Goose CLI Agent AI Agents · Goose v1.54.0 Launch on AWS

Configuration¶

This page shows where Goose's files live on the instance, how to give Goose your provider key safely, and how to set defaults for your own work.

Where things live¶

Path	What it is
`/usr/local/bin/goose`	The `goose` command, a link to `/opt/goose/bin/goose`.
`~/.config/goose/config.yaml`	Your Goose settings, as the `ubuntu` user. Created by `goose configure`.
`~/.config/goose/secrets.yaml`	Your provider keys, when `GOOSE_DISABLE_KEYRING=1` is set.
`~/.local/state/goose/logs`	Goose logs.
`/etc/goose/config.yaml.example`	An example config, written on first boot.
`/etc/goose/secrets`	An optional place for root-managed material, `root:goose`, mode 0750. The `ubuntu` user cannot read it.
`/var/lib/goose/workspace`	The sample workspace, owned by `ubuntu`, mode 0750.
`/opt/sushi/docs/README.md`	The image notes.

First boot creates the ubuntu user's ~/.config/goose, ~/.local/share/goose and ~/.local/state/goose directories with mode 0700. It writes the example config only if it does not exist yet.

Provider keys¶

The image contains no provider keys. Choose one of these, as the ubuntu user:

goose configure, with GOOSE_DISABLE_KEYRING=1 set, as in Getting started. The key is stored in ~/.config/goose/secrets.yaml.
Environment variables in a private shell, for example:
```
read -rs OPENAI_API_KEY && export OPENAI_API_KEY
export GOOSE_PROVIDER=openai
export GOOSE_MODEL=<model-name>
```
read -s keeps the key off the screen and out of your shell history. Use ANTHROPIC_API_KEY and GOOSE_PROVIDER=anthropic for Anthropic.

Goose ignores provider keys in config.yaml, so never put them there. Never put keys in EC2 user data.

The example config¶

/etc/goose/config.yaml.example shows the settings the image suggests. It contains no keys:

GOOSE_MODE: auto
GOOSE_TELEMETRY_ENABLED: false

extensions:
  developer:
    bundled: true
    enabled: true
    name: developer
    type: builtin
    timeout: 300

Copy the parts you want into ~/.config/goose/config.yaml. The file also has commented lines that show how a configured provider looks.

GOOSE_TELEMETRY_ENABLED: false turns off Goose's usage telemetry.
GOOSE_MODE: auto lets Goose edit files and run commands without asking you first. Choose a stricter mode if you want to approve actions. The Goose documentation describes the modes.

Goose runs real commands

In auto mode Goose acts on everything the ubuntu user can reach, including sudo. Keep secrets you do not want it to read off the instance, and give the instance role only the AWS permissions a task really needs.

Work on your own repositories¶

Goose works in the directory you start it from. Clone your project as the ubuntu user and run Goose there:

cd ~
git clone <repository-url>
cd <repository>
goose session --with-builtin developer

Last updated October 13, 2026 · Suggest an improvement