feat(coder/modules/boundary): add boundary module by 35C4n0r · Pull Request #840 · coder/registry

35C4n0r · 2026-04-13T03:21:11Z

Description

Extracts boundary installation and wrapper logic into a standalone coder/boundary module, decoupling it from agentapi.

Why

Boundary is currently embedded inside agentapi (scripts/boundary.sh) and duplicated in claude-code. This couples network isolation to the AI/Tasks stack, but boundary is a general-purpose primitive — users running a plain agent with no agentapi or tasks should be able to use it too.

What this adds

registry/coder/modules/boundary/ — a new first-class module that:

Installs boundary via one of three strategies:
1. coder boundary subcommand (default, zero-install)
2. Direct binary from release (use_boundary_directly = true)
3. Compiled from source (compile_boundary_from_source = true)
Creates a wrapper script at $HOME/.coder-modules/coder/boundary/boundary-wrapper.sh
Exports BOUNDARY_WRAPPER_PATH as a coder_env so any workspace process can use it
Strips CAP_NET_ADMIN from the coder binary (copies to coder-no-caps) to allow execution inside network namespaces without sys_admin
Supports pre_install_script / post_install_script hooks
Exposes boundary_wrapper_path output and sync_script_names for script coordination

Usage

module "boundary" {
  count    = data.coder_workspace.me.start_count
  source   = "registry.coder.com/coder/boundary/coder"
  version  = "0.0.1"
  agent_id = coder_agent.main.id
}

Works standalone with any agent — no agentapi dependency required.

Testing

Terraform variable validation (boundary.tftest.hcl)
TypeScript integration tests (main.test.ts): state verification, coder subcommand happy path, custom hooks, env var correctness, wrapper execution, idempotent installation

Type of Change

New module

Module Information

Path: registry/coder/modules/boundary
New version: v0.0.1
Breaking change: No

Related Issues

Closes #844

🤖 Generated by Coder Agents

…on scripts

Copilot

Pull request overview

Adds a new coder/boundary registry module intended to set up Boundary-related tooling for Coder workspaces.

Changes:

Introduces a Boundary install/setup shell script that can compile from source, install from release, or rely on coder boundary.
Adds a Terraform module (main.tf) that deploys and runs the install script on an agent.
Adds module README and Terraform native tests (.tftest.hcl).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 7 comments.

File	Description
`registry/coder/modules/boundary/scripts/install.sh`	Installs Boundary (or validates `coder boundary`) and generates a wrapper script.
`registry/coder/modules/boundary/main.tf`	Defines module variables and a `coder_script` to deliver/execute `install.sh`.
`registry/coder/modules/boundary/README.md`	Documents module usage and examples.
`registry/coder/modules/boundary/boundary.tftest.hcl`	Adds Terraform plan-time assertions for basic module wiring.

… install hooks

…lation and execution

…module

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 7 comments.

…missing mock support Three root causes: 1. boundary_script_destination used 'install.sh' - same filename that coder-utils writes to. This caused the running script to overwrite itself, corrupting bash's incremental read and producing empty install.log / no wrapper. Fix: rename to 'boundary-install.sh'. 2. coder-mock.sh didn't handle 'coder exp sync' commands used by coder-utils for script ordering. With set -o errexit, scripts failed immediately. Fix: add exp sync as no-op (exit 0). 3. Test setup used setupUtil which only extracts ONE coder_script, but coder-utils creates multiple (pre_install, install, post_install). Fix: extract all coder_scripts from terraform state and run them sequentially in lifecycle order. 4. wrapper-script-execution test called 'wrapper.sh --help' which the mock couldn't handle after the '--' separator (tried to exec '--help'). Fix: test with 'echo boundary-test' instead.

…e gracefully

…r scripts

The boundary command (both 'coder boundary' and standalone 'boundary') expects a '--' separator before the command to execute. The wrapper scripts were passing arguments directly without this separator, causing the wrapper-script-execution test to fail. 🤖 Generated by Coder Agents

This reverts commit 81df58f.

The boundary wrapper scripts pass arguments directly without a '--' separator. Updated the coder mock to match this behavior and adjusted the test comment accordingly. 🤖 Generated by Coder Agents

…README

- Renamed scripts/install.sh → scripts/install.sh.tftpl - Use templatefile() to inject variables at plan time instead of base64-encoding the script and passing env vars at runtime - Removed boundary_script/boundary_script_destination locals - Fixed /home/coder expansion in MODULE_DIR and BOUNDARY_WRAPPER_PATH (double quotes for shell expansion) - Updated custom module_directory test paths to match coder-utils validation pattern ($HOME/.coder-modules/<ns>/<name>) - Updated script name references (coder_boundary → coder-boundary) - Fixed coder-utils source to use branch ref 🤖 Generated by Coder Agents

🤖 Generated by Coder Agents

…sion

🤖 Generated by Coder Agents

- Remove scaffold comment from main.tf - Add description to 'scripts' output - Add sample config.yaml with allowlist skeleton - Add Configuration section to README with coder_script example - Add Claude Code + boundary example showing coder exp sync wait pattern and $BOUNDARY_WRAPPER_PATH -- claude launcher - Simplify usage examples to use -- separator without config flags 🤖 Generated by Coder Agents

- Add boundary_config (string) for inline config content - Add boundary_config_path (string) for external config file path - Cross-variable validation (mutually exclusive, requires TF >= 1.9) - Ship comprehensive default config based on Coder dogfood allowlist - Write config to ~/.config/coder_boundary/config.yaml by default - Export BOUNDARY_CONFIG env var pointing to the effective config path - Add boundary_config_path output - Tests: 13 pass, 67 assertions (8 HCL plan tests pass)

matifali · 2026-04-28T09:13:35Z

+  # Your Coder deployment domain (required — replace with your own).
+  - domain=your-deployment.coder.com
+
+  # Anthropic Services


Also include OpenAI end points.

matifali · 2026-04-28T09:14:16Z

@@ -0,0 +1,211 @@
+allowlist:
+  # Your Coder deployment domain (required — replace with your own).
+  - domain=your-deployment.coder.com


Can we not prefill this using data.coder_workspace.me.access-url?

matifali · 2026-04-28T09:16:15Z

+  # BOUNDARY_CONFIG points to.
+  default_boundary_config        = file("${path.module}/config.yaml")
+  boundary_config_content        = var.boundary_config != null ? var.boundary_config : local.default_boundary_config
+  boundary_config_dir            = "$HOME/.config/coder_boundary"


I think this should live in the .coder-modules/coder/boundary right i.e. module_directory

matifali · 2026-04-28T09:17:32Z

+
+validate_boundary_subcommand() {
+  if command -v coder > /dev/null 2>&1; then
+    if coder boundary --help > /dev/null 2>&1; then


How does this play with unlicensed Coder deployments?

matifali · 2026-04-28T09:17:35Z

+
+validate_boundary_subcommand() {
+  if command -v coder > /dev/null 2>&1; then
+    if coder boundary --help > /dev/null 2>&1; then


How does this play with unlicensed Coder deployments?

matifali · 2026-04-28T09:23:54Z

+
+resource "coder_env" "boundary_wrapper_path" {
+  agent_id = var.agent_id
+  name     = "BOUNDARY_WRAPPER_PATH"


Why are we setting both an ENV and an output for the boundary wrapper path. I think a module output is enough and we can remove the ENV

@35C4n0r, can you respond to this? And please avoid resolving conversations on your own. This confuses the reviewer to see what has been added and how.
Thanks

matifali · 2026-04-28T09:24:37Z

+  value    = local.effective_boundary_config_path
+}
+
+output "boundary_wrapper_path" {


Isn't this enough and we can drop BOUNDARY_WRAPPER_PATH?

- Remove BOUNDARY_WRAPPER_PATH env var, keep output only - Move config path into module_directory (config/config.yaml) - Auto-fill Coder deployment domain via data.coder_workspace.me - Add OpenAI endpoints to default config allowlist

… directly

…config_path outputs

…help 'coder boundary --help' succeeds even on unlicensed deployments. Use 'coder boundary -- true' instead to catch license entitlement errors and surface an actionable message.

…oder boundary failures

…c output

35C4n0r added 2 commits April 13, 2026 08:45

feat(boundary): add boundary module with installation and configurati…

2b459f7

…on scripts

chore: bun fmt

e4e059b

35C4n0r self-assigned this Apr 13, 2026

35C4n0r requested a review from Copilot April 13, 2026 03:28

Copilot started reviewing on behalf of 35C4n0r April 13, 2026 03:28 View session

Copilot AI reviewed Apr 13, 2026

View reviewed changes

35C4n0r marked this pull request as draft April 13, 2026 03:38

35C4n0r and others added 4 commits April 14, 2026 16:37

feat(boundary): enhance installation with wrapper script and pre/post…

12ca1b1

… install hooks

Merge branch 'main' into 35C4n0r/feat-boundary-module

abba320

feat(boundary): add tests and mock scripts for boundary module instal…

0a7aa71

…lation and execution

docs: update README with script synchronization details for boundary …

8dc8c8b

…module

35C4n0r requested a review from Copilot April 14, 2026 17:58

Copilot started reviewing on behalf of 35C4n0r April 14, 2026 17:59 View session

Copilot AI reviewed Apr 14, 2026

View reviewed changes

35C4n0r mentioned this pull request Apr 14, 2026

feat(registry/coder/modules/coder-utils): make install_script and start_script optional #842

Merged

4 tasks

Jay Kumar and others added 8 commits April 14, 2026 18:19

chore: description fix

ce15e06

chore(boundary): remove unused boundary-mock.sh

946204d

fix(boundary): improve command check for 'coder' to handle errors mor…

8b88931

…e gracefully

fix(boundary): remove unnecessary argument passing in boundary wrappe…

f45b2e9

…r scripts

Revert "fix: add '--' separator in boundary wrapper scripts"

f081d87

This reverts commit 81df58f.

fix(tests): update mock and test to not require '--' separator

ec2e16f

The boundary wrapper scripts pass arguments directly without a '--' separator. Updated the coder mock to match this behavior and adjusted the test comment accordingly. 🤖 Generated by Coder Agents

35C4n0r marked this pull request as ready for review April 15, 2026 17:27

35C4n0r requested review from evgeniy-scherbina and matifali April 15, 2026 17:28

matifali requested review from SasSwart, dannykopping and jcjiang and removed request for matifali April 16, 2026 04:50

35C4n0r added 3 commits April 23, 2026 22:24

bun fmt

f3c2c55

feat(boundary): update coder-utils source and adjust config paths in …

5dd0370

…README

docs: update README to include link for boundary installation

4dd0176

35C4n0r force-pushed the 35C4n0r/feat-boundary-module branch from eed787d to 4dd0176 Compare April 23, 2026 18:06

35C4n0r and others added 10 commits April 24, 2026 21:35

Merge branch 'main' into 35C4n0r/feat-boundary-module

056a111

style: run bun fmt

6d828df

🤖 Generated by Coder Agents

feat(boundary): update coder-utils source to registry and specify ver…

12183e5

…sion

docs: fix version in README examples to 0.0.1

256953e

🤖 Generated by Coder Agents

Merge branch 'main' into 35C4n0r/feat-boundary-module

f006b83

fix(boundary): base64 encode config content for template safety

cd71b21

fix(boundary): decode b64 at variable init, add printf debug lines

c33ae2f

matifali reviewed Apr 28, 2026

View reviewed changes

Jay Kumar and others added 7 commits April 28, 2026 09:51

refactor(boundary): convert config.yaml to tftpl, inject coder_domain…

559f4ea

… directly

bun fmt

01d1800

test(boundary): add coverage for coder_domain auto-fill, scripts and …

8c91560

…config_path outputs

fix(boundary): validate coder boundary with a real invocation, not --…

123c48b

…help 'coder boundary --help' succeeds even on unlicensed deployments. Use 'coder boundary -- true' instead to catch license entitlement errors and surface an actionable message.

fix(boundary): only fail on license entitlement error, ignore other c…

e2b69a1

…oder boundary failures

chore(boundary): trim verbose comment

b918896

matifali requested a review from SasSwart April 28, 2026 15:30

docs(boundary): update Claude Code example to coder_app, suppress syn…

4fdad04

…c output

35C4n0r marked this pull request as draft April 28, 2026 17:11

35C4n0r added 3 commits April 28, 2026 22:48

debug

39f0a5a

debug

50db520

debug

f0a469b

matifali mentioned this pull request Apr 28, 2026

Codex module: MCP server subprocesses fail TLS verification when enable_boundary=true #801

Open

debug

b15c197

Conversation

35C4n0r commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Why

What this adds

Usage

Testing

Type of Change

Module Information

Related Issues

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

35C4n0r commented Apr 13, 2026 •

edited

Loading