Official Images

Tektona publishes two official sandbox images on GitHub Container Registry. Both are built on Ubuntu 24.04 and boot with systemd, so a sandbox behaves like a regular Linux machine: apt install nginx starts and enables the service, systemctl works, and background daemons keep running (requires image 0.5.0 or later).

sandbox-base

ghcr.io/tektona-ai/sandbox-base is the headless image — pick it for agent, CI-style, or server workloads that don't need a screen. It ships:

• AI coding agents: Claude Code, Codex, and opencode, ready on the PATH (each release bundles the latest stable versions).
• Node.js 22 LTS with npm.
• code-server for VS Code in the browser.
• A developer toolchain: git (with LFS), Python 3 with pip, build-essential, cmake, and the usual command-line tools for building, inspecting, and debugging (curl, jq, yq, rsync, htop, strace, and more).
• The tektona user with passwordless sudo; sessions land in /home/tektona.

desktop-x11

ghcr.io/tektona-ai/desktop-x11 is sandbox-base plus a full X11 desktop, and the recommended starting point for VNC and computer use. On top of everything above it adds:

• A lightweight desktop environment (Openbox window manager with a dock), viewable in the browser or any VNC client.
• Google Chrome, preconfigured to run inside the sandbox with no first-run prompts — ready for AI browser automation.
• Desktop apps: a terminal, file manager, text editors, calculator, PDF viewer, and LibreOffice Writer and Calc.
• The tooling behind tektonactl desktop — screenshots, clicking, typing, window management, and screen recording.

tektona sandbox create tektona/desktop --vnc

Templates Tektona provides

A sandbox starts from a template, never from an image reference. Both images ship as templates, so you can start a sandbox with no setup. A template reference that begins with tektona/ is one Tektona maintains — you can read it, and only Tektona changes it.

Leave the tag off and you get :default, which always points at the version Tektona currently recommends:

POST /v1/sandboxes
{ "template": "tektona/sandbox-base" }

A template version supplies defaults, never fixed values, so anything the create sets wins. The sandbox records the exact version it started from, so the answer stays true after :default moves on.

To pin a version, use the version id the sandbox reports. To build your own starting point, create a template in your project.

Versions

Images are versioned together and tagged X.Y.Z (plus a floating X.Y). Browse published versions on the package pages linked above and use the highest-numbered tag when you build a template from one. To pin what a sandbox starts from, see Choosing a template.

Extending

Both images are ordinary OCI images — extend one with a Dockerfile, then build a template from the result:

FROM ghcr.io/tektona-ai/desktop-x11:0.6.0
RUN apt-get update && apt-get install -y your-tools

tektona template create my-desktop --image ghcr.io/acme/my-desktop:1.0.0
tektona sandbox create my-desktop

See Run a Custom Image for pushing and using your own image, including private registries.