sbx/docker-agent-kit:latest

schemaVersion: "2"
kind: sandbox
name: docker-agent
version: 1.0.0
displayName: Docker Agent
description: Docker Agent, Docker's multi-provider agentic coding CLI.
sandbox:
    image: docker.io/sbx/docker-agent-image:latest
    entrypoint:
        - docker-agent
    command:
        default:
            - run
            - --yolo
            - --agent-picker
        interactive:
            - run
            - --yolo
            - --agent-picker
agentInstructions:
    filename: AGENTS.md
permissions:
    network:
        allow:
            - api.anthropic.com
            - claude.ai
            - console.anthropic.com
            - api.business.githubcopilot.com
            - api.enterprise.githubcopilot.com
            - api.github.com
            - api.githubcopilot.com
            - api.individual.githubcopilot.com
            - copilot.github.com
            - github.com
            - raw.githubusercontent.com
            - aiplatform.googleapis.com
            - generativelanguage.googleapis.com
            - oauth2.googleapis.com
            - vertexai.googleapis.com
            - api.openai.com
            - openrouter.ai
            - objects.githubusercontent.com
            - models.dev
            - archive.ubuntu.com
            - security.ubuntu.com
            - ports.ubuntu.com
            - download.docker.com
credentials:
    - service: anthropic
      apiKey:
        name: ANTHROPIC_API_KEY
        proxyManaged: true
        inject:
            - domain: api.anthropic.com
              header: x-api-key
              format: '%s'
            - domain: claude.ai
              header: x-api-key
              format: '%s'
            - domain: console.anthropic.com
              header: x-api-key
              format: '%s'
    - service: github
      apiKey:
        name: ""
        inject:
            - domain: api.business.githubcopilot.com
              header: Authorization
              format: Bearer %s
            - domain: api.enterprise.githubcopilot.com
              header: Authorization
              format: Bearer %s
            - domain: api.github.com
              header: Authorization
              format: Bearer %s
            - domain: api.githubcopilot.com
              header: Authorization
              format: Bearer %s
            - domain: api.individual.githubcopilot.com
              header: Authorization
              format: Bearer %s
            - domain: copilot.github.com
              header: Authorization
              format: Bearer %s
            - domain: github.com
              header: Authorization
              format: Bearer %s
            - domain: raw.githubusercontent.com
              header: Authorization
              format: Bearer %s
    - service: google
      apiKey:
        name: GOOGLE_API_KEY
        proxyManaged: true
        inject:
            - domain: aiplatform.googleapis.com
              header: x-goog-api-key
              format: '%s'
            - domain: generativelanguage.googleapis.com
              header: x-goog-api-key
              format: '%s'
            - domain: oauth2.googleapis.com
              header: x-goog-api-key
              format: '%s'
            - domain: vertexai.googleapis.com
              header: x-goog-api-key
              format: '%s'
    - service: mistral
      apiKey:
        name: MISTRAL_API_KEY
        proxyManaged: true
    - service: nebius
      apiKey:
        name: NEBIUS_API_KEY
        proxyManaged: true
    - service: openai
      apiKey:
        name: OPENAI_API_KEY
        proxyManaged: true
        inject:
            - domain: api.openai.com
              header: Authorization
              format: Bearer %s
    - service: openrouter
      apiKey:
        name: OPENROUTER_API_KEY
        proxyManaged: true
        inject:
            - domain: openrouter.ai
              header: Authorization
              format: Bearer %s
    - service: xai
      apiKey:
        name: XAI_API_KEY
        proxyManaged: true
environment:
    variables:
        COLORTERM: truecolor
        LANG: en_US.UTF-8
        TELEMETRY_ENABLED: "false"
        TERM: xterm-256color
setup:
    install:
        - command: |
            set -eu
            link=/usr/local/bin/docker-agent
            target=/opt/docker-agent/bin/docker-agent

            if [ ! -x "$target" ] && [ -x "$link" ]; then
              install -d -o agent -g agent /opt/docker-agent/bin
              install -o agent -g agent -m 0755 "$link" "$target"
            fi
            [ -x "$target" ] && ln -sf "$target" "$link"
          user: root
          description: Keep docker-agent on an agent-writable path so self-update works
    startup:
        - command:
            - sh
            - -c
            - '{ command -v apt-get && apt-get update -qq -y || true; } >/dev/null 2>&1 </dev/null &'
          user: root
          description: Update apt package cache in background