AI CLI Setup & Usage¶

Every DevOps image ships four agentic AI coding assistants. Each one can read your project, edit files and run commands, and each has an interactive mode for you and a non-interactive mode for scripts and CI. This page shows how to sign in to each one inside the container and how to call it from a script.

At a glance¶

Plans and prices change often, so check each vendor directly: Claude, OpenAI API, GitHub Copilot and Antigravity.

How sign-in works in a container¶

The CLIs keep their login in a config directory under /root. Mount that directory from your host and you sign in once, then every new container reuses the login. In CI, where nothing is mounted, you pass a token as an environment variable instead.

sequenceDiagram
  participant H as Host config dir<br/>~/.claude, ~/.codex,<br/>~/.copilot, ~/.gemini
  participant C as CLI in container
  participant V as Vendor API
  H->>C: mounted at /root/...
  alt no saved login yet
    C->>V: start sign-in
    V-->>C: login URL
    Note over C: open the URL on your host,<br/>paste the code back
    C->>H: token saved to mounted dir
  end
  C->>V: prompt + token
  V-->>C: response, edits, commands

Start a container with all four logins mounted (you only need the ones you use):

[ -s ~/.claude.json ] || echo '{}' > ~/.claude.json
mkdir -p ~/.claude ~/.codex ~/.copilot ~/.gemini

docker run -it --rm \
  -v "$PWD":/srv -w /srv \
  -v ~/.claude:/root/.claude \
  -v ~/.claude.json:/root/.claude.json \
  -v ~/.codex:/root/.codex \
  -v ~/.copilot:/root/.copilot \
  -v ~/.gemini:/root/.gemini \
  ghcr.io/jinalshah/devops/images/all-devops:latest

Claude Code¶

docker run -it --rm \
  -v "$PWD":/srv -w /srv \
  -v ~/.claude:/root/.claude \
  -v ~/.claude.json:/root/.claude.json \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  claude

docker run --rm \
  -v "$PWD":/srv -w /srv \
  -e ANTHROPIC_API_KEY \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  claude -p "Summarise what this repository deploys"

Non-interactive use: always pass -p (--print). Without it, claude opens the interactive UI even when you redirect the output. There are no --file or --stdin flags: pipe content in, or name files in the prompt and Claude reads them from the working directory.

# Review your uncommitted changes
git diff | claude -p "Review this diff for security issues and risky changes"

# Explain a failure
terraform plan 2>&1 | claude -p "Why did this plan fail, and how do I fix it?"

# Let Claude read files itself
claude -p "Explain what ansible/deploy.yml does, step by step" > deploy-explained.md

# Machine-readable output
claude -p "List the AWS resources in main.tf" --output-format json

Other handy flags: --model, -c/--continue (carry on from the last conversation) and --permission-mode acceptEdits (let a -p run edit files).

OpenAI Codex CLI¶

docker run -it --rm \
  -v "$PWD":/srv -w /srv \
  -v ~/.codex:/root/.codex \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  codex login --device-auth

printenv OPENAI_API_KEY | codex login --with-api-key

docker run --rm \
  -v "$PWD":/srv -w /srv \
  -e CODEX_API_KEY \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  codex exec "Summarise what this repository deploys"

Non-interactive use: use codex exec (alias codex e). Plain codex "..." starts the interactive UI. codex exec runs in a read-only sandbox by default. Add --sandbox workspace-write when you want it to create or edit files.

# Review a diff (piped input is added to the prompt)
git diff | codex exec "Review this diff for security issues"

# Let Codex write files in the project
codex exec --sandbox workspace-write \
  "Create scripts/backup-postgres.sh that dumps a PostgreSQL database and uploads it to S3"

# JSONL event stream for tooling
codex exec --json "List the Terraform modules in this repo"

Settings live in ~/.codex/config.toml and credentials in ~/.codex/auth.json, which you should treat like a password. Set CODEX_HOME to move them. -m/--model picks a model, and codex resume reopens an earlier session.

GitHub Copilot CLI¶

copilot is GitHub's standalone agentic CLI. It is not IDE inline completion, and the old gh copilot suggest/explain extension isn't in the image.

docker run -it --rm \
  -v "$PWD":/srv -w /srv \
  -v ~/.copilot:/root/.copilot \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  copilot

docker run --rm \
  -v "$PWD":/srv -w /srv \
  -e COPILOT_GITHUB_TOKEN \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  copilot -p "Summarise what this repository deploys" --allow-all-tools

Non-interactive use: copilot -p "..." needs --allow-all-tools (or COPILOT_ALLOW_ALL=true), because it can't stop to ask for permission. Add -s/--silent to print only the answer. There's no --file flag: name files in the prompt.

copilot -s --allow-all-tools \
  -p "Review .github/workflows/deploy.yml for security issues and missing caching"

Other flags: --model and --output-format text|json. State lives in ~/.copilot (set COPILOT_HOME to move it).

Google Antigravity CLI¶

docker run -it --rm \
  -v "$PWD":/srv -w /srv \
  -v ~/.gemini:/root/.gemini \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  agy

mkdir -p ~/.gemini/antigravity-cli
echo '{"modelProvider": "gemini"}' > ~/.gemini/antigravity-cli/settings.json

docker run --rm \
  -v "$PWD":/srv -w /srv \
  -v ~/.gemini:/root/.gemini \
  -e GEMINI_API_KEY \
  ghcr.io/jinalshah/devops/images/all-devops:latest \
  agy -p "Summarise what this repository deploys"

gcloud auth application-default login   # on the host

docker run --rm \
  -v "$PWD":/srv -w /srv \
  -v ~/.config/gcloud:/root/.config/gcloud \
  -e AGY_ADC_AUTH=true \
  ghcr.io/jinalshah/devops/images/gcp-devops:latest \
  agy -p "Summarise what this repository deploys"

Non-interactive use: agy -p "..." (--print), with --output-format text|json|stream-json and --print-timeout 5m. When a headless run fails, agy exits with code 3 and prints AGY_ERROR: {json} on stderr, which is easy to catch in CI. There are no --file, --stdin or --image flags: pipe content in, or name files in the prompt.

git diff | agy -p "Review this diff for security issues"

trivy config --format json . | agy -p "Prioritise these findings and suggest fixes" > trivy-triage.md

# Let it edit files without asking
agy -p "Add descriptions to every variable in modules/vpc/variables.tf" --mode accept-edits

Other flags: --model, --effort low|medium|high, --mode plan, -c/--continue and --sandbox. Subcommands include agy models, agy mcp and agy update, and agy --version prints the version. The binary also updates itself in the background.

Choosing an assistant¶

All four are capable agentic assistants: each reads and edits files and runs commands, and several accept images too. Pick based on what your team already pays for and signs in with:

• Already on a Claude plan or the Anthropic API? Use claude.
• Already on ChatGPT or the OpenAI API? Use codex.
• Already licensed for GitHub Copilot? Use copilot, with no extra vendor account.
• Google Workspace, a Gemini API key or Vertex AI? Use agy.

A second assistant is also a cheap second opinion: generate with one, then review with another.

Good habits¶

Troubleshooting¶

docker run --rm -v ~/.gemini:/root/.gemini \
  ghcr.io/jinalshah/devops/images/all-devops:latest ls -la /root/.gemini

Next steps¶

• AI-assisted DevOps workflows: review, generate and troubleshoot, with CI examples
• Authentication guide: cloud, SSH and AI credentials in one place
• Multi-tool patterns: combine AI with Terraform, Trivy and friends