Add Knowledge Worker Agent to your own workspace image

Last published : Nov 09, 2026
This guide shows you how to copy Knowledge Worker Agent into your own workspace image, so users get it alongside the tools your image already has.
Knowledge Worker Agent is a single program at /usr/bin/knowledge-worker-agent, with no shared libraries and nothing else to install. You copy it out of the Knowledge Worker Agent image in a build stage, so nothing is copied to your computer.
Related information
Administer Knowledge Worker Agent

Before you start

You need:
  • Docker.
  • The Citrix SecurSpaces™ installer, strongnetwork/strong_installer, or sds-cli installed directly. It gets you access to the image registry.
  • Your own workspace image to build on.

Sign in to the image registry

The Knowledge Worker Agent image is in Google Artifact Registry, at europe-docker.pkg.dev. The installer gets a short-lived token tied to your license, so there's no service account key to manage.
  1. Get a token. The installer runs as a container, with your current folder mounted at /strong-network/shared:
    docker run -it --rm \
      -v ${PWD}:/strong-network/shared \
      strongnetwork/strong_installer:${VERSION} \
      fetch-access-token --domain <your-platform-domain>
    If you installed sds-cli directly, run sds-cli fetch-access-token --domain <your-platform-domain> instead. Run either one without arguments to see the CLI's help.
    The token is printed, and is valid for one hour. Run the command again when it expires.
  2. Sign in to the registry with the user name oauth2accesstoken:
    echo "<access-token>" | docker login -u oauth2accesstoken --password-stdin europe-docker.pkg.dev
    With skopeo, which sds-cli uses itself, the command is the same with skopeo login in place of docker login.
  3. Pull the image, to check that you're signed in:
    docker pull europe-docker.pkg.dev/strong-network-release/images/chat:2.0.2

Copy Knowledge Worker Agent into your image

Add a build stage that copies the program out of the Knowledge Worker Agent image:
# --- Knowledge Worker Agent ---
FROM europe-docker.pkg.dev/strong-network-release/images/chat:2.0.2 AS chat

# --- Your workspace image ---
FROM strongnetwork/cloud_editor_generic:2.3.11

USER root
COPY --from=chat /usr/bin/knowledge-worker-agent /usr/bin/knowledge-worker-agent

USER 1000
ENTRYPOINT ["/usr/bin/knowledge-worker-agent"]
Replace the second FROM with your own image, and build it:
docker build -t my-workspace:latest .
The program includes a copy of opencode. At startup, Knowledge Worker Agent installs the opencode version it's pinned to from the npm registry, registry.npmjs.org. If the workspace can't reach the registry, it uses its own copy, so it also works in a workspace with no internet access.

Build central configuration into the image

To give every workspace from the image the same configuration, without a configuration repository to reach, copy the configuration into the image, and point Knowledge Worker Agent at it. A folder path is read in place, with no clone and no network access at startup.
Add these lines to the image stage, before USER 1000:
COPY sds-config/ /usr/share/sds/config/

ENV KWA_CENTRAL_CONFIG=true
ENV KWA_PROJECT_ID=default
ENV KWA_CONFIG_REPO_URL=/usr/share/sds/config
Build the image from a folder that contains sds-config/, laid out like a configuration repository. KWA_PROJECT_ID must match a project in its assignment.jsonc. For what goes in it, see Set up central configuration and Configuration repository.
A configuration built into the image changes only when you build the image again.

Give users access

The image starts nothing on its own. To start Knowledge Worker Agent and make it available to users, add a custom access item to the workspace or template, with Command set to /usr/bin/knowledge-worker-agent and Open Port set to 8765, or to KWA_PORT if you set it. For the steps, see Give users access to Knowledge Worker Agent.