sbx/kiro-mixin:latest

schemaVersion: "3"
displayName: Kiro (mixin)
author: Docker, Inc. https://docker.com
description: Kiro CLI overlay with network policy and MCP gateway setup. Run kiro-cli login before starting chat.
sourceUrl: https://github.com/docker-hardened-images/definitions
version: 3.2.0
licenses:
    - LicenseRef-Proprietary
kind: mixin
provides:
    - [email protected]
capabilities:
    - type: com.docker.sandbox/network-policy@1
      config:
        runtime:
            allow:
                - cli.kiro.dev:443
                - prod.download.cli.kiro.dev:443
                - kiro.dev:443
                - client-telemetry.us-east-1.amazonaws.com:443
                - cognito-identity.us-east-1.amazonaws.com:443
                - desktop-release.q.us-east-1.amazonaws.com:443
                - management.us-east-1.kiro.dev:443
                - oidc.us-east-1.amazonaws.com:443
                - prod.us-east-1.auth.desktop.kiro.dev:443
                - prod.us-east-1.telemetry-v2.kiro.dev:443
                - runtime.us-east-1.kiro.dev:443
                - q.us-east-1.amazonaws.com:443
                - view.awsapps.com:443
    - type: com.docker.sandbox/lifecycle@1
      config:
        install:
            - command: kiro-cli settings list > /dev/null
              description: Create Kiro CLI's state database
              user: agent
        startup:
            - command:
                - sh
                - -c
                - |
                  set -e
                  [ -n "$MCP_GATEWAY_URL" ] || exit 0
                  mkdir -p "$HOME/.kiro/settings"
                  cat > "$HOME/.kiro/settings/mcp.json" <<EOF
                  {
                    "mcpServers": {
                      "mcp-gateway": {
                        "url": "$MCP_GATEWAY_URL",
                        "headers": {
                          "Authorization": "Bearer $MCP_SENTINEL_TOKEN_NAME"
                        }
                      }
                    }
                  }
                  EOF
              description: Register the sandbox MCP gateway in ~/.kiro/settings/mcp.json
              env:
                - MCP_GATEWAY_URL
                - MCP_SENTINEL_TOKEN_NAME
              user: agent
    - type: com.docker.sandbox/agent-context@1
      optional: true
      config:
        content: |
            Kiro CLI is installed as `kiro-cli`. Authentication and network access follow this Kit's capability declarations.
    - type: com.docker.sandbox/agent-context@2
      optional: true
      config:
        content: |
            Kiro CLI is installed as `kiro-cli`. Authentication and network access follow this Kit's capability declarations.
    - type: com.docker.sandbox/acp@1
      optional: true
      config:
        agent: kiro
        command:
            - kiro-cli
            - acp
args:
    version:
        required: true
        description: Kiro CLI release carried by the image
        pattern: ^[0-9]+\.[0-9]+\.[0-9]+$
        buildArg: VERSION