sha256:18e215bcfb66a617fa8f731bd2cd385cb1092ea0f5cf21d118ce74e7f97e660f
Last pushed
3 days by mrweiland
Type
Sandbox Kit
Manifest digest
sha256:18e215bcfb66a617fa8f731bd2cd385cb1092ea0f5cf21d118ce74e7f97e660f
schemaVersion: "3"
displayName: MyOrg utvecklarsandlåda
author: MyOrg Platform Team
description: Shell-workload med Claude Code, GitHub CLI och MyOrg:s verktyg (Java/Maven), nätverksregler och kodkonventioner.
sourceUrl: https://github.com/myorg/team-sandbox
version: 1.0.0
licenses:
- Apache-2.0
- GPL-2.0-with-classpath-exception
- MIT
kind: workload
provides:
- [email protected]
- [email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/ca-certificates-java@20240118
- deb/ca-certificates@20250419
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/iputils-ping@20240905
- deb/[email protected]
- deb/[email protected]
- deb/less@668
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- [email protected]
- [email protected]
capabilities:
- group:
capabilities:
- source:
kit: docker.io/docker/sbx-kit-claude-mixin:2.1.314
path: capabilities[0]
type: com.docker.sandbox/network-policy@1
config:
runtime:
allow:
- api.anthropic.com:443
- platform.claude.com:443
- downloads.claude.ai:443
- claude.com:443
- mcp-proxy.anthropic.com:443
- bridge.claudeusercontent.com:443
declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude-mixin:2.1.314
path: capabilities[0]
- group:
description: Anthropic API access (API key or claude.ai OAuth)
optional: true
capabilities:
- source:
kit: docker.io/docker/sbx-kit-claude-mixin:2.1.314
path: capabilities[1]
type: com.docker.sandbox/credential@1
config:
apiKey:
inject:
- domain: api.anthropic.com
format: '%s'
header: x-api-key
- domain: mcp-proxy.anthropic.com
format: '%s'
header: x-api-key
name: ANTHROPIC_API_KEY
oauth:
credentialFile:
path: ~/.claude/.credentials.json
structure:
claudeAiOauth:
accessToken: '{{.AccessToken}}'
expiresAt: '{{.ExpiresAt}}'
refreshToken: '{{.RefreshToken}}'
scopes: '{{.Scopes}}'
primaryApiKey: '{{.PrimaryApiKey}}'
sentinels:
accessToken: sk-ant-oat01-proxy-managed
refreshToken: sk-ant-ort01-proxy-managed
tokenEndpoint:
host: platform.claude.com
path: /v1/oauth/token
phase: runtime
service: anthropic
description: Anthropic API access (API key or claude.ai OAuth)
declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude-mixin:2.1.314
path: capabilities[1]
- declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude-mixin:2.1.314
path: capabilities[2]
type: com.docker.sandbox/volume@1
config:
path: /home/agent/.claude/projects
size: 2g
description: Conversation history; grows without bound, gets the headroom
- declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude-mixin:2.1.314
path: capabilities[3]
type: com.docker.sandbox/volume@1
config:
path: /home/agent/.claude/sessions
size: 512m
description: Per-session state; load-bearing for `claude -c`
- declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude-mixin:2.1.314
path: capabilities[4]
type: com.docker.sandbox/volume@1
config:
path: /home/agent/.claude/todos
size: 512m
description: TodoWrite state
- declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude-mixin:2.1.314
path: capabilities[5]
type: com.docker.sandbox/volume@1
config:
path: /home/agent/.claude/shell-snapshots
size: 512m
description: Bash state snapshots across sessions
- declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude-mixin:2.1.314
path: capabilities[6]
type: com.docker.sandbox/volume@1
config:
path: /home/agent/.claude/statsig
size: 512m
description: Local feature-flag cache
- group:
capabilities:
- source:
kit: docker.io/docker/sbx-kit-claude-mixin:2.1.314
path: capabilities[7]
type: com.docker.sandbox/lifecycle@1
config:
install:
- command: |
set -e
ws="${WORKSPACE_DIR:-/}"
esc=$(printf '%s' "$ws" | sed 's/\\/\\\\/g; s/"/\\"/g; s/\t/\\t/g; s/\r/\\r/g')
projects="\"/\": { \"hasTrustDialogAccepted\": true }"
[ "$ws" = "/" ] || projects="$projects, \"$esc\": { \"hasTrustDialogAccepted\": true }"
printf '%s\n' "{
\"bypassPermissionsModeAccepted\": true,
\"hasCompletedOnboarding\": true,
\"hasSeenAutoDefaultNudge\": true,
\"projects\": { $projects }
}" > /home/agent/.claude.json
chown agent:agent /home/agent/.claude.json
description: Seed Claude bypass and trust flags
env:
- WORKSPACE_DIR
user: "0"
- command: mkdir -p /home/agent/.claude && chown agent:agent /home/agent/.claude
description: Ensure ~/.claude is agent-owned before settings seed
user: "0"
- command: |
set -e
HELPER=''
if [ "${SBX_CRED_ANTHROPIC_MODE:-none}" != none ]; then
HELPER=' "apiKeyHelper": "echo proxy-managed",
'
fi
# Model selection from the create-phase args. The args'
# patterns admit no quote or backslash, so the expanded
# value is safe inside the JSON string. effortLevel accepts
# low/medium/high/xhigh; max and auto persist only through
# CLAUDE_CODE_EFFORT_LEVEL (settings.json rejects them).
model=''
effort=''
MODEL=''
EFFORT=''
ENV_BLOCK=''
[ -z "$model" ] || MODEL=" \"model\": \"$model\",
"
case "$effort" in
'') ;;
max|auto)
ENV_BLOCK=" \"env\": { \"CLAUDE_CODE_EFFORT_LEVEL\": \"$effort\" },
"
;;
*)
EFFORT=" \"effortLevel\": \"$effort\",
"
;;
esac
# Lifecycle hooks for Narwhal (see /usr/local/bin/sbx-claude-hook):
# Stop and StopFailure report a finished turn, Notification the
# moments Claude waits on the user, UserPromptSubmit the prompt
# that names the conversation (Claude Code lists sessions by id
# only). The script never fails, never writes stdout and runs
# async, so a session without the desktop app sees no delay and
# no hook error.
HOOK='{ "type": "command", "command": "/usr/local/bin/sbx-claude-hook claude", "timeout": 10, "async": true }'
HOOKS=" \"hooks\": {
\"Stop\": [ { \"hooks\": [ $HOOK ] } ],
\"StopFailure\": [ { \"hooks\": [ $HOOK ] } ],
\"UserPromptSubmit\": [ { \"hooks\": [ $HOOK ] } ],
\"Notification\": [ { \"matcher\": \"permission_prompt|idle_prompt|elicitation_dialog|elicitation_url_dialog|agent_needs_input\", \"hooks\": [ $HOOK ] } ]
},
"
# The statusLine command is the only place Claude Code exposes
# the live session (model, context window, cost, lines changed);
# sbx-agent-hook forwards it to Narwhal's status bar and prints
# nothing, so no status line is drawn in the terminal. A mixin that
# sets its own statusLine (e.g. claude-sbx-statusline) replaces
# this one and the app's session view goes quiet for that sandbox.
STATUSLINE=" \"statusLine\": { \"type\": \"command\", \"command\": \"/usr/local/bin/sbx-claude-hook claude-status\" },
"
printf '%s' "{
\"themeId\": 1,
\"alwaysThinkingEnabled\": true,
${HELPER}${MODEL}${EFFORT}${ENV_BLOCK}${HOOKS}${STATUSLINE} \"permissions\": { \"defaultMode\": \"bypassPermissions\" },
\"bypassPermissionsModeAccepted\": true,
\"skipDangerousModePermissionPrompt\": true
}
" > /home/agent/.claude/settings.json
description: Seed Claude settings.json from the surfaced auth mode
env:
- SBX_CRED_ANTHROPIC_MODE
user: agent
- command: |
set -e
[ -n "$MCP_GATEWAY_URL" ] || exit 0
claude mcp add mcp-gateway "$MCP_GATEWAY_URL" \
--transport http \
--scope user \
--header "Authorization: Bearer $MCP_SENTINEL_TOKEN_NAME" || true
description: Register the sandbox MCP gateway at install
env:
- MCP_GATEWAY_URL
- MCP_SENTINEL_TOKEN_NAME
user: agent
startup:
- command:
- sh
- -c
- chown -R agent:agent /home/agent/.claude/projects /home/agent/.claude/sessions /home/agent/.claude/todos /home/agent/.claude/shell-snapshots /home/agent/.claude/statsig 2>/dev/null || true
description: Re-own claude session-state volume mount roots to agent
user: "0"
- command: |
set -e
[ -n "$MCP_GATEWAY_URL" ] || exit 0
claude mcp add mcp-gateway "$MCP_GATEWAY_URL" \
--transport http \
--scope user \
--header "Authorization: Bearer $MCP_SENTINEL_TOKEN_NAME" || true
description: Register the sandbox MCP gateway (startup fallback)
env:
- MCP_GATEWAY_URL
- MCP_SENTINEL_TOKEN_NAME
user: agent
declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude-mixin:2.1.314
path: capabilities[7]
- group:
optional: true
capabilities:
- source:
kit: docker.io/docker/sbx-kit-claude-mixin:2.1.314
path: capabilities[8]
type: com.docker.sandbox/agent-skills@1
config:
path: /home/agent/.claude/skills
declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude-mixin:2.1.314
path: capabilities[8]
- group:
optional: true
capabilities:
- source:
kit: docker.io/docker/sbx-kit-claude-mixin:2.1.314
path: capabilities[9]
type: com.docker.sandbox/agent-context@1
config:
contentFile: /usr/share/sandbox/kit/myorg-dev/context.md.parts/0.md
directory: /home/agent/.claude
filename: CLAUDE.md
declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude-mixin:2.1.314
path: capabilities[9]
- group:
optional: true
capabilities:
- source:
kit: docker.io/docker/sbx-kit-claude-mixin:2.1.314
path: capabilities[10]
type: com.docker.sandbox/agent-context@2
config:
content: |
Claude Code is installed at `/usr/local/bin/claude`. Run `claude` for an
interactive session or `claude -p "<prompt>"` for a one-shot answer.
Authentication is proxy-mediated: `ANTHROPIC_API_KEY` in this container is
a sentinel — the sandbox proxy substitutes the real key bound on the host
(`sbx secret set anthropic`) on requests to Anthropic's APIs. Without a
bound key, `claude` will ask you to log in.
directory: /home/agent/.claude
filename: CLAUDE.md
declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude-mixin:2.1.314
path: capabilities[10]
- group:
capabilities:
- source:
kit: docker.io/docker/sbx-kit-gh:2.103.2
path: capabilities[0]
type: com.docker.sandbox/network-policy@2
config:
runtime:
allow:
- github.com
- hosts:
- api.github.com
methods:
- GET
- HEAD
- POST
- PATCH
- PUT
- DELETE
- hosts:
- uploads.github.com
methods:
- POST
- PUT
deny:
- hosts:
- api.github.com
methods:
- DELETE
paths:
- /repos/**
declarationBlocks:
- "1:0"
source:
kit: docker.io/docker/sbx-kit-gh:2.103.2
path: capabilities[0]
- group:
description: GitHub API access for gh
optional: true
capabilities:
- source:
kit: docker.io/docker/sbx-kit-gh:2.103.2
path: capabilities[1]
type: com.docker.sandbox/credential@1
config:
apiKey:
inject:
- domain: api.github.com
format: Bearer %s
header: Authorization
- domain: uploads.github.com
format: Bearer %s
header: Authorization
- domain: github.com
format: Bearer %s
header: Authorization
name: GH_TOKEN
proxyManaged: true
phase:
- runtime
service: github
description: GitHub API access for gh
declarationBlocks:
- "1:0"
source:
kit: docker.io/docker/sbx-kit-gh:2.103.2
path: capabilities[1]
- group:
optional: true
capabilities:
- source:
kit: docker.io/docker/sbx-kit-gh:2.103.2
path: capabilities[2]
type: com.docker.sandbox/agent-context@1
config:
contentFile: /usr/share/sandbox/kit/myorg-dev/context.md.parts/1.md
declarationBlocks:
- "1:0"
source:
kit: docker.io/docker/sbx-kit-gh:2.103.2
path: capabilities[2]
- group:
optional: true
capabilities:
- source:
kit: docker.io/docker/sbx-kit-gh:2.103.2
path: capabilities[3]
type: com.docker.sandbox/agent-context@2
config:
content: |
# GitHub CLI
`gh` is on PATH at `/usr/local/bin/gh`.
- Authentication is proxy-managed: `GH_TOKEN` is set to a sentinel and the
real credential is injected on requests to github.com, api.github.com,
and uploads.github.com. Never print or copy the token; it is not the
real value anyway.
- Do not run `gh auth login` — authentication already works.
- Prefer `gh` over raw git for GitHub operations: `gh pr create`,
`gh issue list`, `gh run watch`, `gh api` for anything without a
dedicated subcommand.
declarationBlocks:
- "1:0"
source:
kit: docker.io/docker/sbx-kit-gh:2.103.2
path: capabilities[3]
- group:
capabilities:
- source:
kit: docker.io/docker/sbx-kit-shell:1.0.0
path: capabilities[0]
type: com.docker.sandbox/sbx@1
declarationBlocks:
- "2:0"
source:
kit: docker.io/docker/sbx-kit-shell:1.0.0
path: capabilities[0]
- group:
capabilities:
- source:
kit: docker.io/docker/sbx-kit-shell:1.0.0
path: capabilities[1]
type: com.docker.sandbox/network-policy@1
config:
runtime:
allow:
- deb.debian.org
- dhi.io
declarationBlocks:
- "2:0"
source:
kit: docker.io/docker/sbx-kit-shell:1.0.0
path: capabilities[1]
- group:
optional: true
capabilities:
- source:
kit: docker.io/docker/sbx-kit-shell:1.0.0
path: capabilities[2]
type: com.docker.sandbox/agent-context@1
config:
contentFile: /usr/share/sandbox/kit/myorg-dev/context.md.parts/2.md
filename: AGENTS.md
declarationBlocks:
- "2:0"
source:
kit: docker.io/docker/sbx-kit-shell:1.0.0
path: capabilities[2]
- group:
optional: true
capabilities:
- source:
kit: docker.io/docker/sbx-kit-shell:1.0.0
path: capabilities[3]
type: com.docker.sandbox/agent-context@2
config:
content: |
This is a plain shell sandbox on the shell-docker template: bash,
git, apt, Docker (compose/buildx), curl, gh, jq, make, gcc,
Python 3, and Node/npm. Install more with apt; composed kits list
their own capabilities below.
filename: AGENTS.md
declarationBlocks:
- "2:0"
source:
kit: docker.io/docker/sbx-kit-shell:1.0.0
path: capabilities[3]
- group:
capabilities:
- source:
kit: docker.io/mrweiland/myorg-tools:1.0.0
path: capabilities[0]
type: com.docker.sandbox/network-policy@2
config:
runtime:
allow:
- repo.maven.apache.org
- repo1.maven.org
- nexus.myorg.example
deny:
- hosts:
- nexus.myorg.example
methods:
- PUT
- POST
- DELETE
declarationBlocks:
- "3:0"
source:
kit: docker.io/mrweiland/myorg-tools:1.0.0
path: capabilities[0]
- group:
optional: true
capabilities:
- source:
kit: docker.io/mrweiland/myorg-tools:1.0.0
path: capabilities[1]
type: com.docker.sandbox/resources@1
config:
cpu: 4
memory: 8g
declarationBlocks:
- "3:0"
source:
kit: docker.io/mrweiland/myorg-tools:1.0.0
path: capabilities[1]
- group:
name: Maven cache
description: Behåll ~/.m2/repository mellan omstarter
optional: true
capabilities:
- source:
kit: docker.io/mrweiland/myorg-tools:1.0.0
path: capabilities[2].group.capabilities[0]
type: com.docker.sandbox/volume@1
config:
path: /home/agent/.m2/repository
size: 10g
- source:
kit: docker.io/mrweiland/myorg-tools:1.0.0
path: capabilities[2].group.capabilities[1]
type: com.docker.sandbox/lifecycle@1
config:
files:
- content: |
<settings>
<localRepository>/home/agent/.m2/repository</localRepository>
<!-- BYT UT: mirror mot intern Nexus/Artifactory vid behov -->
</settings>
overwrite: false
path: /home/agent/.m2/settings.xml
source:
kit: docker.io/mrweiland/myorg-tools:1.0.0
path: capabilities[2]
- group:
optional: true
capabilities:
- source:
kit: docker.io/mrweiland/myorg-tools:1.0.0
path: capabilities[3]
type: com.docker.sandbox/agent-context@1
config:
contentFile: /usr/share/sandbox/kit/myorg-dev/context.md.parts/3.md
declarationBlocks:
- "3:0"
source:
kit: docker.io/mrweiland/myorg-tools:1.0.0
path: capabilities[3]
- group:
optional: true
capabilities:
- source:
kit: docker.io/mrweiland/myorg-tools:1.0.0
path: capabilities[4]
type: com.docker.sandbox/agent-context@2
config:
content: |
## MyOrg dev tools
Den här sandlådan har MyOrg:s standardverktyg:
- `java` / `javac` — Temurin JDK (version i kit-arg `jdkVersion`)
- `mvn` — Apache Maven; lokal cache i `~/.m2/repository`
Konventioner:
- Bygg och testa med `mvn -B verify` innan du föreslår en ändring.
- Skapa pull requests i stället för att pusha till `main`.
- Nätverket är begränsat till godkända domäner. Om en nedladdning
nekas (HTTP 403 från proxyn) ska du inte försöka kringgå det —
be användaren lägga till domänen i kit eller org-policy.
declarationBlocks:
- "3:0"
source:
kit: docker.io/mrweiland/myorg-tools:1.0.0
path: capabilities[4]
- group:
optional: true
capabilities:
- source:
kit: the set descriptor
path: capabilities[0]
type: com.docker.sandbox/agent-context@1
config:
contentFile: /usr/share/sandbox/kit/myorg-dev/context.md.parts/4.md
declarationBlocks:
- "4:0"
source:
kit: the set descriptor
path: capabilities[0]
- group:
optional: true
capabilities:
- source:
kit: the set descriptor
path: capabilities[1]
type: com.docker.sandbox/agent-context@2
config:
content: |
# MyOrg utvecklarsandlåda
Du kör i MyOrg:s standardsandlåda. Ingående kits och deras källor
finns under `/usr/share/sandbox/kit/`.
- Arbeta i en feature-branch och öppna PR med `gh pr create`.
- Hemligheter finns aldrig i sandlådan; proxyn injicerar dem.
Kör inte `gh auth login` och skriv aldrig ut tokens.
declarationBlocks:
- "4:0"
source:
kit: the set descriptor
path: capabilities[1]
args:
registry:
default: docker.io/mrweiland
description: Registry-namespace där myorg-tools är publicerad
pattern: ^[a-z0-9][a-z0-9._/:-]*$
buildArg: KIT_REGISTRY
kits:
- ref: docker.io/docker/sbx-kit-shell:1.0.0
digest: sha256:a72c2ead8a2ab26ac552e4578ea0e23b5e777e81e8a90108e676be09cffa69a4
- ref: docker.io/docker/sbx-kit-claude-mixin:2.1.314
digest: sha256:23c168d27d2a4779163bd2d7427e2ab6ce45adab5f99b2dd6da9cb6f2991cbbe
- ref: docker.io/docker/sbx-kit-gh:2.103.2
digest: sha256:2af919e2a6782f3aa5aa15711d0dadc08088b529f07df5d7005e3271e97da1cb
- ref: docker.io/mrweiland/myorg-tools:1.0.0
digest: sha256:91596fcf5102012689fe9e344d33b94decb7ea17dc28889192713ec16da19981