The agent runs without administrator rights: it cannot install system packages
or start databases. A task that needs them declares them in the task:
block, and Kadu installs them before the execution starts.
task:
dependencies:
apt: [ffmpeg, poppler-utils]
services: [postgres]
The repository only picks names from a list maintained by Kobana. For a
service, the version, port, user and password come from the list, never from
the repository.
What happens in the execution
- The execution starts and Kadu checks each name against the list. A name
outside the list, or disabled in it, fails the execution before anything is
installed.
- Packages are installed and services start on the execution's own machine,
reachable only from it (
127.0.0.1).
- Each service reaches the skill in an environment variable
(
DEPENDENCY_POSTGRES_URL etc.), with the connection URL ready.
- The timeline shows the "dependencies" step with the time spent, or the
reason for the failure. Only then does the skill start.
Installing counts toward the execution's 60 minutes: declare only what the task
uses.
Rules
| Rule | Detail |
|---|
| Names from the list only | A name outside the list shows in the sync warnings and fails the execution |
| Limits | At most 30 packages and 5 services per task |
| Format | Lists of text; any other key (like npm:) or type discards the whole block, with a warning |
| Absent | dependencies missing from the frontmatter keeps what was stored; dependencies: {} clears it |
| Pairs that cannot coexist | mysql and mariadb (same port), redis and valkey (same port), mysql-client and mariadb-client. Declaring both of a pair fails the execution |
| SQLite | It is a file, not a service: the sqlite3 package is enough |
:::info Why a list
Packages and services are installed with administrator rights, before the skill
runs. The list makes sure only known software goes in, from the official Ubuntu
repository or from official images pinned to an exact version. Even with the
list, Kadu refuses an installation that would give the skill a way to become
administrator of the machine, and the execution fails with the reason.
:::
Available packages
PDF
| Package | What for |
|---|
poppler-utils | Extract text and images, convert pages (pdftotext, pdftoppm, pdfinfo) |
qpdf | Merge, split, rotate, decrypt and repair |
pdftk-java | Merge, split and fill forms (pdftk) |
mupdf-tools | mutool: extract, render and clean |
ghostscript | Render, compress and convert PDF/PostScript |
img2pdf | Images → PDF, lossless |
ocrmypdf | Scanned PDF → searchable PDF (OCR) |
OCR
| Package | What for |
|---|
tesseract-ocr | OCR for images |
tesseract-ocr-por | Portuguese language |
tesseract-ocr-eng | English language |
tesseract-ocr-spa | Spanish language |
Documents (DOC, DOCX, ODT, RTF, PPT)
| Package | What for |
|---|
libreoffice-writer-nogui | DOC/DOCX/ODT: convert and render PDF headless (soffice --headless) |
libreoffice-impress-nogui | PPT/PPTX/ODP: convert and render PDF headless |
pandoc | Convert between Markdown, DOCX, HTML and more |
antiword | DOC (Word 97-2003) → text |
catdoc | Old DOC, XLS and PPT → text (catdoc, xls2csv, catppt) |
docx2txt | DOCX → text |
odt2txt | ODT/ODS → text |
unrtf | RTF → text or HTML |
Spreadsheets and CSV
| Package | What for |
|---|
libreoffice-calc-nogui | XLS/XLSX/ODS: convert and recalculate headless |
gnumeric | ssconvert: XLS/XLSX/ODS/CSV without LibreOffice |
csvkit | csvlook, csvsql, csvjoin, in2csv (XLSX → CSV) |
miller | mlr: filter, aggregate and convert CSV/TSV/JSON |
xlsx2csv | XLSX → CSV |
sqlite3 | SQLite: query CSV and file databases |
Images
| Package | What for |
|---|
imagemagick | Convert, resize and compose images |
graphicsmagick | gm convert/mogrify (ImageMagick alternative) |
libvips-tools | vips: large images with little memory |
webp | WebP (cwebp, dwebp) |
optipng | Lossless PNG optimization |
jpegoptim | JPEG optimization |
pngquant | Lossy PNG compression |
librsvg2-bin | SVG → PNG/PDF (rsvg-convert) |
libimage-exiftool-perl | exiftool: image, PDF and audio metadata |
Audio and video
| Package | What for |
|---|
ffmpeg | Cut, convert and assemble audio and video |
sox | Convert, cut, normalize and apply effects to audio |
libsox-fmt-mp3 | MP3 in sox |
lame | Encode MP3 |
flac | FLAC |
opus-tools | Opus (opusenc, opusdec) |
vorbis-tools | OGG Vorbis (oggenc, oggdec) |
mediainfo | Audio and video metadata |
Files and data
| Package | What for |
|---|
zip | Create ZIP |
unzip | Extract ZIP |
p7zip-full | 7z, and reading RAR and other formats |
xmlstarlet | Query and edit XML (NF-e, CNAB in XML) |
html2text | HTML → text |
yq | Query and convert YAML and XML |
Services and storage
| Package | What for |
|---|
gh | GitHub CLI |
git-lfs | Git LFS |
rclone | Copy and sync files with Google Drive, Dropbox, OneDrive, S3 and others |
s3cmd | S3 and compatible storage |
Database clients
| Package | What for |
|---|
postgresql-client | psql, pg_dump |
mysql-client | mysql, mysqldump (cannot be installed with mariadb-client) |
mariadb-client | mariadb, mariadb-dump (cannot be installed with mysql-client) |
redis-tools | redis-cli |
valkey-tools | valkey-cli |
Fonts and display
| Package | What for |
|---|
fonts-noto-core | Noto fonts (Latin, accents) |
fonts-noto-color-emoji | Color emoji |
fonts-liberation2 | Metric-compatible with Arial, Times and Courier |
fonts-dejavu-core | DejaVu fonts |
xvfb | Virtual display for a browser with a UI |
Available services
| Service | Version | Variable | Value | User / password / database |
|---|
postgres | PostgreSQL 18 | DEPENDENCY_POSTGRES_URL | postgresql://postgres:postgres@127.0.0.1:5432/postgres | postgres / postgres / postgres |
mysql | MySQL 8.4 (LTS) | DEPENDENCY_MYSQL_URL | mysql://root:mysql@127.0.0.1:3306/app | root / mysql / app |
mariadb | MariaDB 11.4 (LTS) | DEPENDENCY_MARIADB_URL | mysql://root:mariadb@127.0.0.1:3306/app | root / mariadb / app |
redis | Redis 7 | DEPENDENCY_REDIS_URL | redis://127.0.0.1:6379 | no password |
valkey | Valkey 8 (Redis protocol) | DEPENDENCY_VALKEY_URL | redis://127.0.0.1:6379 | no password |
The database starts empty on every execution and goes away with it: it is for
temporary work (building data, running an app in development mode), not for
keeping anything between executions.
What is not on the list
| You need | Do this |
|---|
| npm or pip packages, browsers | The skill installs them in its own folder, without administrator rights (npm install -g --prefix "$HOME/.local", npx, pip install --user) |
Slack CLI, Google Cloud CLI (gcloud), Linear | Not in the Ubuntu repository. Install them in the skill's folder, or call the HTTP API with curl |
| AWS CLI | Not in Ubuntu 24.04. For S3, use s3cmd or rclone |
| Google Drive, Dropbox, OneDrive | rclone |
| Another package or database | Ask Kobana support (below) |
Requesting a package or service
Contact Kobana support with the name and what the task needs it for. The
package must be in the official Ubuntu 24.04 repository and must not ship
programs with special permissions; the service needs an official image. Once
added, it is available to the next executions, with no change to the
repository.
Common errors
| Symptom | Cause | Fix |
|---|
| "Outside the allowlist" warning in the sync | Name not on the list, or disabled | Fix the name or request it |
| Execution fails before starting, in the "dependencies" step | Name outside the list, a pair that cannot coexist, or a refused package | Read the reason on the timeline |
dependencies ignored, with a warning | Unknown key or wrong type in the block | Only apt and services, as lists of text |
| Connection to the database refused | Service not declared, or the skill reads another variable | Declare it in services and use the DEPENDENCY_* variable |
| Execution runs out of time | Too many packages | Declare only what the task uses |