docker/sbx-kit-docker-agent-mixin:latest

schemaVersion: "3"
displayName: Docker Agent (mixin)
author: Docker, Inc.
description: Docker Agent as a mixin — the binary in an overlay, with eight optional proxy-managed provider credentials. Layer it onto a shell base and run `docker-agent run`.
sourceUrl: https://github.com/docker/docker-agent
version: 0.1.0
kind: mixin
provides:
    - docker-agent
capabilities:
    - type: com.docker.sandbox/network-policy@1
      config:
        runtime:
            allow:
                - api.anthropic.com:443
                - claude.ai:443
                - console.anthropic.com:443
                - api.business.githubcopilot.com:443
                - api.enterprise.githubcopilot.com:443
                - api.github.com:443
                - api.githubcopilot.com:443
                - api.individual.githubcopilot.com:443
                - copilot.github.com:443
                - github.com:443
                - raw.githubusercontent.com:443
                - aiplatform.googleapis.com:443
                - generativelanguage.googleapis.com:443
                - oauth2.googleapis.com:443
                - vertexai.googleapis.com:443
                - api.mistral.ai:443
                - api.studio.nebius.com:443
                - api.openai.com:443
                - openrouter.ai:443
                - api.x.ai:443
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.anthropic.com
                  format: '%s'
                  header: x-api-key
                - domain: claude.ai
                  format: '%s'
                  header: x-api-key
                - domain: console.anthropic.com
                  format: '%s'
                  header: x-api-key
            name: ANTHROPIC_API_KEY
            proxyManaged: true
        phase: runtime
        service: anthropic
      description: Anthropic API access
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.business.githubcopilot.com
                  format: Bearer %s
                  header: Authorization
                - domain: api.enterprise.githubcopilot.com
                  format: Bearer %s
                  header: Authorization
                - domain: api.github.com
                  format: Bearer %s
                  header: Authorization
                - domain: api.githubcopilot.com
                  format: Bearer %s
                  header: Authorization
                - domain: api.individual.githubcopilot.com
                  format: Bearer %s
                  header: Authorization
                - domain: copilot.github.com
                  format: Bearer %s
                  header: Authorization
                - domain: github.com
                  format: Bearer %s
                  header: Authorization
                - domain: raw.githubusercontent.com
                  format: Bearer %s
                  header: Authorization
            name: GITHUB_TOKEN
            proxyManaged: true
        phase: runtime
        service: github
      description: GitHub and Copilot access
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: aiplatform.googleapis.com
                  format: '%s'
                  header: x-goog-api-key
                - domain: generativelanguage.googleapis.com
                  format: '%s'
                  header: x-goog-api-key
                - domain: oauth2.googleapis.com
                  format: '%s'
                  header: x-goog-api-key
                - domain: vertexai.googleapis.com
                  format: '%s'
                  header: x-goog-api-key
            name: GOOGLE_API_KEY
            proxyManaged: true
        phase: runtime
        service: google
      description: Google AI API access
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.mistral.ai
                  format: Bearer %s
                  header: Authorization
            name: MISTRAL_API_KEY
            proxyManaged: true
        phase: runtime
        service: mistral
      description: Mistral API access
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.studio.nebius.com
                  format: Bearer %s
                  header: Authorization
            name: NEBIUS_API_KEY
            proxyManaged: true
        phase: runtime
        service: nebius
      description: Nebius API access
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.openai.com
                  format: Bearer %s
                  header: Authorization
            name: OPENAI_API_KEY
            proxyManaged: true
        phase: runtime
        service: openai
      description: OpenAI API access
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: openrouter.ai
                  format: Bearer %s
                  header: Authorization
            name: OPENROUTER_API_KEY
            proxyManaged: true
        phase: runtime
        service: openrouter
      description: OpenRouter API access
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.x.ai
                  format: Bearer %s
                  header: Authorization
            name: XAI_API_KEY
            proxyManaged: true
        phase: runtime
        service: xai
      description: xAI API access
    - type: com.docker.sandbox/agent-context@1
      optional: true
      config:
        content: |
            # Docker Agent

            This sandbox runs Docker Agent, a multi-provider coding agent. Every
            provider key is proxy-managed: the values in the environment are
            sentinels the egress proxy swaps at each provider's endpoints.
        directory: /home/agent
        filename: AGENTS.md
    - type: com.docker.sandbox/agent-context@2
      optional: true
      config:
        content: |
            # Docker Agent

            This sandbox runs Docker Agent, a multi-provider coding agent. Every
            provider key is proxy-managed: the values in the environment are
            sentinels the egress proxy swaps at each provider's endpoints.
        directory: /home/agent
        filename: AGENTS.md
dockerfile: ./docker-agent-mixin.dockerfile