Skip to main content
Agent VMs use a two-layer image:
  1. Platform base: Debian 12, Git, Node.js, Claude Code, Codex CLI, gh CLI. Maintained by Murmur.
  2. Your toolchain: Go, Python, Docker, Chrome, internal SDKs. Built by baking a recipe on top of the base.
Your workspace references an image by name via the image_ref field.

​
How images are created

Images are produced by the bake process. You define a recipe (base image + provisioning script), then run murmur bake. It executes immediately under your own authority, or stages an executable change-request action for review with --propose. The platform creates a scratch VM, runs your script, snapshots the result, and registers the image. Images are bound to placements: a GCE image baked in one project is not visible from another. When you create a customer placement, you re-bake your recipes so the images exist in your cloud account.

​
Immutability

Baked images are immutable. You cannot edit one after it is created. To change what’s installed, update your recipe and re-bake. List existing images with murmur get image.

​
Identifying an image from inside a VM

An image baked from a recipe records its own build at /etc/murmur/baked-image.json: the recipe and recipe version it came from, the hash of the bake inputs, the cloud image name, and when the bake ran. Any user on the VM can read it with no network access, which makes it the quickest answer to “what is this machine running?”; see identifying the image from inside a VM.

​
Automatic image updates

Murmur can rebuild an image when an agent reports a defect such as a missing tool, unavailable command, or outdated package. The fix changes the recipe used to bake the image. See automatic recipe updates for how the service works and how to make it propose changes for review instead of applying them.