Credentials. Credentials in environment variables or a .env file can leak through CI logs or shell history, so store them in your pipeline secret manager.
Who it is forA developer or CI maintainer who wants an agent task to run from a script or pipeline.
The problemThe Web UI needs a browser and a person to log in, which does not suit scripted or batch work.
The outcomeA headless DSH run that reads provider credentials from environment variables or a .env file and exits after the task.
What you need first
- Docker with Compose, or Rootless Podman 4.5 with podman-compose 1.6.0 or newer
- A local project directory to mount as the workspace, or leave the default named volume
- Model provider credentials to enter in the Settings page or supply as environment variables
- A Kubernetes cluster and Helm for the chart deployment
Steps
- Set the provider credentials as environment variables or in a
.envfile, since headless mode reads only those and not saved keys. - Start the container from the image with the workspace mounted and a shell available. (inferred, check the README)
- Run
dsh --profile headlessinside the container for the one-shot or automated task. - Capture the exit code and output and check that the task result is in the mounted workspace. (inferred, check the README)
- Run a small test task before adding it to a pipeline.
Prompt for your agent
Using the image from runzhliu/deepseek-harness-docker, run `dsh --profile headless` against the workspace <workspace-path> with provider credentials from environment variables. Expected output: a completed task with a zero exit code and changed files in the workspace. Verify that no saved credential file was needed for the run.
Caveat. The README says sandbox behavior depends on the target host, so validate one real shell or file tool call on the target environment before relying on headless runs.
Use this in your AI agent
Ask your agent
Using the Deduped MCP, get the setup steps for runzhliu/deepseek-harness-docker and "Run DeepSeek Harness headless for batch and CI jobs"
Add Deduped to Claude Code once
claude mcp add --transport http deduped https://dedupedai.com/mcp
Every Monday: the 5 hottest repos and exactly how to use them. Free, one email a week, unsubscribe anytime.
Get them freeShare: X LinkedIn Hacker News Email Copy link
Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer