounted as
+  # single files below so they can be tweaked per-host (e.g. a coworker
+  # importing their own aliases) without rebuilding the image.
+  mkdir -p "$DATA_DIR/home"
+  [ -f "$DATA_DIR/home/.bashrc" ] || cp "$REPO_DIR/files/bashrc" "$DATA_DIR/home/.bashrc"
+  [ -f "$DATA_DIR/home/bash_aliases" ] || cp "$REPO_DIR/files/bash_aliases" "$DATA_DIR/home/bash_aliases"
+
+  # Two files carry everything needed to stay logged in: .credentials.json
+  # (the OAuth token) and claude.json (account/onboarding state — Claude Code
+  # checks this too, so persisting the token alone isn't enough to avoid a
+  # re-login prompt after a rebuild). Each is bind-mounted individually,
+  # same as .bashrc above, seeded empty on first run so Docker doesn't create
+  # a directory in its place. Individual file mounts (rather than a directory
+  # volume + in-container symlink) matter here: Claude Code likely saves
+  # these atomically (write a temp file, then rename() over the target), and
+  # rename() onto a symlink replaces the symlink instead of writing through
+  # it — silently breaking persistence after the first write. A bind mount
+  # doesn't have that failure mode.
+  mkdir -p "$DATA_DIR/claude"
+  [ -f "$DATA_DIR/claude/credentials.json" ] || touch "$DATA_DIR/claude/credentials.json"
+  [ -f "$DATA_DIR/claude/claude.json" ] || touch "$DATA_DIR/claude/claude.json"
+
+  # Optional: mount ~/.ssh into the container (read-only) for connecting out to
+  # other nodes. Opt in by creating $DATA_DIR/ssh and populating it with
+  # keys/config before starting the container.
+  ssh_mount=()
+  if [ -d "$DATA_DIR/ssh" ]; then
+    ssh_mount=(-v "$DATA_DIR/ssh:/root/.ssh:ro")
+  fi
+
+  if docker ps -aq -f name="^${NAME}\$" | grep -q .; then
+    docker start "$NAME"
+  else
+    docker run -d \
+      --name "$NAME" \
+      --hostname "$NAME" \
+      -v "$DATA_DIR/home/.bashrc:/root/.bashrc" \
+      -v "$DATA_DIR/home/bash_aliases:/opt/dotfiles/bash_aliases" \
+      -v "$DATA_DIR/claude/credentials.json:/root/.claude/.credentials.json" \
+      -v "$DATA_DIR/claude/claude.json:/root/.claude.json" \
+      -v "$WORKSPACE_DIR:/projects" \
+      "${ssh_mount[@]}" \
+      "$NAME"
+  fi
+}
+
+cmd_connect() {
+  # The container exits on its own once the main tmux session ends (see
+  # entrypoint.sh) and isn't auto-restarted, so make sure it's up before
+  # exec'ing in — a no-op if it's already running.
+  docker start "$NAME" >/dev/null
+  docker exec -it "$NAME" tmux
+}
+
+cmd_remove() {
+  docker stop "$NAME" >/dev/null 2>&1 || true
+  docker rm "$NAME"
+}
+
+case "${1:-help}" in
+  config|configure) cmd_config ;;
+  build) cmd_build ;;
+  start) cmd_start ;;
+  connect) cmd_connect ;;
+  remove|stop|rm) cmd_remove ;;
+  help|-h|--help) usage ;;
+  *)
+    echo "Unknown command: $1" >&2
+    usage >&2
+    exit 1
+    ;;
+esac

files/bash_aliases

@@ -0,0 +1,26 @@
+#!/bin/bash
+# Bash aliases for the claudaris container
+
+# ls long hidden and human readable
+alias ll='ls -lah'
+alias l1='ls -1'
+alias ls='ls --color=auto'
+
+# up levels (up #_of_dir_up)
+function cd_up() {
+  cd $(printf "%0.0s../" $(seq 1 $1));
+}
+alias up='cd_up'
+
+# or just ctrl+d
+alias quit='exit'
+alias e='exit'
+
+# tmux
+alias tl='tmux list-sessions'
+
+# git
+alias gs='git status'
+
+alias btw='fastfetch'
+alias cd='z'

files/bashrc

@@ -0,0 +1,51 @@
+# ~/.bashrc: executed by bash(1) for non-login shells.
+
+# If not running interactively, don't do anything
+case $- in
+    *i*) ;;
+      *) return;;
+esac
+
+# don't put duplicate lines or lines starting with space in the history.
+HISTCONTROL=ignoreboth
+HISTSIZE=10000
+HISTFILESIZE=20000
+HISTTIMEFORMAT="%F %T "
+
+# append to the history file, don't overwrite it
+shopt -s histappend
+
+# check the window size after each command and, if necessary,
+# update the values of LINES and COLUMNS.
+shopt -s checkwinsize
+
+# Prints " (branch)" when inside a git repo, nothing otherwise.
+__git_branch() {
+    local branch
+    branch=$(git symbolic-ref --short HEAD 2>/dev/null) || branch=$(git rev-parse --short HEAD 2>/dev/null) || return
+    printf ' (%s)' "$branch"
+}
+
+# Tokyo Night palette, matching files/tmux.conf: purple user@host, blue cwd,
+# green git branch, gray prompt symbol.
+PS1='\[\033[38;2;187;154;247;1m\]\u@\h\[\033[0m\] \[\033[38;2;122;162;247m\]\w\[\033[0m\]\[\033[38;2;158;206;106m\]$(__git_branch)\[\033[0m\]\n\[\033[38;2;86;95;137m\]\$\[\033[0m\] '
+
+if [ -x /usr/bin/dircolors ]; then
+    eval "$(dircolors -b)"
+    alias ls='ls --color=auto'
+fi
+
+if [ -f /opt/dotfiles/bash_aliases ]; then
+    . /opt/dotfiles/bash_aliases
+fi
+
+if ! shopt -oq posix; then
+  if [ -f /usr/share/bash-completion/bash_completion ]; then
+    . /usr/share/bash-completion/bash_completion
+  elif [ -f /etc/bash_completion ]; then
+    . /etc/bash_completion
+  fi
+fi
+
+# Claude Code CLI installer env
+[ -f /root/.local/bin/env ] && . /root/.local/bin/env

files/entrypoint.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+set -euo pipefail
+
+# Staying logged in across rebuilds is handled entirely by `claudaris start`,
+# which bind-mounts ~/.claude/.credentials.json and ~/.claude.json individually
+# from the host (see claudaris) — nothing to seed or symlink here.
+
+# Create the main tmux session if it does not exist.
+/usr/bin/tmux new-session -d -s main 2>/dev/null || true
+
+# tmux's defaults apply here (remain-on-exit off, exit-empty on): a window
+# closes when its shell exits, the session closes when its last window does,
+# and the server exits when its last session does. Poll for that and exit
+# the container once it happens, instead of running forever.
+while /usr/bin/tmux has-session -t main 2>/dev/null; do
+    sleep 2
+done
+exit 0

files/tmux

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+if [ "$#" -eq 0 ]; then
+    exec /usr/bin/tmux new-session -A -s main
+else
+    exec /usr/bin/tmux "$@"
+fi

files/tmux.conf

@@ -0,0 +1,73 @@
+##### Terminal #####
+
+set -g default-terminal "tmux-256color"
+set -ga terminal-overrides ",*:Tc"
+
+##### General #####
+
+set -g mouse on
+set -g history-limit 100000
+set -g escape-time 0
+set -g focus-events on
+
+# Always use bash interactively
+set-option -g default-shell /bin/bash
+set-option -g default-command "bash -i"
+
+##### Status Bar #####
+
+set -g status-position bottom
+set -g status-interval 5
+set -g status-justify left
+
+# Deep indigo background
+set -g status-style "bg=#24283b,fg=#c0caf5"
+
+# Remove default spacing
+set -g status-left-length 40
+set -g status-right-length 100
+
+# Left
+set -g status-left "#[fg=#bb9af7,bold] #S #[fg=#565f89]|"
+
+# Right
+set -g status-right "#[fg=#7aa2f7]%H:%M #[fg=#565f89]| #[fg=#9ece6a]%Y-%m-%d "
+
+##### Windows #####
+
+set -g window-status-format " #I:#W "
+set -g window-status-style "fg=#565f89,bg=#24283b"
+
+set -g window-status-current-format " #I:#W "
+set -g window-status-current-style "fg=#1a1b26,bg=#bb9af7,bold"
+
+set -g window-status-activity-style "fg=#e0af68,bold"
+
+##### Pane Borders #####
+
+set -g pane-border-style "fg=#414868"
+set -g pane-active-border-style "fg=#bb9af7"
+
+##### Messages #####
+
+set -g message-style "fg=#1a1b26,bg=#bb9af7"
+set -g message-command-style "fg=#1a1b26,bg=#7aa2f7"
+
+##### Copy Mode #####
+
+set -g mode-style "fg=#1a1b26,bg=#7dcfff"
+
+##### Clock #####
+
+set -g clock-mode-colour "#bb9af7"
+
+##### Pane Numbers #####
+
+set -g display-panes-active-colour "#bb9af7"
+set -g display-panes-colour "#565f89"
+
+##### Bell #####
+
+set -g visual-bell off
+set -g bell-action none
+

index.html

@@ -0,0 +1,544 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>claudaris</title>
+<style>
+  :root {
+    --bg: #0d0e1a;
+    --bg-panel: #131426;
+    --bg-panel-2: #1a1b2e;
+    --border: #2a2c4a;
+    --purple: #bb9af7;
+    --blue: #7aa2f7;
+    --cyan: #7dcfff;
+    --green: #9ece6a;
+    --yellow: #e0af68;
+    --pink: #f7768e;
+    --text: #c0caf5;
+    --text-dim: #6b7089;
+    --mono: "SF Mono", "Fira Code", "JetBrains Mono", ui-monospace, Menlo, Consolas, monospace;
+  }
+
+  * { box-sizing: border-box; }
+
+  html, body {
+    margin: 0;
+    padding: 0;
+    background: var(--bg);
+    color: var(--text);
+    font-family: var(--mono);
+    overflow-x: hidden;
+  }
+
+  body {
+    background-image:
+      linear-gradient(rgba(187,154,247,0.035) 1px, transparent 1px),
+      linear-gradient(90deg, rgba(187,154,247,0.035) 1px, transparent 1px);
+    background-size: 40px 40px;
+    min-height: 100vh;
+  }
+
+  ::selection { background: var(--purple); color: var(--bg); }
+
+  a { color: var(--cyan); text-decoration: none; }
+  a:hover { text-decoration: underline; }
+
+  /* scanline flicker overlay */
+  .scanlines {
+    pointer-events: none;
+    position: fixed;
+    inset: 0;
+    z-index: 50;
+    background: repeating-linear-gradient(
+      to bottom,
+      rgba(255,255,255,0.015) 0px,
+      rgba(255,255,255,0.015) 1px,
+      transparent 1px,
+      transparent 3px
+    );
+    mix-blend-mode: overlay;
+  }
+
+  .wrap {
+    max-width: 900px;
+    margin: 0 auto;
+    padding: 48px 24px 96px;
+    position: relative;
+  }
+
+  /* Header */
+  header {
+    border: 1px solid var(--border);
+    background: linear-gradient(180deg, var(--bg-panel), var(--bg));
+    border-radius: 8px;
+    padding: 28px 32px;
+    margin-bottom: 28px;
+    position: relative;
+    overflow: hidden;
+  }
+
+  header::before {
+    content: "";
+    position: absolute;
+    top: 0; left: 0; right: 0;
+    height: 2px;
+    background: linear-gradient(90deg, transparent, var(--purple), var(--cyan), var(--purple), transparent);
+    animation: scan 4s linear infinite;
+  }
+
+  @keyframes scan {
+    0% { transform: translateX(-100%); }
+    100% { transform: translateX(100%); }
+  }
+
+  .glitch-title {
+    font-size: clamp(2rem, 6vw, 3.2rem);
+    font-weight: 800;
+    letter-spacing: 2px;
+    margin: 0;
+    color: var(--purple);
+    text-shadow:
+      0 0 8px rgba(187,154,247,0.6),
+      0 0 24px rgba(187,154,247,0.25);
+    position: relative;
+    display: inline-block;
+  }
+
+  .glitch-title::after {
+    content: attr(data-text);
+    position: absolute;
+    left: 2px;
+    top: 0;
+    color: var(--cyan);
+    opacity: 0.5;
+    clip-path: inset(0 0 55% 0);
+    animation: glitch 3.2s infinite steps(1);
+  }
+
+  @keyframes glitch {
+    0%, 92%, 100% { clip-path: inset(0 0 100% 0); transform: translate(0,0); }
+    93% { clip-path: inset(10% 0 60% 0); transform: translate(-2px,1px); }
+    95% { clip-path: inset(50% 0 10% 0); transform: translate(2px,-1px); }
+    97% { clip-path: inset(20% 0 40% 0); transform: translate(-1px,0); }
+  }
+
+  .subtitle {
+    color: var(--text-dim);
+    margin-top: 10px;
+    font-size: 0.95rem;
+  }
+
+  .subtitle .accent { color: var(--green); }
+  .subtitle .accent2 { color: var(--yellow); }
+
+  .tags {
+    margin-top: 18px;
+    display: flex;
+    gap: 8px;
+    flex-wrap: wrap;
+  }
+
+  .tag {
+    font-size: 0.72rem;
+    padding: 3px 10px;
+    border: 1px solid var(--border);
+    border-radius: 999px;
+    color: var(--text-dim);
+    background: rgba(255,255,255,0.02);
+    letter-spacing: 0.5px;
+  }
+
+  /* Nav */
+  nav {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 10px;
+    margin-bottom: 32px;
+  }
+
+  nav a {
+    color: var(--text-dim);
+    border: 1px solid var(--border);
+    padding: 6px 14px;
+    border-radius: 6px;
+    font-size: 0.8rem;
+    transition: all 0.15s ease;
+    text-decoration: none;
+  }
+
+  nav a:hover {
+    color: var(--bg);
+    background: var(--purple);
+    border-color: var(--purple);
+    box-shadow: 0 0 14px rgba(187,154,247,0.5);
+  }
+
+  /* Section panels */
+  section {
+    border: 1px solid var(--border);
+    background: var(--bg-panel);
+    border-radius: 8px;
+    padding: 26px 30px;
+    margin-bottom: 20px;
+    scroll-margin-top: 20px;
+    position: relative;
+  }
+
+  section h2 {
+    margin: 0 0 14px;
+    font-size: 1.05rem;
+    letter-spacing: 1px;
+    text-transform: uppercase;
+    color: var(--blue);
+    display: flex;
+    align-items: center;
+    gap: 10px;
+  }
+
+  section h2::before {
+    content: "";
+    width: 8px;
+    height: 8px;
+    background: var(--cyan);
+    box-shadow: 0 0 8px var(--cyan);
+    border-radius: 1px;
+    transform: rotate(45deg);
+    flex-shrink: 0;
+  }
+
+  section p {
+    line-height: 1.7;
+    color: var(--text);
+    font-size: 0.92rem;
+  }
+
+  section p.dim, li.dim { color: var(--text-dim); }
+
+  code, .kbd {
+    font-family: var(--mono);
+    background: rgba(122,162,247,0.1);
+    color: var(--cyan);
+    padding: 1px 6px;
+    border-radius: 4px;
+    border: 1px solid rgba(122,162,247,0.2);
+    font-size: 0.86em;
+  }
+
+  pre {
+    background: #0a0b16;
+    border: 1px solid var(--border);
+    border-left: 3px solid var(--purple);
+    border-radius: 6px;
+    padding: 16px 18px;
+    overflow-x: auto;
+    margin: 14px 0;
+    position: relative;
+  }
+
+  pre::before {
+    content: "$";
+    color: var(--green);
+    margin-right: 10px;
+    opacity: 0.7;
+  }
+
+  pre code {
+    background: none;
+    border: none;
+    padding: 0;
+    color: var(--green);
+    font-size: 0.9rem;
+  }
+
+  /* Command grid */
+  .cmd-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(240px, 1fr));
+    gap: 12px;
+    margin-top: 8px;
+  }
+
+  .cmd-card {
+    border: 1px solid var(--border);
+    background: var(--bg-panel-2);
+    border-radius: 6px;
+    padding: 14px 16px;
+    transition: border-color 0.2s ease, transform 0.2s ease;
+  }
+
+  .cmd-card:hover {
+    border-color: var(--purple);
+    transform: translateY(-2px);
+  }
+
+  .cmd-card .cmd {
+    color: var(--pink);
+    font-weight: 700;
+    font-size: 0.95rem;
+  }
+
+  .cmd-card .alias {
+    color: var(--text-dim);
+    font-size: 0.75rem;
+    margin-left: 6px;
+  }
+
+  .cmd-card .desc {
+    color: var(--text-dim);
+    font-size: 0.82rem;
+    margin-top: 6px;
+    line-height: 1.5;
+  }
+
+  /* Config table */
+  table {
+    width: 100%;
+    border-collapse: collapse;
+    margin-top: 10px;
+    font-size: 0.86rem;
+  }
+
+  th {
+    text-align: left;
+    color: var(--yellow);
+    font-weight: 600;
+    padding: 8px 10px;
+    border-bottom: 1px solid var(--border);
+    font-size: 0.78rem;
+    text-transform: uppercase;
+    letter-spacing: 0.5px;
+  }
+
+  td {
+    padding: 10px 10px;
+    border-bottom: 1px solid rgba(42,44,74,0.5);
+    vertical-align: top;
+    color: var(--text);
+  }
+
+  tr:last-child td { border-bottom: none; }
+
+  td.name { color: var(--green); white-space: nowrap; }
+  td.default { color: var(--text-dim); }
+
+  ul.check {
+    list-style: none;
+    padding: 0;
+    margin: 8px 0 0;
+  }
+
+  ul.check li {
+    padding: 6px 0 6px 24px;
+    position: relative;
+    font-size: 0.9rem;
+    line-height: 1.6;
+    color: var(--text);
+  }
+
+  ul.check li::before {
+    content: "▸";
+    position: absolute;
+    left: 0;
+    color: var(--purple);
+  }
+
+  .note {
+    border-left: 3px solid var(--yellow);
+    background: rgba(224,175,104,0.06);
+    padding: 10px 16px;
+    border-radius: 0 6px 6px 0;
+    font-size: 0.85rem;
+    color: var(--text-dim);
+    margin-top: 14px;
+  }
+  .note strong { color: var(--yellow); }
+
+  footer {
+    text-align: center;
+    color: var(--text-dim);
+    font-size: 0.78rem;
+    margin-top: 40px;
+    padding-top: 24px;
+    border-top: 1px solid var(--border);
+  }
+
+  footer .blink {
+    animation: blink 1.4s steps(1) infinite;
+    color: var(--green);
+  }
+
+  @keyframes blink {
+    50% { opacity: 0; }
+  }
+
+  @media (max-width: 600px) {
+    section { padding: 20px 18px; }
+    header { padding: 22px 20px; }
+  }
+</style>
+</head>
+<body>
+<div class="scanlines"></div>
+<div class="wrap">
+
+  <header>
+    <h1 class="glitch-title" data-text="CLAUDARIS">CLAUDARIS</h1>
+    <div class="subtitle">
+      /klaw-<span class="accent">DAR</span>-iss/ — a moveable docker container for
+      <span class="accent2">Claude Code</span>. using Arch btw.
+    </div>
+    <div class="tags">
+      <span class="tag">ARCHLINUX</span>
+      <span class="tag">TMUX</span>
+      <span class="tag">SELF-HOSTED</span>
+      <span class="tag">NO-RESTART-POLICY</span>
+    </div>
+  </header>
+
+  <nav>
+    <a href="#configure">01 · configure</a>
+    <a href="#commands">02 · commands</a>
+    <a href="#ssh">03 · ssh</a>
+    <a href="#internals">04 · internals</a>
+    <a href="#structure">05 · repo</a>
+  </nav>
+
+  <section id="configure">
+    <h2>Configure</h2>
+    <p>
+      Run the interactive wizard — press enter at any prompt to keep the
+      current/default value:
+    </p>
+    <pre><code>./claudaris config</code></pre>
+    <p>
+      It writes your answers to <code>.env</code> (gitignored — every user
+      keeps their own), which every other command sources. Set
+      <code>NAME</code> to something unique to you (e.g. <code>chris-claude</code>)
+      if more than one person is running a container from this same repo
+      checkout. Re-run <code>config</code> / <code>configure</code> any time
+      to update it.
+    </p>
+    <table>
+      <tr><th>variable</th><th>purpose</th><th>default</th></tr>
+      <tr>
+        <td class="name">NAME</td>
+        <td>Image name, container name, and hostname inside the container (shows up as <code>root@$NAME</code> in the prompt).</td>
+        <td class="default">claudaris</td>
+      </tr>
+      <tr>
+        <td class="name">DATA_DIR</td>
+        <td>Host directory for volume mount data — bashrc, aliases, Claude auth, ssh keys.</td>
+        <td class="default">/data/$NAME</td>
+      </tr>
+      <tr>
+        <td class="name">WORKSPACE_DIR</td>
+        <td>Host directory mounted as <code>/projects</code> inside the container.</td>
+        <td class="default">/home/$USER/projects</td>
+      </tr>
+    </table>
+  </section>
+
+  <section id="commands">
+    <h2>Commands</h2>
+    <p class="dim">Everything runs through the single <code>claudaris</code> entry point.</p>
+
+    <div class="cmd-grid">
+      <div class="cmd-card">
+        <div><span class="cmd">config</span><span class="alias">configure</span></div>
+        <div class="desc">Interactive wizard — writes <code>NAME</code>, <code>DATA_DIR</code>, <code>WORKSPACE_DIR</code> to <code>.env</code>.</div>
+        <pre><code>./claudaris config</code></pre>
+      </div>
+      <div class="cmd-card">
+        <div><span class="cmd">build</span></div>
+        <div class="desc">Builds the image (always <code>--no-cache --pull</code>, so it picks up the latest Claude Code release).</div>
+        <pre><code>sudo ./claudaris build</code></pre>
+      </div>
+      <div class="cmd-card">
+        <div><span class="cmd">start</span></div>
+        <div class="desc">Creates or restarts the container with all volumes wired up.</div>
+        <pre><code>sudo ./claudaris start</code></pre>
+      </div>
+      <div class="cmd-card">
+        <div><span class="cmd">connect</span></div>
+        <div class="desc">Starts the container if needed, then attaches your tmux session.</div>
+        <pre><code>sudo ./claudaris connect</code></pre>
+      </div>
+      <div class="cmd-card">
+        <div><span class="cmd">remove</span><span class="alias">stop · rm</span></div>
+        <div class="desc">Stops and removes the container so the next <code>start</code> recreates it fresh.</div>
+        <pre><code>sudo ./claudaris remove</code></pre>
+      </div>
+    </div>
+  </section>
+
+  <section id="ssh">
+    <h2>Optional: SSH access to other nodes</h2>
+    <p>
+      To let the container SSH out to other machines, create
+      <code>$DATA_DIR/ssh</code> on the host and populate it with keys/config
+      <em>before</em> running <code>./claudaris start</code>. If present, it's
+      bind-mounted read-only to <code>/root/.ssh</code>.
+    </p>
+    <div class="note"><strong>off by default</strong> — nothing is mounted unless the directory exists.</div>
+  </section>
+
+  <section id="internals">
+    <h2>Internals</h2>
+
+    <p><strong style="color:var(--green)">Persistent login.</strong>
+      Claude Code is installed at build time under <code>/root</code>, so a
+      rebuild always picks up the latest release. Two files are bind-mounted
+      individually to survive that: <code>~/.claude/.credentials.json</code>
+      (the OAuth token) and <code>~/.claude.json</code> (account/onboarding
+      state — Claude Code checks this too, so persisting the token alone
+      isn't enough to avoid a re-login prompt after a rebuild).
+      <code>./claudaris start</code> seeds both from empty on the host the
+      first time it runs.
+    </p>
+
+    <p><strong style="color:var(--green)">Self-stopping.</strong>
+      The container stops itself once its tmux session ends (any shell exit
+      — Ctrl+D, <code>exit</code>, crash) instead of running forever, and
+      there's no Docker restart policy — <code>connect</code> and
+      <code>start</code> both bring it back up automatically if you find it
+      stopped.
+    </p>
+
+    <p><strong style="color:var(--green)">Dotfiles.</strong>
+      <code>.bashrc</code> and <code>bash_aliases</code> are both bind-mounted
+      as single files so they can be tweaked per-host (e.g. a coworker
+      importing their own aliases) without a rebuild.
+      <code>./claudaris start</code> seeds them from <code>files/bashrc</code>
+      and <code>files/bash_aliases</code> the first time it runs, without
+      overwriting later edits. Anything that needs to survive regardless
+      (PATH, zoxide, git identity) lives in <code>/etc/...</code> inside the
+      image instead of under <code>/root</code>.
+    </p>
+
+    <p><strong style="color:var(--green)">Hostname.</strong>
+      The container is started with <code>--hostname "$NAME"</code>, so the
+      prompt reads <code>root@claudaris</code> (or whatever you set
+      <code>NAME</code> to) instead of a random container ID.
+    </p>
+  </section>
+
+  <section id="structure">
+    <h2>Repo layout</h2>
+    <ul class="check">
+      <li><code>claudaris</code> — the entry point: build / start / connect / remove / help.</li>
+      <li><code>Dockerfile</code> — Arch base image, dotfiles, Claude Code install, entrypoint.</li>
+      <li><code>.env</code> — written by <code>claudaris config</code>, per-user, gitignored.</li>
+      <li><code>files/</code> — <code>bashrc</code>, <code>bash_aliases</code>, <code>entrypoint.sh</code>, <code>tmux</code> wrapper, <code>tmux.conf</code>.</li>
+      <li><code>AGENTS.md</code> — deep-dive notes for anyone (human or agent) hacking on this repo.</li>
+    </ul>
+  </section>
+
+  <footer>
+    claudaris <span class="blink">█</span> moveable · self-hosted · always running the latest Claude Code
+  </footer>
+
+</div>
+</body>
+</html>