agentteams-controller
| Version | 2026.223.1500 |
| Repo | box/github.com/opencharly/pod-agentteams-controller:v2026.237.454 |
The AgentTeams controller — a Go binary (with the agt REST client)
that embeds a kine-backed kube-apiserver and reconciles Manager/Worker/
Team/Human CRs, serving the REST API on :8090. Built from the pinned
AgentTeams v1.2.2 source tarball (CGO for the kine sqlite driver, gcc
required) plus the kube-apiserver v1.31.3 binary and the CRD + builtin
agent trees, and run as a rootless supervisord service. The controller
spawns Manager/Worker containers through the rootless podman socket
(AGENTTEAMS_PROXY_SOCKET) and mints the admin CLI token to
/var/run/agentteams/cli-token. Spawned agents join a venue-dependent
network (AGENTTEAMS_DOCKER_NETWORK, set by the start script): on a
container venue they join the charly network and reach the controller
— and, via the embedded URL rewrite, every in-container service
(matrix 6167, minio 9000, higress 8080) — by the controller container’s
DNS name; on a machine venue (VM) they use the rootless default pasta
network (the guest kernel may lack bridge support for netavark) and
reach the controller at host.docker.internal. The start script derives
AGENTTEAMS_CONTROLLER_URL from $(hostname) on a container venue and
host.docker.internal on a machine venue (an explicit non-loopback
override is honored). The start script is
charly-owned (written by this candy), not an upstream AgentTeams
script: it resolves the shared admin / MinIO / Matrix-registration
credentials (env wins, else the self-provisioned files on the
respective candies’ volumes — ~/.agentteams/controller for the admin
password, ~/.agentteams/minio for the MinIO root password,
~/.agentteams/matrix for the Matrix registration token) before
exec’ing the controller.
Services
Section titled “Services”podman-socketagentteams-controller
Acceptance plan
Section titled “Acceptance plan”This candy’s plan: — the runnable spec charly check executes against a live deployment. check: steps are idempotent probes; run: steps change state.
| Intent | Step |
|---|---|
run |
download the pinned AgentTeams v1.2.2 source tarball |
run |
build the controller and agt binaries from source |
run |
download the pinned kube-apiserver binary |
run |
install the AgentTeams CRD manifests |
run |
install the builtin agent trees (worker-agent, worker runtimes, skills) |
run |
write the tmpfiles.d entry that recreates /run/agentteams uid-1000-owned at boot |
run |
pre-create the rootless runtime directories (admin CLI token + podman socket) |
run |
create the controller volume directory under the image user’s home (venue-agnostic: ${HOME} resolves to the container home on a pod, the guest home on a VM) |
run |
enable the rootless user session for uid 1000 (subuid/subgid + linger) so the controller’s podman socket and spawned containers run unprivileged (machine venue only — the pod venue bind-mounts the host socket instead, so the systemd gate makes this a no-op there) |
run |
create the charly podman network the controller spawns Manager/Worker containers onto (machine venue only — the pod venue’s host socket already has the charly network, so the systemd gate makes this a no-op there) |
run |
write the rootless controller start script |
check |
the controller binary is built |
check |
the agt REST client binary is built |
check |
the kube-apiserver binary is installed |
check |
the AgentTeams CRD manifests are installed |
check |
the builtin agent trees are installed |
check |
the admin CLI token directory is uid-1000-writable |
check |
the controller health endpoint answers |
check |
the controller mints the admin CLI token |
check |
the controller REST API answers the authenticated status endpoint |
check |
the controller REST API lists managers with the admin token |