sha256:ee09938e55afd62d21a860264640e8715b4265c058c8e4bd89cd4c36d2d7f952
Last pushed
2 days by mrweiland
Type
Sandbox Kit
Manifest digest
sha256:ee09938e55afd62d21a860264640e8715b4265c058c8e4bd89cd4c36d2d7f952
schemaVersion: "3"
displayName: MyOrg utvecklarsandlåda
author: MyOrg Platform Team
description: Claude Code-workload med GitHub CLI och MyOrg:s verktyg (Java/Maven, .NET), nätverksregler och kodkonventioner.
sourceUrl: https://github.com/myorg/team-sandbox
version: 1.2.1
licenses:
- Apache-2.0
- GPL-2.0-with-classpath-exception
- MIT
- SEE LICENSE IN https://github.com/anthropics/claude-code/blob/main/LICENSE.md
kind: workload
provides:
- [email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/ca-certificates-java@20240118
- deb/ca-certificates@20250419
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/iputils-ping@20240905
- deb/[email protected]
- deb/[email protected]
- deb/less@668
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
capabilities:
- group:
capabilities:
- source:
kit: docker.io/docker/sbx-kit-claude:2.1.316
path: capabilities[0]
type: com.docker.sandbox/sbx@1
declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude:2.1.316
path: capabilities[0]
- group:
capabilities:
- source:
kit: docker.io/docker/sbx-kit-claude:2.1.316
path: capabilities[1]
type: com.docker.sandbox/network-policy@1
config:
runtime:
allow:
- api.anthropic.com:443
- platform.claude.com:443
- downloads.claude.ai:443
- claude.com:443
- mcp-proxy.anthropic.com:443
- bridge.claudeusercontent.com:443
declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude:2.1.316
path: capabilities[1]
- group:
name: Anthropic access
description: Anthropic API access (API key or claude.ai OAuth)
optional: true
capabilities:
- source:
kit: docker.io/docker/sbx-kit-claude:2.1.316
path: capabilities[2]
type: com.docker.sandbox/credential@1
name: Anthropic access
config:
apiKey:
inject:
- domain: api.anthropic.com
format: '%s'
header: x-api-key
- domain: mcp-proxy.anthropic.com
format: '%s'
header: x-api-key
name: ANTHROPIC_API_KEY
oauth:
credentialFile:
path: ~/.claude/.credentials.json
structure:
claudeAiOauth:
accessToken: '{{.AccessToken}}'
expiresAt: '{{.ExpiresAt}}'
refreshToken: '{{.RefreshToken}}'
scopes: '{{.Scopes}}'
primaryApiKey: '{{.PrimaryApiKey}}'
sentinels:
accessToken: sk-ant-oat01-proxy-managed
refreshToken: sk-ant-ort01-proxy-managed
tokenEndpoint:
host: platform.claude.com
path: /v1/oauth/token
phase: runtime
service: anthropic
description: Anthropic API access (API key or claude.ai OAuth)
declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude:2.1.316
path: capabilities[2]
- group:
description: Drive claude sessions programmatically
capabilities:
- source:
kit: docker.io/docker/sbx-kit-claude:2.1.316
path: capabilities[3]
type: com.docker.sandbox/agent-sessions@1
config:
continue:
- --continue
list:
- node
- /opt/claude-sessions/interactive-sessions.mjs
prompt:
- -p
- --
- '{{.Prompt}}'
resume:
- --resume
- '{{.SessionID}}'
description: Drive claude sessions programmatically
declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude:2.1.316
path: capabilities[3]
- group:
description: Open claude's terminal UI on a chosen session
optional: true
capabilities:
- source:
kit: docker.io/docker/sbx-kit-claude:2.1.316
path: capabilities[4]
type: com.docker.sandbox/agent-interactive-sessions@1
config:
continue:
- --continue
prompt:
- --
- '{{.Prompt}}'
resume:
- --resume
- '{{.SessionID}}'
sessionPicker:
- --resume
description: Open claude's terminal UI on a chosen session
declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude:2.1.316
path: capabilities[4]
- group:
capabilities:
- source:
kit: docker.io/docker/sbx-kit-claude:2.1.316
path: capabilities[5]
type: com.docker.sandbox/lifecycle@1
config:
install:
- command: |
set -e
ws="${WORKSPACE_DIR:-/}"
esc=$(printf '%s' "$ws" | sed 's/\\/\\\\/g; s/"/\\"/g; s/\t/\\t/g; s/\r/\\r/g')
projects="\"/\": { \"hasTrustDialogAccepted\": true }"
[ "$ws" = "/" ] || projects="$projects, \"$esc\": { \"hasTrustDialogAccepted\": true }"
printf '%s\n' "{
\"bypassPermissionsModeAccepted\": true,
\"hasCompletedOnboarding\": true,
\"hasSeenAutoDefaultNudge\": true,
\"projects\": { $projects }
}" > /home/agent/.claude.json
chown agent:agent /home/agent/.claude.json
description: Seed Claude bypass/trust flags (root; overwrites image-shipped file)
env:
- WORKSPACE_DIR
user: "0"
- command: mkdir -p /home/agent/.claude && chown agent:agent /home/agent/.claude
description: Ensure ~/.claude is agent-owned before settings seed
user: "0"
- command: |
set -e
HELPER=''
if [ "${SBX_CRED_ANTHROPIC_MODE:-none}" != none ]; then
HELPER=' "apiKeyHelper": "echo proxy-managed",
'
fi
# Model selection from the create-phase args. The args'
# patterns admit no quote or backslash, so the expanded
# value is safe inside the JSON string. effortLevel accepts
# low/medium/high/xhigh; max and auto persist only through
# CLAUDE_CODE_EFFORT_LEVEL (settings.json rejects them).
model=''
effort=''
MODEL=''
EFFORT=''
ENV_BLOCK=''
[ -z "$model" ] || MODEL=" \"model\": \"$model\",
"
case "$effort" in
'') ;;
max|auto)
ENV_BLOCK=" \"env\": { \"CLAUDE_CODE_EFFORT_LEVEL\": \"$effort\" },
"
;;
*)
EFFORT=" \"effortLevel\": \"$effort\",
"
;;
esac
# Lifecycle hooks for Narwhal (see /usr/local/bin/sbx-claude-hook):
# Stop and StopFailure report a finished turn, Notification the
# moments Claude waits on the user, UserPromptSubmit the prompt
# that names the conversation (Claude Code lists sessions by id
# only). The script never fails, never writes stdout and runs
# async, so a session without the desktop app sees no delay and
# no hook error.
HOOK='{ "type": "command", "command": "/usr/local/bin/sbx-claude-hook claude", "timeout": 10, "async": true }'
HOOKS=" \"hooks\": {
\"Stop\": [ { \"hooks\": [ $HOOK ] } ],
\"StopFailure\": [ { \"hooks\": [ $HOOK ] } ],
\"UserPromptSubmit\": [ { \"hooks\": [ $HOOK ] } ],
\"Notification\": [ { \"matcher\": \"permission_prompt|idle_prompt|elicitation_dialog|elicitation_url_dialog|agent_needs_input\", \"hooks\": [ $HOOK ] } ]
},
"
# The statusLine command is the only place Claude Code exposes
# the live session (model, context window, cost, lines changed);
# sbx-agent-hook forwards it to Narwhal's status bar and prints
# nothing, so no status line is drawn in the terminal. A mixin that
# sets its own statusLine (e.g. claude-sbx-statusline) replaces
# this one and the app's session view goes quiet for that sandbox.
STATUSLINE=" \"statusLine\": { \"type\": \"command\", \"command\": \"/usr/local/bin/sbx-claude-hook claude-status\" },
"
printf '%s' "{
\"themeId\": 1,
\"alwaysThinkingEnabled\": true,
${HELPER}${MODEL}${EFFORT}${ENV_BLOCK}${HOOKS}${STATUSLINE} \"permissions\": { \"defaultMode\": \"bypassPermissions\" },
\"bypassPermissionsModeAccepted\": true,
\"skipDangerousModePermissionPrompt\": true
}
" > /home/agent/.claude/settings.json
description: Seed Claude settings.json from the surfaced auth mode
env:
- SBX_CRED_ANTHROPIC_MODE
user: agent
- command: |
set -e
[ -n "$MCP_GATEWAY_URL" ] || exit 0
export PATH="$HOME/.local/bin:$HOME/.claude/local:$PATH"
claude mcp add mcp-gateway "$MCP_GATEWAY_URL" \
--transport http \
--scope user \
--header "Authorization: Bearer $MCP_SENTINEL_TOKEN_NAME" || true
description: Register the sandbox MCP gateway (install-time, race-free)
env:
- MCP_GATEWAY_URL
- MCP_SENTINEL_TOKEN_NAME
user: agent
startup:
- background: true
command:
- sh
- -c
- command -v apt-get > /dev/null 2>&1 && (apt-get update -qq -y > /dev/null 2>&1 || true)
description: Update apt package cache in background
user: "0"
- command: |
set -e
[ -n "$MCP_GATEWAY_URL" ] || exit 0
export PATH="$HOME/.local/bin:$HOME/.claude/local:$PATH"
claude mcp add mcp-gateway "$MCP_GATEWAY_URL" \
--transport http \
--scope user \
--header "Authorization: Bearer $MCP_SENTINEL_TOKEN_NAME" || true
description: Register the sandbox MCP gateway (startup fallback)
env:
- MCP_GATEWAY_URL
- MCP_SENTINEL_TOKEN_NAME
user: agent
declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude:2.1.316
path: capabilities[5]
- group:
optional: true
capabilities:
- source:
kit: docker.io/docker/sbx-kit-claude:2.1.316
path: capabilities[6]
type: com.docker.sandbox/agent-skills@1
config:
path: /home/agent/.claude/skills
declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude:2.1.316
path: capabilities[6]
- group:
optional: true
capabilities:
- source:
kit: docker.io/docker/sbx-kit-claude:2.1.316
path: capabilities[7]
type: com.docker.sandbox/agent-context@1
config:
contentFile: /usr/share/sandbox/kit/myorg-dev/context.md.parts/0.md
directory: /home/agent/.claude
filename: CLAUDE.md
declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude:2.1.316
path: capabilities[7]
- group:
optional: true
capabilities:
- source:
kit: docker.io/docker/sbx-kit-claude:2.1.316
path: capabilities[8]
type: com.docker.sandbox/agent-context@2
config:
content: |
## Claude Code: Environment Persistence
The `CLAUDE_ENV_FILE` environment variable is set to `/etc/sandbox-persistent.sh`.
According to [Claude Code Documentation](https://code.claude.com/docs/en/settings#bash-tool-behavior):
> **CLAUDE_ENV_FILE**
>
> If set, this file will be sourced before each Bash command execution. This allows environment variables to persist across multiple Bash tool invocations.
This means `/etc/sandbox-persistent.sh` is sourced before every Bash tool call you make. Any `export` statements you append to this file will be available in all subsequent commands without needing a login shell.
### Shell Completions Must NOT Be in CLAUDE_ENV_FILE
**NEVER add shell completion scripts to `/etc/sandbox-persistent.sh`.**
`CLAUDE_ENV_FILE` is sourced **before every single bash command execution**, not just during shell initialization. Completion scripts rely on special variables (`COMP_WORDS`, `COMP_CWORD`, `COMPREPLY`) that only exist during tab-completion contexts.
#### WRONG - Will Break Bash
```bash
# DO NOT ADD THESE TO /etc/sandbox-persistent.sh
[ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion"
[[ -s "$SDKMAN_DIR/etc/bash_completion.sh" ]] && source "$SDKMAN_DIR/etc/bash_completion.sh"
```
#### CORRECT - Only Load Core Functionality
```bash
# ONLY add the main initialization scripts
export NVM_DIR="$HOME/.nvm"
[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
export SDKMAN_DIR="$HOME/.sdkman"
[[ -s "$SDKMAN_DIR/bin/sdkman-init.sh" ]] && source "$SDKMAN_DIR/bin/sdkman-init.sh"
```
#### Symptoms of Broken Shell
When completion scripts are incorrectly added:
- All bash commands return no output (silent failure)
- `echo`, `pwd`, and other basic commands produce no results
- The bash tool becomes completely unusable
#### Solution
If you accidentally added completion scripts and broke the shell:
1. Remove the completion line(s) from `/etc/sandbox-persistent.sh`
2. Exit and restart the Claude Code session
3. Verify with `echo "test"` that bash works again
directory: /home/agent/.claude
filename: CLAUDE.md
declarationBlocks:
- "0:0"
source:
kit: docker.io/docker/sbx-kit-claude:2.1.316
path: capabilities[8]
- group:
capabilities:
- source:
kit: docker.io/docker/sbx-kit-gh:2.103.2
path: capabilities[0]
type: com.docker.sandbox/network-policy@2
config:
runtime:
allow:
- github.com
- hosts:
- api.github.com
methods:
- GET
- HEAD
- POST
- PATCH
- PUT
- DELETE
- hosts:
- uploads.github.com
methods:
- POST
- PUT
deny:
- hosts:
- api.github.com
methods:
- DELETE
paths:
- /repos/**
declarationBlocks:
- "1:0"
source:
kit: docker.io/docker/sbx-kit-gh:2.103.2
path: capabilities[0]
- group:
description: GitHub API access for gh
optional: true
capabilities:
- source:
kit: docker.io/docker/sbx-kit-gh:2.103.2
path: capabilities[1]
type: com.docker.sandbox/credential@1
config:
apiKey:
inject:
- domain: api.github.com
format: Bearer %s
header: Authorization
- domain: uploads.github.com
format: Bearer %s
header: Authorization
- domain: github.com
format: Bearer %s
header: Authorization
name: GH_TOKEN
proxyManaged: true
phase:
- runtime
service: github
description: GitHub API access for gh
declarationBlocks:
- "1:0"
source:
kit: docker.io/docker/sbx-kit-gh:2.103.2
path: capabilities[1]
- group:
optional: true
capabilities:
- source:
kit: docker.io/docker/sbx-kit-gh:2.103.2
path: capabilities[2]
type: com.docker.sandbox/agent-context@1
config:
contentFile: /usr/share/sandbox/kit/myorg-dev/context.md.parts/1.md
declarationBlocks:
- "1:0"
source:
kit: docker.io/docker/sbx-kit-gh:2.103.2
path: capabilities[2]
- group:
optional: true
capabilities:
- source:
kit: docker.io/docker/sbx-kit-gh:2.103.2
path: capabilities[3]
type: com.docker.sandbox/agent-context@2
config:
content: |
# GitHub CLI
`gh` is on PATH at `/usr/local/bin/gh`.
- Authentication is proxy-managed: `GH_TOKEN` is set to a sentinel and the
real credential is injected on requests to github.com, api.github.com,
and uploads.github.com. Never print or copy the token; it is not the
real value anyway.
- Do not run `gh auth login` — authentication already works.
- Prefer `gh` over raw git for GitHub operations: `gh pr create`,
`gh issue list`, `gh run watch`, `gh api` for anything without a
dedicated subcommand.
declarationBlocks:
- "1:0"
source:
kit: docker.io/docker/sbx-kit-gh:2.103.2
path: capabilities[3]
- group:
capabilities:
- source:
kit: docker.io/mrweiland/myorg-dotnet:1.1.0
path: capabilities[0]
type: com.docker.sandbox/network-policy@2
config:
runtime:
allow:
- api.nuget.org
- globalcdn.nuget.org
deny:
- dc.services.visualstudio.com
declarationBlocks:
- "2:0"
source:
kit: docker.io/mrweiland/myorg-dotnet:1.1.0
path: capabilities[0]
- group:
name: NuGet cache
description: Behåll ~/.nuget/packages mellan omstarter
optional: true
capabilities:
- source:
kit: docker.io/mrweiland/myorg-dotnet:1.1.0
path: capabilities[1].group.capabilities[0]
type: com.docker.sandbox/volume@1
config:
path: /home/agent/.nuget/packages
size: 10g
- source:
kit: docker.io/mrweiland/myorg-dotnet:1.1.0
path: capabilities[1].group.capabilities[1]
type: com.docker.sandbox/lifecycle@1
config:
install:
- command: mkdir -p /home/agent/.nuget/packages && chown agent:agent /home/agent/.nuget /home/agent/.nuget/packages
description: Gör NuGet-cachen ägd av agent
user: "0"
source:
kit: docker.io/mrweiland/myorg-dotnet:1.1.0
path: capabilities[1]
- group:
optional: true
capabilities:
- source:
kit: docker.io/mrweiland/myorg-dotnet:1.1.0
path: capabilities[2]
type: com.docker.sandbox/agent-context@1
config:
contentFile: /usr/share/sandbox/kit/myorg-dev/context.md.parts/2.md
declarationBlocks:
- "2:0"
source:
kit: docker.io/mrweiland/myorg-dotnet:1.1.0
path: capabilities[2]
- group:
optional: true
capabilities:
- source:
kit: docker.io/mrweiland/myorg-dotnet:1.1.0
path: capabilities[3]
type: com.docker.sandbox/agent-context@2
config:
content: |
## .NET
`dotnet` finns på PATH (`dotnet --list-sdks` visar versionen).
- Bygg och testa med `dotnet build` och `dotnet test` innan du föreslår
en ändring.
- Paket hämtas från nuget.org; cachen ligger i `~/.nuget/packages`.
- Webbappar som ska nås från värden måste lyssna på `0.0.0.0`
(t.ex. `ASPNETCORE_URLS=http://0.0.0.0:5000`).
declarationBlocks:
- "2:0"
source:
kit: docker.io/mrweiland/myorg-dotnet:1.1.0
path: capabilities[3]
- group:
capabilities:
- source:
kit: docker.io/mrweiland/myorg-tools:1.0.1
path: capabilities[0]
type: com.docker.sandbox/network-policy@2
config:
runtime:
allow:
- repo.maven.apache.org
- repo1.maven.org
- nexus.myorg.example
deny:
- hosts:
- nexus.myorg.example
methods:
- PUT
- POST
- DELETE
declarationBlocks:
- "3:0"
source:
kit: docker.io/mrweiland/myorg-tools:1.0.1
path: capabilities[0]
- group:
optional: true
capabilities:
- source:
kit: docker.io/mrweiland/myorg-tools:1.0.1
path: capabilities[1]
type: com.docker.sandbox/resources@1
config:
cpu: 4
memory: 8g
declarationBlocks:
- "3:0"
source:
kit: docker.io/mrweiland/myorg-tools:1.0.1
path: capabilities[1]
- group:
name: Maven cache
description: Behåll ~/.m2/repository mellan omstarter
optional: true
capabilities:
- source:
kit: docker.io/mrweiland/myorg-tools:1.0.1
path: capabilities[2].group.capabilities[0]
type: com.docker.sandbox/volume@1
config:
path: /home/agent/.m2/repository
size: 10g
- source:
kit: docker.io/mrweiland/myorg-tools:1.0.1
path: capabilities[2].group.capabilities[1]
type: com.docker.sandbox/lifecycle@1
config:
install:
- command: mkdir -p /home/agent/.m2/repository && chown agent:agent /home/agent/.m2 /home/agent/.m2/repository
description: Gör Maven-cachen ägd av agent
user: "0"
source:
kit: docker.io/mrweiland/myorg-tools:1.0.1
path: capabilities[2]
- group:
optional: true
capabilities:
- source:
kit: docker.io/mrweiland/myorg-tools:1.0.1
path: capabilities[3]
type: com.docker.sandbox/agent-context@1
config:
contentFile: /usr/share/sandbox/kit/myorg-dev/context.md.parts/3.md
declarationBlocks:
- "3:0"
source:
kit: docker.io/mrweiland/myorg-tools:1.0.1
path: capabilities[3]
- group:
optional: true
capabilities:
- source:
kit: docker.io/mrweiland/myorg-tools:1.0.1
path: capabilities[4]
type: com.docker.sandbox/agent-context@2
config:
content: |
## MyOrg dev tools
Den här sandlådan har MyOrg:s standardverktyg:
- `java` / `javac` — Temurin JDK (version i kit-arg `jdkVersion`)
- `mvn` — Apache Maven; lokal cache i `~/.m2/repository`
Konventioner:
- Bygg och testa med `mvn -B verify` innan du föreslår en ändring.
- Skapa pull requests i stället för att pusha till `main`.
- Nätverket är begränsat till godkända domäner. Om en nedladdning
nekas (HTTP 403 från proxyn) ska du inte försöka kringgå det —
be användaren lägga till domänen i kit eller org-policy.
declarationBlocks:
- "3:0"
source:
kit: docker.io/mrweiland/myorg-tools:1.0.1
path: capabilities[4]
- group:
optional: true
capabilities:
- source:
kit: the set descriptor
path: capabilities[0]
type: com.docker.sandbox/agent-context@1
config:
contentFile: /usr/share/sandbox/kit/myorg-dev/context.md.parts/4.md
declarationBlocks:
- "4:0"
source:
kit: the set descriptor
path: capabilities[0]
- group:
optional: true
capabilities:
- source:
kit: the set descriptor
path: capabilities[1]
type: com.docker.sandbox/agent-context@2
config:
content: |
# MyOrg utvecklarsandlåda
Du kör i MyOrg:s standardsandlåda. Ingående kits och deras källor
finns under `/usr/share/sandbox/kit/`.
- Arbeta i en feature-branch och öppna PR med `gh pr create`.
- Hemligheter finns aldrig i sandlådan; proxyn injicerar dem.
Kör inte `gh auth login` och skriv aldrig ut tokens.
declarationBlocks:
- "4:0"
source:
kit: the set descriptor
path: capabilities[1]
args:
registry:
default: docker.io/mrweiland
description: Registry-namespace där myorg-tools är publicerad
pattern: ^[a-z0-9][a-z0-9._/:-]*$
buildArg: KIT_REGISTRY
kits:
- ref: docker.io/docker/sbx-kit-claude:2.1.316
digest: sha256:60a90df50354b1bb737b0f47bc2aad0475b36e019c65361173feace3efcf662a
- ref: docker.io/docker/sbx-kit-gh:2.103.2
digest: sha256:2af919e2a6782f3aa5aa15711d0dadc08088b529f07df5d7005e3271e97da1cb
- ref: docker.io/mrweiland/myorg-tools:1.0.1
digest: sha256:1a27e88d7f76aa5053ad065afe907b2afca52cc874a9d69b997e378b9b60a369
- ref: docker.io/mrweiland/myorg-dotnet:1.1.0
digest: sha256:ab912a6bee4a98681b1137da5141f6d046764043c862872d052e1d70bf358ed3