Login and git

Git identity

Your host's global git config user.name and user.email are passed into the container as GIT_AUTHOR_* and GIT_COMMITTER_* variables, so git commit works. This does not grant push access. To push, add a credential such as GITHUB_TOKEN through secrets. SSH keys are never forwarded. If a profile sets any of these four variables itself, the profile's value takes precedence.

Login persistence

Agent login and config state (~/.claude, ~/.codex) is stored in a Docker named volume mounted at /home/agent. Your home directory is not mounted. Logging in once works across all profiles, projects, and images on the machine.

Agent login

Codex's browser OAuth callback can't reach the container, so use the device-code flow:

stashbase agent run --profile coding -- codex login --device-auth

Add the login hosts to egress_hosts, or login and silent token refresh will fail:

If platform.claude.com is missing, Claude Code fails with "OAuth access token has expired" once the token needs to refresh, often hours after the session started.