sha256:b0f79b5f9177f0a6ede7e5fa2e2cdde54f85c5dfa0d6b13193dc1a3a970dd99e
Last pushed
about 1 month by cdupuis
Type
Sandbox Kit
Manifest digest
sha256:b0f79b5f9177f0a6ede7e5fa2e2cdde54f85c5dfa0d6b13193dc1a3a970dd99e
schemaVersion: "3"
displayName: Codex over ACP
author: Docker, Inc.
description: 'A sandbox an ACP client can drive: a shell base, Codex CLI, and the Agent Client Protocol adapter that fronts it — published as one kit. The same three kits compose by hand; this exists so an editor can be pointed at one reference instead of three that have to agree.'
sourceUrl: https://github.com/docker/sandbox-kit-spec
version: 1.0.1
licenses:
- Apache-2.0
kind: workload
provides:
- [email protected]
- [email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/ca-certificates-java@20240118
- deb/ca-certificates@20250419
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/iputils-ping@20240905
- deb/[email protected]
- deb/[email protected]
- deb/less@668
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
capabilities:
- type: com.docker.sandbox/network-policy@1
config:
runtime:
allow:
- api.openai.com:443
- openai.com:443
- auth.openai.com:443
- chatgpt.com:443
- files.openai.com:443
- registry.npmjs.org:443
- releases.openai.com:443
- api.github.com:443
- github.com:443
- release-assets.githubusercontent.com:443
- codeload.github.com:443
- deb.debian.org
- dhi.io
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: api.openai.com
format: Bearer %s
header: Authorization
- domain: openai.com
format: Bearer %s
header: Authorization
name: OPENAI_API_KEY
proxyManaged: true
oauth:
resourceHosts:
- chatgpt.com
sentinels:
accessToken: oai-oat01-proxy-managed
refreshToken: oai-ort01-proxy-managed
tokenEndpoint:
host: auth.openai.com
path: /oauth/token
phase: runtime
service: openai
description: OpenAI API access (API key or ChatGPT OAuth)
- type: com.docker.sandbox/agent-skills@1
optional: true
config:
path: /home/agent/.agents/skills
- type: com.docker.sandbox/sbx@1
- type: com.docker.sandbox/lifecycle@1
config:
install:
- command:
- sh
- -c
- |
set -e
mkdir -p /home/agent/.codex /home/agent/.agents
MODE="${SBX_CRED_OPENAI_MODE:-none}"
cat > /home/agent/.codex/config.toml << 'EOF'
# Codex configuration for Docker sandbox
# This configuration enables "yolo mode" - no approvals, full access
approval_policy = "never"
sandbox_mode = "danger-full-access"
mcp_oauth_credentials_store = "file"
EOF
# Model selection from the create-phase args. These are
# top-level keys, so they must land here, before the
# model_providers and projects tables below would capture
# them. The args' patterns admit no quote or backslash, so
# the expanded value is safe inside the TOML string.
model=''
effort=''
[ -z "$model" ] || printf 'model = "%s"\n' "$model" >> /home/agent/.codex/config.toml
[ -z "$effort" ] || printf 'model_reasoning_effort = "%s"\n' "$effort" >> /home/agent/.codex/config.toml
# Managed modes must not let remote clients replace the proxy
# placeholder with sandbox-local ChatGPT OAuth. None mode
# deliberately permits login.
case "$MODE" in
oauth|apikey)
cat >> /home/agent/.codex/config.toml << 'EOF'
forced_login_method = "api"
EOF
;;
esac
if [ "$MODE" = oauth ]; then
cat >> /home/agent/.codex/config.toml << 'EOF'
model_provider = "sandboxd"
[model_providers.sandboxd]
name = "Sandbox Proxy"
base_url = "https://chatgpt.com/backend-api/codex"
experimental_bearer_token = "oai-oat01-proxy-managed"
requires_openai_auth = false
EOF
fi
# Pre-trust the workspace so codex skips its "do you trust this
# directory" onboarding — the v2 kit skipped it via its
# --dangerously-bypass-approvals-and-sandbox entrypoint, which a
# mixin (plain `codex` from the base shell) doesn't have. MUST
# stay after every top-level key append: [projects."…"] opens a
# TOML table, and any key appended after it would silently land
# inside that table (which is exactly how model_provider once
# vanished, sending codex to api.openai.com with a ChatGPT
# token and a scopes 401).
ws="${WORKSPACE_DIR:-/home/agent/workspace}"
esc=$(printf '%s' "$ws" | sed 's/\\/\\\\/g; s/"/\\"/g')
cat >> /home/agent/.codex/config.toml <<EOF
[projects."$esc"]
trust_level = "trusted"
EOF
case "$MODE" in
oauth|apikey)
cat > /home/agent/.codex/auth.json << 'EOF'
{
"OPENAI_API_KEY": "proxy-managed"
}
EOF
;;
*)
rm -f /home/agent/.codex/auth.json
;;
esac
description: Seed Codex config/auth from SBX_CRED_OPENAI_MODE
env:
- SBX_CRED_OPENAI_MODE
- WORKSPACE_DIR
user: agent
startup:
- command:
- sh
- -c
- |
set -e
[ -n "$MCP_GATEWAY_URL" ] || exit 0
cfg="$HOME/.codex/config.toml"
touch "$cfg"
grep -q "^\[mcp_servers.mcp-gateway\]" "$cfg" && exit 0
esc() { printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'; }
url=$(esc "$MCP_GATEWAY_URL")
auth=$(esc "$MCP_SENTINEL_TOKEN_NAME")
# Codex's grammar for a streamable HTTP server: the transport
# is implied by `url` (a `command` would make it stdio; there
# is no `type` key), and static headers go in `http_headers`.
# A `[...headers]` sub-table is not read, so the gateway
# would be reached without its bearer token and codex would
# warn about both keys at startup.
cat >> "$cfg" <<EOF
[mcp_servers.mcp-gateway]
url = "$url"
http_headers = { Authorization = "Bearer $auth" }
EOF
description: Register the sandbox MCP gateway in ~/.codex/config.toml
env:
- MCP_GATEWAY_URL
- MCP_SENTINEL_TOKEN_NAME
user: agent
- type: com.docker.sandbox/agent-context@1
config:
contentFile: /usr/share/sandbox/kit/codex-acp-set/context.md
filename: AGENTS.md
args:
registry:
default: docker.io/docker
description: Registry namespace the listed kits were pushed to
pattern: ^[a-z0-9][a-z0-9._/:-]*$
buildArg: KIT_REGISTRY
kits:
- ref: docker.io/docker/sbx-kit-shell:1.0.0
digest: sha256:367c9a4b3fd550f777e1d57cc53550afb4a1385055d79111acf6f996272ff6de
- ref: docker.io/docker/sbx-kit-codex-mixin:0.158.0
digest: sha256:30a94b1e45029c81343962c6cd4189fac43c953a2864cc419fc2205888b632f9
- ref: docker.io/docker/sbx-kit-codex-acp:2.0.0
digest: sha256:274fbf58670a9268cd8df05c1d5c8e61ca26c805e9665c2467e0d158c8660625