New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

K8s Sandbox Install

by LegoX in LegoX/Lego-RL

Guided install / scale-out of a sandbox Kubernetes cluster for the Lego-RL k8s backend (kubeadm 1.32 + containerd + flannel + ImageVolume, optionally nydus / a shared registry / an isolated dockerd).

Apache-2.0Auto-check: warningsDevOps & Cloud

Install K8s Sandbox Install

The automated check flagged lines worth reading first. See the safety section below.

skills CLI
$ npx skills add LegoX/Lego-RL --skill k8s-sandbox-install -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install LegoX/Lego-RL k8s-sandbox-install --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/LegoX/Lego-RL.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/plugins/rl-plugin/skills/k8s-sandbox-install .claude/skills/k8s-sandbox-install && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
k8s-sandbox-install
GitHub stars
113
Token cost
~2.9k tokens
SKILL.md length
1,453 words
Files
1
Skills in repo
11
Repo updated
First seen
Licence
Apache-2.0

At a glance

Guided install / scale-out of a sandbox Kubernetes cluster for the Lego-RL k8s backend (kubeadm 1.32 + containerd + flannel + ImageVolume, optionally nydus / a shared registry / an isolated dockerd).

  • Works in 7 steps: the one question, then probe everything… → per-node preflight (read-only; run… → per-node base configuration → …
  • Tasks that involve Container orchestration
  • SKILL.md covers Version baseline (do not…, Stage 0 — the one question,…, Stage 1 — per-node preflight… and Stage 2 — per-node base…, plus 5 more sections
  • Calls kubectl, curl and apt

What it does

K8s Sandbox Install is an agent skill from LegoX/Lego-RL. Guided install / scale-out of a sandbox Kubernetes cluster for the Lego-RL k8s backend (kubeadm 1.32 + containerd + flannel + ImageVolume, optionally nydus / a shared registry / an isolated dockerd). Probes the target machines for differences (OS, network, disk, pre-existing cluster) and never asks for what it can detect itself; finishes by generating a site.<name.env wired for the training side. Triggers: install kubernetes, set up a cluster, add a worker node, join worker, new cluster, sandbox cluster deployment.

Its SKILL.md is about 2.9k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in DevOps & Cloud, covering Container orchestration. It works with Kubernetes. The repository describes itself as: Lego-RL: Harness-Native Reinforcement Learning for Coding Agents. The licence is Apache-2.0.

When your agent uses it

  • Tasks that involve Container orchestration

Example prompts

  • “/k8s-sandbox-install”

Requirements

  • Docker

Workflow steps

7 steps, taken from the step headings in SKILL.md.

  1. the one question, then probe everything else
  2. per-node preflight (read-only; run everything before reporting)
  3. per-node base configuration
  4. control-plane init (master only)
  5. worker join + verification
  6. acceptance (all green, or the install is not done)
  7. wire it to the training side (generate, do not make the user fill it in)

What it can do on your machine

Read from SKILL.md and the folder at commit 0731c95. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • kubectl
    • curl
    • apt

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use kubectl and curl, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

K8s Sandbox Install loads about 2.9k tokens when it runs. Until then it costs about 135 tokens; SKILL.md has 1,453 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~135
When it runs · the whole SKILL.md, loaded when a task matches
~2.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: warnings

The automated check found patterns that need a careful read before installing.

  • WarningMentions a credentials file (SSH keys, cloud or package-manager tokens)SKILL.md:35
    If the current shell's `known_hosts`, `~/.ssh/config` or command history
  • WarningMentions a credentials file (SSH keys, cloud or package-manager tokens)SKILL.md:109
    # save the join command; set up ~/.kube/config; apply flannel

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from LegoX/Lego-RL at commit 0731c95, republished under its Apache-2.0 licence (© LegoX). 1,453 words, ~2,905 tokens.

Download SKILL.mdSave it as .claude/skills/k8s-sandbox-install/SKILL.md (or your agent's skills folder).
name
k8s-sandbox-install
description
Guided install / scale-out of a sandbox Kubernetes cluster for the Lego-RL k8s backend (kubeadm 1.32 + containerd + flannel + ImageVolume, optionally nydus / a shared registry / an isolated dockerd). Probes the target machines for differences (OS, network, disk, pre-existing cluster) and never asks for what it can detect itself; finishes by generating a site.<name>.env wired for the training side. Triggers: install kubernetes, set up a cluster, add a worker node, join worker, new cluster, sandbox cluster deployment.

Sandbox cluster install wizard

You are an install wizard. The goal: stand up a cluster on the user's machines that can run the Lego-RL Kubernetes backend, with versions, features and guardrails aligned to the baseline below.

Core principle: never ask for anything you can probe. The user should usually have to supply exactly one thing — how to reach the nodes over SSH. Everything else (OS, disks, subnets, egress, an existing cluster, shared storage) you determine yourself. Only when a decision is ambiguous or risky do you go back to the user, and then with probe results plus a recommendation, not an open question. Never copy commands blindly: probe first, then decide, at every stage.

Background reading before you start:

  • scripts/lib/site.example.env — every cluster-specific value the training side consumes, and how the site.env layer works.
  • docs/content/docs/run-training/backends.mdx — what the k8s backend expects.
  • docs/content/docs/data-preparation.mdx — the environment-image story (prebuilt registry vs. in-pod inline build), which decides whether this cluster needs a registry at all.

Version baseline (do not change unless the user explicitly asks)

kubeadm/kubelet/kubectl 1.32.13 (ImageVolume needs ≥1.32; 1.31 has a readonly bug and is unusable), containerd 2.2.x, flannel, pause:3.10, CNI plugins ≥v1.5. apt-mark hold all of them.

Stage 0 — the one question, then probe everything else

Ask the user only: how to log into the nodes (IP list + SSH user/password or key, whether root is available). If the current shell's known_hosts, ~/.ssh/config or command history already hint at it, try that first — if it works, you do not even need to ask.

With SSH in hand, probe everything (collect per node, present one table before continuing):

ItemHow to probeAutomatic decision rule
OS / kernel / arch/etc/os-release, uname -rmUbuntu 22.04/24.04 + amd64 → proceed; CentOS/arm64 → list the differences and confirm with the user
Which node is control-planecompare cores / memory / diskdefault to the balanced node, not the one with the largest disk (keep that for builds/storage). State the choice and the reason; change it only if the user objects
Large-disk pathlsblk / df -h for the biggest writable mountone obvious large disk → use <mount>/storage; if the root disk is the largest, warn that images will consume hundreds of GB to TB and ask whether that is acceptable or another disk should be attached
Subnet conflictsip route vs 10.244.0.0/16, 10.96.0.0/12on conflict, switch podSubnet automatically (e.g. 10.245.0.0/16) and update flannel's Network to match — inform, do not ask
Egresscurl -sI --max-time 5 against pkgs.k8s.io / download.docker.com / registry-1.docker.io / ghcr.ioall reachable → proceed; otherwise probe `env
Existing cluster / leftoverskubectl get nodes, systemctl status kubelet, ss -ltn | grep 6443, ls /etc/kubernetes /var/lib/etcdlive cluster → switch to the add-node flow; leftovers → list them, and kubeadm reset always requires user confirmation
Shared storagemount | grep -E 'nfs|alinas|cpfs|gpfs|lustre'present → nydus / hostPath mounts can be enabled; absent → skip nydus, leave hostPath empty
swap / time / hostnameswapon --show, timedatectl, hostnamefix all of these directly (disable swap + fstab, install chrony, lowercase uppercase hostnames) and report afterwards
Usable registryprobe known addresses (already configured under certs.d, or seen in the user's shell history) with curl /v2/list what answers as a recommendation; if none, default to the pure inline-build path (no registry needed) without asking

Optional-component defaults (do not ask; explain in the final report, the user can request more): isolated dockerd = only if the machine already has docker or the user mentioned building images; nydus = only with a shared FS and obtainable binaries; metrics-server = install (harmless); Docker Hub pull secret = only ask for a PAT if private images turn out to be needed.

Stage 1 — per-node preflight (read-only; run everything before reporting)

Work through the Stage 0 table item by item and produce a node × check status table. Resource limits: CPU < 16 warns (work around with kubeadm --ignore-preflight-errors=NumCPU); ports 6443 / 10250 / 2379-2380 / 8472(udp) must be free; nodes must reach each other with ping + nc. Fix what you find — do not enter Stage 2 with known problems.

Stage 2 — per-node base configuration

Make every step idempotent so a re-run is safe:

  1. Write all nodes into /etc/hosts (use a marked block, e.g. # >>> k8s-sandbox-cluster >>>, and delete the old block on re-run). Write the full list on every node so resolution works in both directions. Add any registry alias you detected a need for at the same time.
  2. Kernel modules overlay / br_netfilter + sysctl (bridge-nf-call-iptables, ip_forward)
    • inotify limits (max_user_watches=1048576, max_user_instances=8192, required for high pod density).
  3. Create the large-disk directories: <disk>/containerd (plus optional <disk>/nydus-cache, <disk>/docker).
  4. apt sources + exact-version install + hold: containerd (either the Docker repo's containerd.io=2.2.x or Ubuntu's containerd=2.2.1 — pick one, but keep it identical cluster-wide), kubelet/kubeadm/kubectl=1.32.13, kubernetes-cni.
  5. containerd config (start from containerd config default, then edit — note 2.x emits single-quoted TOML, so sed must match single quotes):
    • root = '<disk>/containerd'
    • SystemdCgroup = true
    • align pause: s|pause:3.10.1|pause:3.10|g
    • write /etc/containerd/certs.d/<host:port>/hosts.toml for each detected registry (add skip_verify = true for a plain-HTTP registry).
  6. Install CNI plugins into /opt/cni/bin (flannel does not bundle them; without them nodes sit at NetworkPluginNotReady).
  7. systemctl restart containerd && systemctl enable containerd kubelet.
  8. Optional nydus: install nydusd / containerd-nydus-grpc + the snapshotter service, and register the proxy plugin. Enable sync_remove GC, and register the unpack platform with the containerd transfer service.
Show full SKILL.md (582 more words)Show less

Stage 3 — control-plane init (master only)

Generate /root/kubeadm-config.yaml, filling IPs / hostnames / podSubnet from the Stage 0 probe results. Key points:

  • apiServer.extraArgs: feature-gates=ImageVolume=true and KubeletConfiguration.featureGates.ImageVolume: true — both sides are required.
  • maxPods derived from the detected core count: 16c → 32; 64c+ → 128–200. Err on the low side.
  • Set controlPlaneEndpoint even for a single master, so a later HA expansion does not need certificates re-signed.
  • Include imageGCHighThresholdPercent: 90 / Low: 80, containerLogMaxSize: 100Mi, and evictionPressureTransitionPeriod: 5m (0s amplifies DiskPressure evictions).
bash
kubeadm config images pull --config=/root/kubeadm-config.yaml   # pull first: surfaces network problems early
kubeadm init --config=/root/kubeadm-config.yaml --upload-certs --ignore-preflight-errors=NumCPU
# save the join command; set up ~/.kube/config; apply flannel
# (if podSubnet changed, edit the flannel yml's Network first)

Stage 4 — worker join + verification

kubeadm join (if the token expired, regenerate with kubeadm token create --print-join-command). After each join, verify ImageVolume: true propagated into /var/lib/kubelet/config.yaml; if not, add it by hand and restart kubelet. Once every node is Ready, a small cluster can drop the master's NoSchedule taint.

Stage 5 — acceptance (all green, or the install is not done)

  1. Basics: kubectl get nodes -o wide all Ready, coredns Running, cross-node pod ping works (flannel VXLAN 8472/udp open).
  2. ImageVolume end to end: a busybox test pod with volumes[].image. A readonly must be true error means the kubelet version is wrong.
  3. Registry trust: crictl pull <registry>/<known-image> from any node. When probing whether an image exists, curl must send a full Accept header including the OCI index type, or you get a false 404.
  4. maxPods took effect: kubectl describe nodes | grep -A1 pods:.
  5. Verify each optional component: nydus (ctr plugins ls | grep nydus plus pulling one nydus image), isolated dockerd (Root Dir on the large disk; the k8s containerd namespace is only k8s.io), pull secret (start a pod from a private image).

Stage 6 — wire it to the training side (generate, do not make the user fill it in)

  1. Copy the master's admin.conf to the training machine (if server: is 127.0.0.1, replace it with the real IP). Check first whether a kubeconfig pointing at the same server already exists and reuse it rather than creating a duplicate.

  2. Generate scripts/lib/site.<name>.env from scripts/lib/site.example.env, filling every value from the probe results and noting where each came from:

    • K8S_KUBECONFIG ← the path from the previous step;
    • HARBOR_OPENSWE_IMAGE_REGISTRY ← a registry detected in Stage 0 and confirmed with a real crictl pull; none → leave empty (inline build is the fallback);
    • HARBOR_NYDUS_MIRROR ← only if nydus / a mirror was installed;
    • HARBOR_HOSTPATH_MOUNTS ← only paths you verified exist with ls on every node, else null;
    • HARBOR_CLUSTER_DNS_IP ← kubectl -n kube-system get svc kube-dns -o jsonpath='{.spec.clusterIP}', needed explicitly only when it is not 10.96.0.10;
    • MODEL_ROOT / NEW_VERL_DIR ← carry over from the existing site.env (these belong to the training machine and do not change with the cluster).

    Select it at run time with SITE_ENV_FILE=scripts/lib/site.<name>.env. Do not overwrite the default site.env — another run may still be using the old cluster.

  3. If egress isolation is on, confirm on every node that HARBOR_NETADMIN_IMAGE is pullable (if it is not, every pod hangs). If it is not, mirror it into the user's registry first.

  4. Health-check with SITE_ENV_FILE=... PREFLIGHT_ONLY=1 against the runner (or /rl:check). Do a 1-node smoke run before a real one.

Hard rules

  • Any kubeadm reset, any edit to an existing /etc/kubernetes, or touching a cluster someone else is running → confirm with the user first.
  • Never apt upgrade. Remind the user afterwards that the relevant packages are held.
  • Never leave a .bak file in /etc/kubernetes/manifests/ — the kubelet loads it as a static pod.
  • Stop and diagnose at the first failing stage; do not skip ahead.
  • Every IP and path in the generated site file must come from this run's probes. Never copy addresses from another user's cluster.

© LegoX, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .claude/plugins/rl-plugin/skills/k8s-sandbox-install of LegoX/Lego-RL.

Open the folder on GitHubat commit 0731c95

Compare with similar skills

K8s Sandbox Install next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

K8s Sandbox Install compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
K8s Sandbox Install this skillLegoX/Lego-RL113—~2.9kAutomated safety check: WarnApache-2.0
Kubeshark Installerkubeshark/kubeshark12k—~3.6kAutomated safety check: NotesApache-2.0
KubeSphere Multi-Tenant Managementkubesphere/kubesphere17k—~3.1kAutomated safety check: PassCustom licence
Sim Helmsimstudioai/sim30k—~2.2kAutomated safety check: PassApache-2.0
Helm Chart ScaffoldingCybereason-Public/owLSM28013 repos~381Automated safety check: PassGPL-2.0
Kubeshark KFL2 Filter Referencekubeshark/kubeshark12k—~3.6kAutomated safety check: PassApache-2.0

Similar skills

  • Kubeshark Installer

    kubeshark/kubeshark

    Installs and configures Kubeshark on a Kubernetes cluster, choosing between the quick CLI path and a Helm install with custom values.

    12k GitHub stars~3.6k tokensUpdated yesterday
    DevOps & CloudAuto-check: notes

  • KubeSphere Multi-Tenant Management

    kubesphere/kubesphere

    Creates and queries KubeSphere users, workspaces and projects and assigns built-in roles, defaulting to least privilege and never deleting anything.

    17k GitHub stars~3.1k tokensUpdated 2 mo ago
    DevOps & CloudAuto-check passed

  • Sim Helm

    simstudioai/sim

    Install, upgrade, and operate the Sim Helm chart on Kubernetes.

    30k GitHub stars~2.2k tokensUpdated today
    DevOps & CloudAuto-check passed

  • Helm Chart Scaffolding

    Cybereason-Public/owLSM

    Comprehensive guidance for creating, organizing, and managing Helm charts for packaging and deploying Kubernetes applications.

    280 GitHub starsUsed in 13 repos~381 tokens
    DevOps & CloudAuto-check passed

  • Kubeshark KFL2 Filter Reference

    kubeshark/kubeshark

    Syntax reference for KFL2, the CEL-based display filter language used to search Kubernetes network traffic captured by Kubeshark, loaded before any filter is written.

    12k GitHub stars~3.6k tokensUpdated yesterday
    DevOps & CloudAuto-check passed

  • KubeSphere ServiceMesh Manager

    kubesphere/kubesphere

    Installs, checks and troubleshoots the KubeSphere ServiceMesh extension (Istio, Kiali, Jaeger), including grayscale release, sidecar injection, topology and tracing issues.

    17k GitHub stars~2.4k tokensUpdated 2 mo ago
    DevOps & CloudAuto-check passed

More from LegoX/Lego-RL

All 11 skills in this repo

  • Lego Rl Config

    LegoX/Lego-RL

    Compose, edit, refactor, and validate Lego-RL train/eval/infer .env configs and reusable scripts/templates modules.

    113 GitHub stars~2.1k tokensUpdated 2 days ago
    Auto-check: notes

  • Check

    LegoX/Lego-RL

    Preflight a Lego-RL config: answer "is it safe to launch this run right now?".

    113 GitHub stars~2.9k tokensUpdated 2 days ago
    Auto-check passed

  • Dashboard

    LegoX/Lego-RL

    Bring up the Lego-RL training dashboard (webui/) on whatever machine you are on, adapting to that box's layout instead of assuming this repo's paths.

    113 GitHub stars~4.2k tokensUpdated 2 days ago
    Auto-check passed

  • Run

    LegoX/Lego-RL

    Preflight and launch a Lego-RL run (train, eval or infer). An agent skill from LegoX/Lego-RL.

    113 GitHub stars~3k tokensUpdated 2 days ago
    Auto-check passed

  • Status

    LegoX/Lego-RL

    Diagnose a Lego-RL run that is already in flight (or just finished): which run is alive, how far it has got, and whether its numbers are healthy.

    113 GitHub stars~3k tokensUpdated 2 days ago
    Auto-check passed

  • Rl Check

    LegoX/Lego-RL

    One-to-one Codex counterpart for Claude /rl:check. An agent skill from LegoX/Lego-RL.

    113 GitHub stars~338 tokensUpdated 2 days ago
    Auto-check passed

Works with

Categories

Questions about K8s Sandbox Install

What does K8s Sandbox Install do?

Guided install / scale-out of a sandbox Kubernetes cluster for the Lego-RL k8s backend (kubeadm 1.32 + containerd + flannel + ImageVolume, optionally nydus / a shared registry / an isolated dockerd). K8s Sandbox Install is an agent skill from LegoX/Lego-RL.32 + containerd + flannel + ImageVolume, optionally nydus / a shared registry / an isolated dockerd).

When should I use K8s Sandbox Install?

K8s Sandbox Install fits situations like: tasks that involve Container orchestration.

How do I install K8s Sandbox Install in Claude Code?

Run `npx skills add LegoX/Lego-RL --skill k8s-sandbox-install -a claude-code`. Or copy the skill folder (.claude/plugins/rl-plugin/skills/k8s-sandbox-install in LegoX/Lego-RL) into .claude/skills/k8s-sandbox-install in your project. Claude Code loads it when a task matches its description.

How do I install K8s Sandbox Install in Codex?

Run `npx skills add LegoX/Lego-RL --skill k8s-sandbox-install -a codex`. Or copy the skill folder (.claude/plugins/rl-plugin/skills/k8s-sandbox-install in LegoX/Lego-RL) into .agents/skills/k8s-sandbox-install in your project. Codex loads it when a task matches its description.

Can I use K8s Sandbox Install in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add LegoX/Lego-RL --skill k8s-sandbox-install -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/k8s-sandbox-install, .gemini/skills/k8s-sandbox-install, .github/skills/k8s-sandbox-install and .opencode/skills/k8s-sandbox-install in your project.

What does K8s Sandbox Install need to run?

Going by SKILL.md and its folder, K8s Sandbox Install needs the command-line tools its instructions call (kubectl, curl and apt). Our summary lists: Docker.

Does K8s Sandbox Install access the network?

SKILL.md contains no URLs. Its commands use curl, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is K8s Sandbox Install safe to install?

Our automated static check of SKILL.md flagged 2 warning(s): mentions a credentials file (ssh keys, cloud or package-manager tokens). Read the flagged lines before installing; the check is not a guarantee either way.

What licence does K8s Sandbox Install use?

K8s Sandbox Install is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does K8s Sandbox Install use?

About 2.9k tokens (SKILL.md is roughly 12k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to K8s Sandbox Install?

Skills that share tags, products or a category with K8s Sandbox Install: Kubeshark Installer (kubeshark/kubeshark, 12k stars), KubeSphere Multi-Tenant Management (kubesphere/kubesphere, 17k stars), Sim Helm (simstudioai/sim, 30k stars) and Helm Chart Scaffolding (Cybereason-Public/owLSM, 280 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains K8s Sandbox Install?

LegoX (a GitHub organization) maintains it in LegoX/Lego-RL, which has 113 GitHub stars. The repository holds 11 skills in this directory. The repository was last updated on October 8, 2026.

Source: LegoX/Lego-RL on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.