Docker Sandboxes Kits

DockerOfficialPublished by Docker

Skill
Tool integration
Cloud and DevOps
Apache-2.0
Low risk
Has scripts

From the author

Use this skill when authoring, verifying, publishing, or composing a Docker Sandboxes kit, even if the user just says they want to "add a tool to a sandbox agent", "package a CLI or agent as a kit", "publish a kit to a registry", or "give a mixin its own credentials and network access". Covers the v3 kit descriptor (`# syntax=docker/sandbox-kit:3`, `kind: workload` or `mixin`, typed capabilities, provides/requires, content recipes), building with docker buildx, checking with kit-tck and `sbx kit inspect`, composing onto a workload, and publishing and signing. Legacy v2 `spec.yaml` kits are not covered; `sbx kit validate` is not a substitute for kit-tck conformance and runtime checks.

— the description by Docker

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides guidance for working with Docker Sandboxes Kits v3, which are OCI images containing a descriptor that defines capabilities, requirements, and content recipes. It covers the v3 descriptor format, building with Docker Buildx, conformance testing with kit-tck, and composing kits onto workloads. It specifically excludes legacy v2 spec.yaml kits and focuses on the v3 workflow for creating mixins and workloads that extend sandbox functionality.

What it does

Authors v3 kit descriptors using the docker/sandbox-kit:3 syntax
Defines typed capabilities for network access, credentials, and host mounts
Builds and validates kits using Docker Buildx and kit-tck
Composes kits onto sandbox workloads for runtime testing
Provides patterns for content recipes and overlay ownership
Guides the publishing and signing process for kit images

When to use it

When packaging a CLI or agent as a reusable sandbox kit
When adding tools, credentials, or policies to an existing sandbox agent
When converting a legacy v2 kit to the v3 descriptor format
When defining capability requests for a kit to ensure least-privilege access

Advantages

Ensures strict descriptor validation to prevent silent policy failures
Supports modular composition of mixins onto base workloads
Provides a clear path for conformance testing before deployment
Enables granular control over host capabilities and environment variables

Usage examples

“How do I create a new mixin kit for a CLI tool?”: The agent will guide you through creating a kit directory with a v3 YAML descriptor and a Dockerfile recipe, defining the necessary network policies and capabilities.
“How do I validate my v3 kit before publishing?”: The agent will provide the commands to build the kit using Docker Buildx and run the kit-tck validation tool against the resulting OCI layout.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/docker/docker-sandboxes-kits/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip docker-sandboxes-kits.zip -d .agents/skills

Documentation by Docker

Docker Sandboxes: Kits (v3 descriptors)

Overview

A kit extends a sandbox with a tool, an agent, credentials, or policy. In v3 a kit is one OCI image: its layers are the content, and a manifest annotation carries the descriptor, which says what the kit offers, what it needs from the host as typed capability requests, and what it needs from other kits. An engine that does not read the annotation runs it as an ordinary image.

The source is a <kit>.yaml whose first line is # syntax=docker/sandbox-kit:3 with schemaVersion: "3", usually beside a <kit>.dockerfile content recipe. The kinds are workload, mixin, and set (a list of other kits). Build and check with docker buildx build, kit-tck validate, sbx kit inspect, and a real sbx run composition.

Scope and guardrails:

Legacy v2 spec.yaml kits (schemaVersion: "2", kind: sandbox) are not covered here. This is the skill's routing boundary, not a claim that v2 has been deprecated or removed. This skill neither authors nor debugs them. If the user has one, say so and offer to write the v3 equivalent as a new descriptor (see "Migrating from v2").
sbx kit validate is not a conformance check. The v0.50.1 code supplies a v3 builder to both normal validate and inspect. Both need an authenticated daemon; --offline deliberately omits the builder and rejects v3 source kits. A normal validate success is therefore allowed, but does not replace kit-tck or real runtime composition.
Do not carry v2 vocabulary into v3: name, sandbox:, permissions.network, credentials:, setup.*, and --kit-arg are not v3 fields, and v2 composition rules (additive allow lists, duplicate-service credential failures) are not established for v3.
This skill is experimental. The source calls the schema-3 grammar unfinished and says the Go implementation wins over its docs, so re-check fine details against the spec before relying on them.
No minimum sbx version for Kits v3 is established by the source, which says only that current stable releases support it in local and cloud mode. Check the installed sbx rather than assuming.

When to use this skill

Activate this skill when:

The user wants to create a new kit: package a CLI or agent as a kit, add a tool, credential, or policy to an existing agent, or add a -mixin variant.
The user asks what a kit descriptor should contain, whether to write a workload or a mixin, or which capabilities a kit should request.
The user wants to pin a tool version, declare provides/requires, or write the content recipe (<kit>.dockerfile) for a kit.
The user wants to build, check, publish, or sign a kit, or to compose a built kit onto a workload and test it.
The user has an existing v2 spec.yaml and wants it converted to v3.

Do not use this skill when

Do not use this skill when:

The task is creating, running, or removing the sandbox a kit is composed into, independent of the kit's own content — use docker-sandboxes-lifecycle.
The task is what a credential or network rule actually does at runtime (proxy injection, allow/deny precedence, the policy a sandbox currently has), where a user stores a secret value, or secrets and policy unrelated to any kit — use docker-sandboxes-network-credentials.
The task is the sbxenv.yaml file that references kits through its own kits: block — use docker-sandboxes-env (this skill still owns what goes inside the referenced kit).
The task is general Dockerfile or image-build optimization unrelated to a kit's recipe — use docker-build-strategies.
The task is to author, validate, or debug a legacy v2 spec.yaml. It is out of scope; offer migration instead.
The task is a bulk migration of v2 kits to v3. The source names a migrate-kit-to-v3 skill and a field-by-field mapping, but that skill is not part of this catalog and may not be installed; do not route to it unless it is available. See "Migrating from v2" below.

Core guidance

v3: choose workload or mixin first

Everything else follows from the kind.

	`kind: workload`	`kind: mixin`
Layers are	a root filesystem	an overlay landing on a workload
Per composition	exactly one	zero or more
Owns	entrypoint, env, user, workdir, a legacy context profile	env, labels, ports and volumes, which merge; an agent mixin can select an explicit context profile
Must have content	yes	no — may be declaration-only

Write a workload when you own the environment the agent runs in. Write a mixin when you add a tool, a credential, or a policy to somebody else's. Most new kits should be mixins; a tool worth shipping as a workload is usually worth shipping as both (the source's claude and claude-mixin examples are that pair).
A mixin cannot set ENTRYPOINT, CMD, USER or WORKDIR and have it take effect: the workload anchors the composition and owns those fields. The additive fields merge (env, labels, ports, volumes), so a mixin's ENV reaches the composed image and PATH is appended rather than replaced.
Prefer ENV for static environment: it is what the agent process sees, whereas profile and rc files do not run for the agent, so an /etc/profile.d/<kit>-env.sh drop reaches a terminal the user opens but not the agent. Use profile.d only when two mixins might set one variable to different values (a hard composition failure) or the value only makes sense in an interactive shell.

v3: layout and descriptor

The default form is a companion pair found by filename stem: <kit>/<kit>.yaml (first line # syntax=docker/sandbox-kit:3) and <kit>/<kit>.dockerfile (omitted for a declaration-only mixin). Every key is lowerCamelCase, and decoding is strict: an unrecognized key is an error, deliberately, because a silently ignored misspelling would be a policy silently absent.

assets/v3-mixin-egress.yaml is a complete declaration-only mixin. Its build and all 19 layout conformance checks passed on 2026-11-02; runtime composition initially failed on v0.50.1 because agent-context@2 was required. The explanatory note is now optional; the network request remains required. Corrected composition and npm HTTPS access passed under the test host policy. See checks/authenticated-results.md for scope and limits.
references/v3-capabilities.md has the annotated descriptor skeleton, the other authoring forms, and every capability type with its common mistakes.

v3: capabilities — least privilege, and the rules most often missed

A capability is a typed request the host answers. The default is required and fails resolution closed; optional: true means the kit degrades without it. Request only what the kit needs. The rules below prevent the most common failures; the full table is in references/v3-capabilities.md.

network-policy@1 is phase-scoped: an absent phase grants nothing. Install-hook hosts go in install, runtime hosts in runtime, shared hosts in both. network-policy@2 bounds by HTTP method and path, is exclusive with @1, and its bound should be verified on the target runtime before it is treated as a security boundary.
credential@1 entries are required by default; add optional: true unless the kit cannot run unauthenticated. Every inject[].domain must appear exactly in each listed phase's allow list; a wildcard does not satisfy a specific subdomain. Never put secret values in a descriptor, arg, or recipe.
ssh-agent@1: set unrestricted: false and bound it (sign: [git], authenticate: [[email protected]]); the default signs anything with every key the user's agent holds. Prefer credential@1 over HTTPS when a token will do.
lifecycle@1 hook environments are deny-by-default; declare every variable a hook or its child processes read, including HTTP_PROXY/HTTPS_PROXY.
privileged@1, host-mount@1, host-port@1 and dockerd@1 widen what the kit can touch. Do not declare them on speculation; host mounts are shared with the host user and survive sandbox removal.
Verify every flag in agent-sessions@1 and agent-interactive-sessions@1 against the tool's real CLI; never invent one.

v3: versions, provides, and requires

Pin the tool once. Declare a build-phase version arg, wire it through to the installer, and reference it from both provides and the top-level version:, so one value drives the install, the matchable capability, the published version, and the tag.
A pinned provide is a claim about content, so make the build enforce it: re-read the installed version and fail on mismatch. Pinning the provide without pinning the install is worse than floating.
An unversioned provide is not a resting place. Under version: "1.0.0" it publishes <tool>@1.0.0, the kit's release number wearing the tool's name; with no version: the build fails. Pin it, or drop the provide.
requires is a closed-set check. A name nothing in the composition provides makes the kit refuse to compose anywhere. It constrains the composed runtime, not your build stage. Never require the platform floor (bash, sh, curl, git, a CA store, the agent user at uid 1000), and do not try to express a conditional dependency: let the hook probe and fail with an actionable message. The test is "what must already be present, on every base, for this kit to work at all"; usually that is nothing.
Where a requirement is real, use deb/ names (derived from a workload's dpkg database; on multi-platform workloads, the intersection across platforms), and never author a deb/ provide yourself.

v3: content recipes

Recipes for both kinds, the overlay ownership rules, the virtualenv trap, and the audit are in references/v3-recipes.md. Read it before writing a mixin: overlay ownership is the most common way a working-looking kit is broken. In short: a mixin overlay stages under /out and copies into scratch, keeps out of /home/agent where it can, and states numeric ownership for every directory level it ships (/home root-owned, /home/agent uid 1000).

v3: build, run, and verify

Create a named container builder once and select it for exports and publication. The docker driver with the classic image store can drop manifest annotations, leaving an image that is no longer a kit.

docker buildx create --name kit-builder --driver docker-container --bootstrap

# Run from the parent of <kit> and <workload>; subshells preserve that directory.
# 1. validate — the descriptor is checked before content is built. cacheonly
#    drops the EXPORT, not the build: once valid, the whole recipe still solves.
(cd <kit> && docker buildx build --builder kit-builder . \
  -f <kit>.yaml --output type=cacheonly)

# 2. build, exporting a layout so kit-tck can judge it without a registry
(cd <kit> && docker buildx build --builder kit-builder . -f <kit>.yaml -t <kit>:<version> \
  --output type=oci,dest=/tmp/<kit>-layout,tar=false)

# 3. conformance — the tag alone, not <kit>:<version>
kit-tck validate --layout /tmp/<kit>-layout <version>

# 4. run it, no registry needed
sbx run ./<kit> .                          # a workload
sbx run ./<workload> --kit ./<kit> .       # a mixin, composed
sbx kit inspect ./<kit>                    # requires authenticated daemon; see below

--app-name isolates the Docker login store as well as daemon state. Sign in explicitly to the test app before normal source inspection. --offline is not an auth workaround for v3 sources: it deliberately disables the builder to keep the command daemon-free. The observed offline rejection is expected, not evidence that normal inspect is broken.
v0.50.1 inspection shows a legacy-shaped summary, not the raw descriptor. Use kit-tck inspect --descriptor --layout <layout> <tag> to read the typed requests. Do not copy sbx kit inspect --format json output as v3 YAML.
v0.50.1 supports v3 kits but not agent-context@2 at composition time. Only mark this request optional when its guidance is nonessential, as in the egress asset; otherwise use a host with explicit support. Successful inspection/validation does not prove required capability availability.
A build is not proof the kit works. For a mixin, compose the built overlay onto a real workload and run the tool with sbx exec <sandbox> <tool> --version. Arguments after -- on sbx run are agent arguments, so they never execute the overlay's binary. Details and the ownership audit are in references/v3-recipes.md.
Inside a sandbox the kit is self-describing: /usr/share/sandbox/kit/<kit>/kit.yaml is the published descriptor, kit.dockerfile the recipe, and /var/log/sbx-kit-startup.log the startup hook output.
Local recipe builds use host Docker Buildx when available, otherwise the shared builder sandbox; see references/v3-publish-and-sign.md for the BUILDX_BUILDER and SBX_KIT_BUILDER selectors.
Install kit-tck from a pinned release or commit, not @latest, and record which one you used. The source's go install line uses @latest.

v3: publish and sign

Publishing is the build with --push: there is no pack step and no kit push subcommand. Push both platforms in one invocation, tag the version and latest together, and run kit-tck validate on the pushed reference. Signing is optional: sign the digest from --metadata-file, never the tag, and pin the whole certificate identity (repository, workflow file, and ref), not an organization prefix. Commands and reasoning are in references/v3-publish-and-sign.md.

A push writes to a registry and this skill cannot undo it. Get explicit approval for the exact registry, repository, and tags first, and use a scratch namespace for trials.

Safety boundaries and inverse operations

Never run source examples blindly. Build, run, push, and sign commands here are templates with placeholders; the operator runs them against disposable resources.
Inverse operations are destructive and need explicit confirmation: the named builder is removed with docker buildx rm kit-builder, a test sandbox with sbx rm (flags in docker-sandboxes-lifecycle), and local test images with docker rmi (see docker-destructive-guardrails). Name only what you created. Removing a sandbox instance deletes its volumes; host-mounted data survives and stays visible to the host user.
Keep descriptors, args, recipes, and build output free of secrets. Use credential@1 for credentials and let the host answer it.
A registry push, a tag move, and a signature are not reversible by this skill. State exactly what was pushed and signed.

Migrating from v2

The v2-to-v3 field mapping is not part of the supplied source material, so this skill does not map fields; do not guess one. For a request to convert a v2 spec.yaml: confirm the installed sbx can read v3, keep the v2 kit only as a reference for intent, and write the v3 kit as a new descriptor using the sections above. Check it with the v3 workflow (buildx, kit-tck, a real composition); do not substitute sbx kit validate for those checks. If the migrate-kit-to-v3 skill or its mapping is available in the user's environment, use it as an additional reference and say that it came from outside this catalog.

For the sandboxes a kit is composed into (sbx create/run --kit, and removing a test sandbox), use docker-sandboxes-lifecycle.
For what a kit's credential and network declarations mean at runtime (proxy injection, allow/deny precedence, the effective policy once global or per-sandbox policy is included, where the user stores a secret value), use docker-sandboxes-network-credentials. That skill's vocabulary is v2-era; for v3, the capability rules in this skill apply to what a kit asks for.
For the sbxenv.yaml file whose kits: and agent: fields reference a kit, use docker-sandboxes-env.
For Dockerfile and build practices beyond kit recipes, use docker-build-strategies.
Before removing builders, images, or volumes created while testing a kit, use docker-destructive-guardrails.

References

references/v3-capabilities.md — v3 descriptor skeleton, authoring forms, every capability type with common mistakes, volume and host-mount semantics, groups, and final-environment references.
references/v3-recipes.md — workload and mixin overlay recipes, ownership rules, and how to verify an overlay.
references/v3-publish-and-sign.md — publishing with buildx, tagging, cosign signing and verification, and tooling notes.
references/sources.md — provenance, unverified claims, and conflicts.

Assets

assets/v3-mixin-egress.yaml — a complete declaration-only v3 mixin (schemaVersion: "3") with a required network-policy request and optional explanatory agent context.

Checks

checks/verification.md — a manually exercised v3 runbook (inspect, buildx descriptor check, kit-tck, strict decoding, daemon-backed validation versus offline rejection, optional composition, scoped cleanup). It uses isolated names and no registry publishing or signing.
checks/runtime-results.md — 2026-11-02 commands, output, versions, pass/fail results, and the source-inspection limitation.
checks/authenticated-results.md — authenticated A2/A6/A7, original failures, descriptor correction, successful runtime checks and cleanup.
scripts/audit-layer-owners.py — fail-closed numeric ownership inventory of manifest-referenced OCI layers (Python 3.11+; uncompressed/gzip layers).

Files

ATTRIBUTION.mdAdded by AutoGineer834 B
LICENSELicence file added by AutoGineer11.1 KiB
SKILL.md18.5 KiB
agents/openai.yaml361 B
assets/v3-mixin-egress.yaml896 B
checks/authenticated-results.md36.4 KiB
checks/runtime-results.md16.0 KiB
checks/verification.md8.9 KiB
references/sources.md13.9 KiB
references/v3-capabilities.md18.0 KiB
references/v3-publish-and-sign.md8.3 KiB
references/v3-recipes.md12.7 KiB
scripts/audit-layer-owners.pyScript3.5 KiB
skill.yaml1.8 KiB

checks/authenticated-results.md

Authenticated v3 verification — 2026-11-02

Final verdict

Composition and runtime connectivity passed on sbx v0.50.1 after correcting the mixin's capability requirement. No Sandboxes code or installed binary was changed. The original failures are retained below.

Step	Original expectation	Actual result / corrected expectation
A1	Isolated builder and scratch	Pass on each attempt; reused only the explicitly authenticated app `kit-v3-1102`.
A2	Prints both typed capability names	Original expectation fails: normal inspect succeeds but shows a legacy-shaped summary. JSON includes the npm allow list, not raw capability declarations. Corrected A2 passes.
A3	cacheonly succeeds	Pass on corrected asset.
A4	TCK reports no failures	Pass: 19 checks, 19 passed. TCK descriptor inspection prints both capability types and optional context.
A5	Unknown `capabilites` fails	Pass: expected exit 1 names the misspelled field.
A6	Normal validate must fail	Original expectation contradicted: normal validation exits 0, `valid (directory)`. Offline exits 1 by design. Corrected A6 passes.
A7	Compose and observe host decision	Initially failed on required `agent-context@2`, then on workload name collision. After fixes, sandbox starts; policy allows npm:443; curl returns HTTP 200.
A8	Remove only test resources	Pass: sandbox, three named builders, all scratch directories, isolated daemon and app runtime state removed.

Versions and fixture

macOS arm64; installed /opt/homebrew/bin/sbx v0.50.1, revision ddb0268d7124b9cf98955d0b08ffd71a0dfcebe4.
Docker client/engine 29.9.1 / Desktop 4.96.0; Buildx v0.38.0, revision 0dbe87f36ed472fe36b6796c3f70b4210a731fc5.
TCK commit 4d932451613f8df89c8468e2bb7c5286882897ca, Go module version v3.0.0-m.11.0.20261031103226-4d932451613f, Go 1.26.10. The version command prints dev; build metadata retains the pin.
Kit frontend 3.0.0-m.11 (92835bb7): sha256:adbc0d1ea63451871d5d78111120bb29f2fd2b265e63d39c664ae2c3d722c805.
Trusted fixture: tests/e2e/kits/testdata/shell in the operator's Sandboxes checkout aaa96b72111a83a8326419630ab6ad18c0fde0c5. A disposable copy pins docker.io/sbx/shell-docker-image to index digest sha256:6c84996b07b743154fc8f26c662b642cee8fb6dd410803b2c40d5d3a537c838d and renames the companion pair to kit-probe/kit-probe.yaml and kit-probe/kit-probe.dockerfile. Its only capability is sbx@1; entrypoint is sh. The source checkout was not modified.

Corrections and limits

--app-name isolates credentials. The operator explicitly signed in to the test app. Offline is not a workaround: it deliberately omits the v3 builder. Both normal inspect and validate build/import through the daemon.
v0.50.1 uses newKitV2View for inspect JSON even for v3. Its output is a projection, not authoring YAML. TCK descriptor inspection is the verified way to see the raw typed requests in the exported layout.
Validation does not select all required capabilities for composition. The original asset validated but failed to run because v0.50.1 does not support required agent-context@2. The note is explanatory, so the asset now marks only that capability optional: true. Network policy remains required. Delivery of the optional note is not verified on this host.
A local workload named shell collides with v0.50.1's built-in agent. Renaming only the disposable fixture avoids it. Use --detach, not the runbook's earlier --detached spelling.
The successful test used the isolated app's balanced policy. Policy check reported "Allowed" and "Local policy only"; policy listing also reported managed governance. We record both outputs without generalizing governance semantics. HTTP 200 confirms connectivity, not that the mixin alone granted access: existing package-registry rules may also permit it. No differential deny/allow control or security-boundary test was performed.
The shipped descriptor is readable at /usr/share/sandbox/kit/extra-egress/kit.yaml, and exec ran as uid 1000. No arbitrary tool-overlay, cloud, publication, signing or other capability behavior is established by this test.
Cleanup removed 3.2 GiB of this app's runtime state after stopping its daemon. No default daemon/state was touched. The operator-created isolated keychain sign-in is preserved (no logout). Standard Go/download caches and Docker's shared builder image may remain; no global prune ran.

Commands and output

The three transcripts below retain failures and exit codes. $WORK replaces each run's generated short canonical temp directory, $SKILLS_REPO and $SANDBOXES_REPO replace checkout paths, and $HOME replaces the home path. The managed policy identifier is redacted. After the passing run, the asset's verification-status comment was updated; descriptor fields are unchanged. Each attempt used one zsh process:

unset DOCKER_CLI_PLUGIN_ORIGINAL_CLI_COMMAND DOCKER_CLI_PLUGIN_SOCKET
export NO_COLOR=1 BUILDKIT_PROGRESS=plain
APP=kit-v3-1102
WORK=$(mktemp -d /tmp/kit-v3.XXXXXX)
WORK=$(cd "$WORK" && pwd -P)
BUILDER="kit-live-$$"
export BUILDX_BUILDER="$BUILDER"
# Capture each exit code; continue expected failures; EXIT trap performs A8.
# Select the scratch TCK after installation: export PATH="$WORK/bin:$PATH"

Build commands with context . ran in $WORK/extra-egress or $WORK/typo as appropriate. Other commands use absolute paths. The first two attempts aborted A7 before sandbox creation, so their cleanup reports "not found"; the final attempt successfully removes the running sandbox. Only the last run reaches the policy, HTTP and in-sandbox descriptor checks.

Attempt 1: original required context

UTC: 2026-11-02T16:00:47Z
APP=kit-v3-1102
WORK=$WORK
BUILDER=kit-live-26464

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 version
sbx version v0.50.1 ddb0268d7124b9cf98955d0b08ffd71a0dfcebe4
[exit 0]

$ docker buildx version
github.com/docker/buildx v0.38.0 0dbe87f36ed472fe36b6796c3f70b4210a731fc5
[exit 0]

$ mkdir $WORK/extra-egress $WORK/shell $WORK/workspace
[exit 0]

$ cp $SKILLS_REPO/skills/docker-sandboxes-kits/assets/v3-mixin-egress.yaml $WORK/extra-egress/extra-egress.yaml
[exit 0]

$ cp $SANDBOXES_REPO/tests/e2e/kits/testdata/shell/shell.yaml $WORK/shell/shell.yaml
[exit 0]

$ python3 -c from\ pathlib\ import\ Path\;\ import\ sys\;\ p=Path\(sys.argv\[1\]\)\;\ Path\(sys.argv\[2\]\).write_text\(p.read_text\(\).replace\(\"docker.io/sbx/shell-docker-image:latest\",\ \"docker.io/sbx/shell-docker-image@sha256:6c84996b07b743154fc8f26c662b642cee8fb6dd410803b2c40d5d3a537c838d\"\)\) $SANDBOXES_REPO/tests/e2e/kits/testdata/shell/shell.dockerfile $WORK/shell/shell.dockerfile
[exit 0]

$ cat $WORK/shell/shell.yaml $WORK/shell/shell.dockerfile
# syntax=docker/sandbox-kit:3
schemaVersion: "3"
kind: workload
description: Shell workload for shortcut selection and reattachment.
capabilities:
  - type: com.docker.sandbox/sbx@1
# syntax=docker/dockerfile:1
FROM docker.io/sbx/shell-docker-image@sha256:6c84996b07b743154fc8f26c662b642cee8fb6dd410803b2c40d5d3a537c838d
ENTRYPOINT ["sh"]
[exit 0]

$ docker buildx create --name kit-live-26464 --driver docker-container --bootstrap
#1 [internal] booting buildkit
#1 pulling image moby/buildkit:buildx-stable-1
#1 pulling image moby/buildkit:buildx-stable-1 1.0s done
#1 creating container buildx_buildkit_kit-live-264640
#1 creating container buildx_buildkit_kit-live-264640 0.4s done
#1 DONE 1.4s
kit-live-26464
[exit 0]

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 daemon start --detach --policy balanced
  ✓ daemon — started (PID 26490)
      socket $HOME/.sbx/run_kit-v3-1102/d/sandboxd.sock
      logs $HOME/Library/Application Support/com.docker.sandboxes/sandboxes-kit-v3-1102/sandboxd/daemon.log
[exit 0]

=== A2 normal inspection ===

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 kit inspect $WORK/extra-egress

KITS
  ○ $WORK/extra-egress — building…
  ✓ $WORK/extra-egress — built (7s)
      sbx-kit-src:extra-egress-e50b7db3b40b

  Name:         extra-egress
  Kind:         mixin
  Schema:       v3
  Display:      Extra egress
  Description:  Requests runtime egress to the npm registry and says so to the agent.
  Template:     sbx-kit-src:extra-egress-e50b7db3b40b
  Policies:
    Network:    1 allow, 0 deny
[exit 0]

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 kit inspect $WORK/extra-egress --format json

KITS
  ✓ $WORK/extra-egress — cached
      sbx-kit-src:extra-egress-e50b7db3b40b
{
  "schemaVersion": "3",
  "kind": "mixin",
  "name": "extra-egress",
  "displayName": "Extra egress",
  "description": "Requests runtime egress to the npm registry and says so to the agent.",
  "sandbox": {
    "image": "sbx-kit-src:extra-egress-e50b7db3b40b"
  },
  "permissions": {
    "network": {
      "allow": [
        "registry.npmjs.org"
      ]
    }
  }
}
[exit 0]

=== A6 normal and offline validation ===

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 kit validate $WORK/extra-egress

KITS
  ✓ $WORK/extra-egress — cached
      sbx-kit-src:extra-egress-e50b7db3b40b
  ✓ $WORK/extra-egress — valid (directory)
[exit 0]

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 kit validate $WORK/extra-egress --offline
error: kit $WORK/extra-egress is a v3 source kit and this load path has no kit builder configured; artifact validation failed
[exit 1]

=== A7 runtime composition ===

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 run $WORK/shell --kit $WORK/extra-egress --detach --name kit-v3-check --cpus 2 --memory 2g $WORK/workspace

KITS
  ○ $WORK/shell — building…
  ✓ $WORK/shell — built (49s)
      sbx-kit-src:shell-884aec520dce
  ✓ $WORK/extra-egress — cached
      sbx-kit-src:extra-egress-e50b7db3b40b
error: resolve kits: $WORK/extra-egress:1:269: capabilities[1]: required capability selection rejected (item capabilities[1]); original source $WORK/extra-egress capabilities[1]; unsupported capability type com.docker.sandbox/agent-context@2   | 1 | {"schemaVersion":"3","displayName":"Extra egress","description":"Requests runtime egress to the npm registry and says so to the agent.","kind":"mixin","capabilities":[{"type":"com.docker.sandbox/network-policy@1","config":{"runtime":{"allow":["registry.npmjs.org"]}}},{"type":"com.docker.sandbox/agent-context@2","config":{"content":"This kit requests runtime egress to registry.npmjs.org. The host decides whether the request is granted."}}]}   |                                                                                                                                                                                                                                                                             ^
[exit 1]

=== A8 cleanup ===

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 rm --force kit-v3-check
error: sandbox 'kit-v3-check' not found
  try: sbx ls
[exit 1]

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 daemon stop
Stopped daemon
[exit 0]

$ docker buildx rm kit-live-26464
kit-live-26464 removed
[exit 0]

$ rm -rf $WORK
[exit 0]

$ test ! -e $WORK
[exit 0]

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 daemon status
  Status:  stopped
  Socket:  $HOME/.sbx/run_kit-v3-1102/d/sandboxd.sock (not connected)
[exit 0]

Attempt 2: optional context, workload name collision

UTC: 2026-11-02T16:02:23Z
APP=kit-v3-1102
WORK=$WORK
BUILDER=kit-live-26681

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 version
sbx version v0.50.1 ddb0268d7124b9cf98955d0b08ffd71a0dfcebe4
[exit 0]

$ docker buildx version
github.com/docker/buildx v0.38.0 0dbe87f36ed472fe36b6796c3f70b4210a731fc5
[exit 0]

$ mkdir $WORK/extra-egress $WORK/shell $WORK/workspace
[exit 0]

$ cp $SKILLS_REPO/skills/docker-sandboxes-kits/assets/v3-mixin-egress.yaml $WORK/extra-egress/extra-egress.yaml
[exit 0]

$ cp $SANDBOXES_REPO/tests/e2e/kits/testdata/shell/shell.yaml $WORK/shell/shell.yaml
[exit 0]

$ python3 -c from\ pathlib\ import\ Path\;\ import\ sys\;\ p=Path\(sys.argv\[1\]\)\;\ Path\(sys.argv\[2\]\).write_text\(p.read_text\(\).replace\(\"docker.io/sbx/shell-docker-image:latest\",\ \"docker.io/sbx/shell-docker-image@sha256:6c84996b07b743154fc8f26c662b642cee8fb6dd410803b2c40d5d3a537c838d\"\)\) $SANDBOXES_REPO/tests/e2e/kits/testdata/shell/shell.dockerfile $WORK/shell/shell.dockerfile
[exit 0]

$ cat $WORK/shell/shell.yaml $WORK/shell/shell.dockerfile
# syntax=docker/sandbox-kit:3
schemaVersion: "3"
kind: workload
description: Shell workload for shortcut selection and reattachment.
capabilities:
  - type: com.docker.sandbox/sbx@1
# syntax=docker/dockerfile:1
FROM docker.io/sbx/shell-docker-image@sha256:6c84996b07b743154fc8f26c662b642cee8fb6dd410803b2c40d5d3a537c838d
ENTRYPOINT ["sh"]
[exit 0]

$ docker buildx create --name kit-live-26681 --driver docker-container --bootstrap
#1 [internal] booting buildkit
#1 pulling image moby/buildkit:buildx-stable-1
#1 pulling image moby/buildkit:buildx-stable-1 0.9s done
#1 creating container buildx_buildkit_kit-live-266810
#1 creating container buildx_buildkit_kit-live-266810 0.4s done
#1 DONE 1.3s
kit-live-26681
[exit 0]

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 daemon start --detach --policy balanced
  ✓ daemon — started (PID 26707)
      socket $HOME/.sbx/run_kit-v3-1102/d/sandboxd.sock
      logs $HOME/Library/Application Support/com.docker.sandboxes/sandboxes-kit-v3-1102/sandboxd/daemon.log
[exit 0]

=== A2 normal inspection ===

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 kit inspect $WORK/extra-egress

KITS
  ○ $WORK/extra-egress — building…
  ✓ $WORK/extra-egress — built (2s)
      sbx-kit-src:extra-egress-53991acf39c0

  Name:         extra-egress
  Kind:         mixin
  Schema:       v3
  Display:      Extra egress
  Description:  Requests runtime egress to the npm registry and says so to the agent.
  Template:     sbx-kit-src:extra-egress-53991acf39c0
  Policies:
    Network:    1 allow, 0 deny
[exit 0]

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 kit inspect $WORK/extra-egress --format json

KITS
  ✓ $WORK/extra-egress — cached
      sbx-kit-src:extra-egress-53991acf39c0
{
  "schemaVersion": "3",
  "kind": "mixin",
  "name": "extra-egress",
  "displayName": "Extra egress",
  "description": "Requests runtime egress to the npm registry and says so to the agent.",
  "sandbox": {
    "image": "sbx-kit-src:extra-egress-53991acf39c0"
  },
  "permissions": {
    "network": {
      "allow": [
        "registry.npmjs.org"
      ]
    }
  }
}
[exit 0]

=== A6 normal and offline validation ===

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 kit validate $WORK/extra-egress

KITS
  ✓ $WORK/extra-egress — cached
      sbx-kit-src:extra-egress-53991acf39c0
  ✓ $WORK/extra-egress — valid (directory)
[exit 0]

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 kit validate $WORK/extra-egress --offline
error: kit $WORK/extra-egress is a v3 source kit and this load path has no kit builder configured; artifact validation failed
[exit 1]

=== Corrected asset conformance and strict decoding ===

$ mkdir $WORK/bin $WORK/typo
[exit 0]

$ env GOBIN=$WORK/bin go install github.com/docker/sandbox-kit-spec/v3/cmd/kit-tck@4d932451613f8df89c8468e2bb7c5286882897ca
go: github.com/docker/sandbox-kit-spec/[email protected] requires go >= 1.26.10; switching to go1.26.10
[exit 0]

$ kit-tck version
dev
[exit 0]

$ go version -m $WORK/bin/kit-tck
$WORK/bin/kit-tck: go1.26.10
	path	github.com/docker/sandbox-kit-spec/v3/cmd/kit-tck
	mod	github.com/docker/sandbox-kit-spec/v3	v3.0.0-m.11.0.20261031103226-4d932451613f	h1:dS5huJIhcyTPidx3Z/+gS6vKwv1N/ttTzJJiXvOnj2U=
	dep	github.com/containerd/log	v0.2.0	h1:BewD/umNgVnoczglOpX8eRMyEy5t5iPlu5AIpnWDONc=
	dep	github.com/containerd/platforms	v1.0.0-rc.5	h1:vXd569rDrz8LeMXzAnBsy6LADV5YtsD8oyaRarxdmSU=
	dep	github.com/distribution/reference	v0.6.0	h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
	dep	github.com/klauspost/compress	v1.20.3	h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=
	dep	github.com/opencontainers/go-digest	v1.0.0	h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
	dep	github.com/opencontainers/image-spec	v1.1.1	h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
	dep	github.com/sirupsen/logrus	v1.10.2	h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=
	dep	golang.org/x/crypto	v0.58.0	h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
	dep	golang.org/x/sync	v0.24.0	h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
	dep	golang.org/x/sys	v0.49.0	h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
	dep	golang.org/x/term	v0.47.0	h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
	dep	gopkg.in/yaml.v3	v3.0.1	h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
	dep	oras.land/oras-go/v2	v2.6.4	h1:l4uv+UT7QK4Hju+KOEZ/c8iOjq3iZH7cULoRpUnSDAU=
	build	-buildmode=exe
	build	-compiler=gc
	build	CGO_ENABLED=1
	build	CGO_CFLAGS=
	build	CGO_CPPFLAGS=
	build	CGO_CXXFLAGS=
	build	CGO_LDFLAGS=
	build	GOARCH=arm64
	build	GOOS=darwin
	build	GOARM64=v8.0
[exit 0]

$ docker buildx build --builder kit-live-26681 . -f extra-egress.yaml --output type=cacheonly
#0 building with "kit-live-26681" instance using docker-container driver

#1 [internal] load build definition from extra-egress.yaml
#1 transferring dockerfile: 937B done
#1 DONE 0.0s

#2 resolve image config for docker-image://docker.io/docker/sandbox-kit:3
#2 DONE 0.2s

#3 docker-image://docker.io/docker/sandbox-kit:3@sha256:adbc0d1ea63451871d5d78111120bb29f2fd2b265e63d39c664ae2c3d722c805
#3 resolve docker.io/docker/sandbox-kit:3@sha256:adbc0d1ea63451871d5d78111120bb29f2fd2b265e63d39c664ae2c3d722c805 done
#3 CACHED

#4 [internal] load kit descriptor extra-egress.yaml · sandbox-kit 3.0.0-m.11 (92835bb7)
#4 transferring dockerfile: 39B done
#4 DONE 0.0s

#5 [kit] stage sources /usr/share/sandbox/kit/extra-egress
#5 CACHED

View build details: docker-desktop://dashboard/build/kit-live-26681/kit-live-266810/my12u8y0ig64biaq8brjjy0zd
[exit 0]

$ docker buildx build --builder kit-live-26681 . -f extra-egress.yaml -t extra-egress:0.0.0 --output type=oci,dest=$WORK/layout,tar=false
#0 building with "kit-live-26681" instance using docker-container driver

#1 [internal] load build definition from extra-egress.yaml
#1 transferring dockerfile: 937B done
#1 DONE 0.0s

#2 resolve image config for docker-image://docker.io/docker/sandbox-kit:3
#2 DONE 0.2s

#3 docker-image://docker.io/docker/sandbox-kit:3@sha256:adbc0d1ea63451871d5d78111120bb29f2fd2b265e63d39c664ae2c3d722c805
#3 resolve docker.io/docker/sandbox-kit:3@sha256:adbc0d1ea63451871d5d78111120bb29f2fd2b265e63d39c664ae2c3d722c805 done
#3 CACHED

#4 [internal] load kit descriptor extra-egress.yaml · sandbox-kit 3.0.0-m.11 (92835bb7)
#4 transferring dockerfile: 39B done
#4 DONE 0.0s

#5 [kit] stage sources /usr/share/sandbox/kit/extra-egress
#5 CACHED

#6 exporting to oci image format
#6 exporting layers done
#6 exporting manifest sha256:731ae4ec7a2d7ba09a0576a4c3f7a6fcc493364dc30ea1c048bdbe91a07fc5db done
#6 exporting config sha256:98526907c4ac9bdccc85a81963d9582347b613a8c23e24aee9e7d0367eceb283 done
#6 DONE 0.0s

View build details: docker-desktop://dashboard/build/kit-live-26681/kit-live-266810/pjc85rocit5jtkc69abrdd5if
[exit 0]

$ kit-tck validate --layout $WORK/layout 0.0.0
kit-tck dev · validate · $WORK/layout 0.0.0

  19 checks · 19 passed

✓ conforms
[exit 0]

$ kit-tck inspect --descriptor --layout $WORK/layout 0.0.0
schemaVersion: "3"
displayName: Extra egress
description: Requests runtime egress to the npm registry and says so to the agent.
kind: mixin
capabilities:
  - type: com.docker.sandbox/network-policy@1
    config:
      runtime:
        allow:
          - registry.npmjs.org
  - type: com.docker.sandbox/agent-context@2
    optional: true
    config:
      content: This kit requests runtime egress to registry.npmjs.org. The host decides whether the request is granted.
[exit 0]

$ python3 -c from\ pathlib\ import\ Path\;\ import\ sys\;\ Path\(sys.argv\[2\]\).write_text\(Path\(sys.argv\[1\]\).read_text\(\).replace\(\"capabilities:\",\"capabilites:\",1\)\) $WORK/extra-egress/extra-egress.yaml $WORK/typo/typo.yaml
[exit 0]

$ docker buildx build --builder kit-live-26681 . -f typo.yaml --output type=cacheonly
#0 building with "kit-live-26681" instance using docker-container driver

#1 [internal] load build definition from typo.yaml
#1 transferring dockerfile: 928B done
#1 DONE 0.0s

#2 resolve image config for docker-image://docker.io/docker/sandbox-kit:3
#2 DONE 0.2s

#3 docker-image://docker.io/docker/sandbox-kit:3@sha256:adbc0d1ea63451871d5d78111120bb29f2fd2b265e63d39c664ae2c3d722c805
#3 resolve docker.io/docker/sandbox-kit:3@sha256:adbc0d1ea63451871d5d78111120bb29f2fd2b265e63d39c664ae2c3d722c805 done
#3 CACHED

#4 [internal] load kit descriptor typo.yaml · sandbox-kit 3.0.0-m.11 (92835bb7)
#4 transferring dockerfile: 928B done
#4 DONE 0.0s
ERROR: failed to build: failed to solve: decode kit descriptor: yaml: unmarshal errors:
  line 10: field capabilites not found in type spec.Descriptor

View build details: docker-desktop://dashboard/build/kit-live-26681/kit-live-266810/fwj4sug32v94ddyhgth6bixaj
[exit 1]

=== A7 runtime composition ===

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 run $WORK/shell --kit $WORK/extra-egress --detach --name kit-v3-check --cpus 2 --memory 2g $WORK/workspace

KITS
  ✓ $WORK/shell — cached
      sbx-kit-src:shell-884aec520dce
  ✓ $WORK/extra-egress — cached
      sbx-kit-src:extra-egress-53991acf39c0
error: agent "shell" is already registered (built-in agents cannot be overridden by a kit)
[exit 1]

=== A8 cleanup ===

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 rm --force kit-v3-check
error: sandbox 'kit-v3-check' not found
  try: sbx ls
[exit 1]

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 daemon stop
Stopped daemon
[exit 0]

$ docker buildx rm kit-live-26681
kit-live-26681 removed
[exit 0]

$ rm -rf $WORK
[exit 0]

$ test ! -e $WORK
[exit 0]

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 daemon status
  Status:  stopped
  Socket:  $HOME/.sbx/run_kit-v3-1102/d/sandboxd.sock (not connected)
[exit 0]

Attempt 3: corrected mixin and renamed workload

UTC: 2026-11-02T16:02:55Z
APP=kit-v3-1102
WORK=$WORK
BUILDER=kit-live-26938

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 version
sbx version v0.50.1 ddb0268d7124b9cf98955d0b08ffd71a0dfcebe4
[exit 0]

$ docker buildx version
github.com/docker/buildx v0.38.0 0dbe87f36ed472fe36b6796c3f70b4210a731fc5
[exit 0]

$ mkdir $WORK/extra-egress $WORK/kit-probe $WORK/workspace
[exit 0]

$ cp $SKILLS_REPO/skills/docker-sandboxes-kits/assets/v3-mixin-egress.yaml $WORK/extra-egress/extra-egress.yaml
[exit 0]

$ cp $SANDBOXES_REPO/tests/e2e/kits/testdata/shell/shell.yaml $WORK/kit-probe/kit-probe.yaml
[exit 0]

$ python3 -c from\ pathlib\ import\ Path\;\ import\ sys\;\ p=Path\(sys.argv\[1\]\)\;\ Path\(sys.argv\[2\]\).write_text\(p.read_text\(\).replace\(\"docker.io/sbx/shell-docker-image:latest\",\ \"docker.io/sbx/shell-docker-image@sha256:6c84996b07b743154fc8f26c662b642cee8fb6dd410803b2c40d5d3a537c838d\"\)\) $SANDBOXES_REPO/tests/e2e/kits/testdata/shell/shell.dockerfile $WORK/kit-probe/kit-probe.dockerfile
[exit 0]

$ cat $WORK/kit-probe/kit-probe.yaml $WORK/kit-probe/kit-probe.dockerfile
# syntax=docker/sandbox-kit:3
schemaVersion: "3"
kind: workload
description: Shell workload for shortcut selection and reattachment.
capabilities:
  - type: com.docker.sandbox/sbx@1
# syntax=docker/dockerfile:1
FROM docker.io/sbx/shell-docker-image@sha256:6c84996b07b743154fc8f26c662b642cee8fb6dd410803b2c40d5d3a537c838d
ENTRYPOINT ["sh"]
[exit 0]

$ docker buildx create --name kit-live-26938 --driver docker-container --bootstrap
#1 [internal] booting buildkit
#1 pulling image moby/buildkit:buildx-stable-1
#1 pulling image moby/buildkit:buildx-stable-1 0.9s done
#1 creating container buildx_buildkit_kit-live-269380
#1 creating container buildx_buildkit_kit-live-269380 0.4s done
#1 DONE 1.3s
kit-live-26938
[exit 0]

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 daemon start --detach --policy balanced
  ✓ daemon — started (PID 26963)
      socket $HOME/.sbx/run_kit-v3-1102/d/sandboxd.sock
      logs $HOME/Library/Application Support/com.docker.sandboxes/sandboxes-kit-v3-1102/sandboxd/daemon.log
[exit 0]

=== A2 normal inspection ===

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 kit inspect $WORK/extra-egress

KITS
  ✓ $WORK/extra-egress — cached
      sbx-kit-src:extra-egress-53991acf39c0

  Name:         extra-egress
  Kind:         mixin
  Schema:       v3
  Display:      Extra egress
  Description:  Requests runtime egress to the npm registry and says so to the agent.
  Template:     sbx-kit-src:extra-egress-53991acf39c0
  Policies:
    Network:    1 allow, 0 deny
[exit 0]

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 kit inspect $WORK/extra-egress --format json

KITS
  ✓ $WORK/extra-egress — cached
      sbx-kit-src:extra-egress-53991acf39c0
{
  "schemaVersion": "3",
  "kind": "mixin",
  "name": "extra-egress",
  "displayName": "Extra egress",
  "description": "Requests runtime egress to the npm registry and says so to the agent.",
  "sandbox": {
    "image": "sbx-kit-src:extra-egress-53991acf39c0"
  },
  "permissions": {
    "network": {
      "allow": [
        "registry.npmjs.org"
      ]
    }
  }
}
[exit 0]

=== A6 normal and offline validation ===

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 kit validate $WORK/extra-egress

KITS
  ✓ $WORK/extra-egress — cached
      sbx-kit-src:extra-egress-53991acf39c0
  ✓ $WORK/extra-egress — valid (directory)
[exit 0]

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 kit validate $WORK/extra-egress --offline
error: kit $WORK/extra-egress is a v3 source kit and this load path has no kit builder configured; artifact validation failed
[exit 1]

=== Corrected asset conformance and strict decoding ===

$ mkdir $WORK/bin $WORK/typo
[exit 0]

$ env GOBIN=$WORK/bin go install github.com/docker/sandbox-kit-spec/v3/cmd/kit-tck@4d932451613f8df89c8468e2bb7c5286882897ca
go: github.com/docker/sandbox-kit-spec/[email protected] requires go >= 1.26.10; switching to go1.26.10
[exit 0]

$ kit-tck version
dev
[exit 0]

$ go version -m $WORK/bin/kit-tck
$WORK/bin/kit-tck: go1.26.10
	path	github.com/docker/sandbox-kit-spec/v3/cmd/kit-tck
	mod	github.com/docker/sandbox-kit-spec/v3	v3.0.0-m.11.0.20261031103226-4d932451613f	h1:dS5huJIhcyTPidx3Z/+gS6vKwv1N/ttTzJJiXvOnj2U=
	dep	github.com/containerd/log	v0.2.0	h1:BewD/umNgVnoczglOpX8eRMyEy5t5iPlu5AIpnWDONc=
	dep	github.com/containerd/platforms	v1.0.0-rc.5	h1:vXd569rDrz8LeMXzAnBsy6LADV5YtsD8oyaRarxdmSU=
	dep	github.com/distribution/reference	v0.6.0	h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
	dep	github.com/klauspost/compress	v1.20.3	h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=
	dep	github.com/opencontainers/go-digest	v1.0.0	h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
	dep	github.com/opencontainers/image-spec	v1.1.1	h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
	dep	github.com/sirupsen/logrus	v1.10.2	h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo=
	dep	golang.org/x/crypto	v0.58.0	h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
	dep	golang.org/x/sync	v0.24.0	h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
	dep	golang.org/x/sys	v0.49.0	h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
	dep	golang.org/x/term	v0.47.0	h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
	dep	gopkg.in/yaml.v3	v3.0.1	h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
	dep	oras.land/oras-go/v2	v2.6.4	h1:l4uv+UT7QK4Hju+KOEZ/c8iOjq3iZH7cULoRpUnSDAU=
	build	-buildmode=exe
	build	-compiler=gc
	build	CGO_ENABLED=1
	build	CGO_CFLAGS=
	build	CGO_CPPFLAGS=
	build	CGO_CXXFLAGS=
	build	CGO_LDFLAGS=
	build	GOARCH=arm64
	build	GOOS=darwin
	build	GOARM64=v8.0
[exit 0]

$ docker buildx build --builder kit-live-26938 . -f extra-egress.yaml --output type=cacheonly
#0 building with "kit-live-26938" instance using docker-container driver

#1 [internal] load build definition from extra-egress.yaml
#1 transferring dockerfile: 937B done
#1 DONE 0.0s

#2 resolve image config for docker-image://docker.io/docker/sandbox-kit:3
#2 ...

#3 [auth] docker/sandbox-kit:pull token for registry-1.docker.io
#3 DONE 0.0s

#2 resolve image config for docker-image://docker.io/docker/sandbox-kit:3
#2 DONE 1.2s

#4 docker-image://docker.io/docker/sandbox-kit:3@sha256:adbc0d1ea63451871d5d78111120bb29f2fd2b265e63d39c664ae2c3d722c805
#4 resolve docker.io/docker/sandbox-kit:3@sha256:adbc0d1ea63451871d5d78111120bb29f2fd2b265e63d39c664ae2c3d722c805 done
#4 sha256:e82cb93883f6d13d4487a7059dded45fd79fdec4147dfc96d597285c8b5cca38 0B / 6.70MB 0.2s
#4 sha256:e82cb93883f6d13d4487a7059dded45fd79fdec4147dfc96d597285c8b5cca38 1.05MB / 6.70MB 0.6s
#4 sha256:e82cb93883f6d13d4487a7059dded45fd79fdec4147dfc96d597285c8b5cca38 2.10MB / 6.70MB 0.9s
#4 sha256:e82cb93883f6d13d4487a7059dded45fd79fdec4147dfc96d597285c8b5cca38 3.15MB / 6.70MB 1.4s
#4 sha256:e82cb93883f6d13d4487a7059dded45fd79fdec4147dfc96d597285c8b5cca38 4.19MB / 6.70MB 1.7s
#4 sha256:e82cb93883f6d13d4487a7059dded45fd79fdec4147dfc96d597285c8b5cca38 5.24MB / 6.70MB 2.1s
#4 sha256:e82cb93883f6d13d4487a7059dded45fd79fdec4147dfc96d597285c8b5cca38 6.29MB / 6.70MB 2.4s
#4 sha256:e82cb93883f6d13d4487a7059dded45fd79fdec4147dfc96d597285c8b5cca38 6.70MB / 6.70MB 2.5s done
#4 extracting sha256:e82cb93883f6d13d4487a7059dded45fd79fdec4147dfc96d597285c8b5cca38 0.1s done
#4 DONE 2.6s

#5 [internal] load kit descriptor extra-egress.yaml · sandbox-kit 3.0.0-m.11 (92835bb7)
#5 transferring dockerfile: 937B done
#5 DONE 0.0s

#6 [kit] stage sources /usr/share/sandbox/kit/extra-egress
#6 DONE 0.0s

View build details: docker-desktop://dashboard/build/kit-live-26938/kit-live-269380/c9l2bydydlduvo1zscryojtiq
[exit 0]

$ docker buildx build --builder kit-live-26938 . -f extra-egress.yaml -t extra-egress:0.0.0 --output type=oci,dest=$WORK/layout,tar=false
#0 building with "kit-live-26938" instance using docker-container driver

#1 [internal] load build definition from extra-egress.yaml
#1 transferring dockerfile: 937B done
#1 DONE 0.0s

#2 resolve image config for docker-image://docker.io/docker/sandbox-kit:3
#2 DONE 0.2s

#3 docker-image://docker.io/docker/sandbox-kit:3@sha256:adbc0d1ea63451871d5d78111120bb29f2fd2b265e63d39c664ae2c3d722c805
#3 resolve docker.io/docker/sandbox-kit:3@sha256:adbc0d1ea63451871d5d78111120bb29f2fd2b265e63d39c664ae2c3d722c805 done
#3 CACHED

#4 [internal] load kit descriptor extra-egress.yaml · sandbox-kit 3.0.0-m.11 (92835bb7)
#4 transferring dockerfile: 39B done
#4 DONE 0.0s

#5 [kit] stage sources /usr/share/sandbox/kit/extra-egress
#5 CACHED

#6 exporting to oci image format
#6 exporting layers 0.0s done
#6 exporting manifest sha256:b45820c1c7cfc2cd6c8c10b46dc26bd0f427f20786fbd2b87fbb75ca99ab6832 done
#6 exporting config sha256:dcb9a44b48756814f2edca2bf71147996c18784a65755557bc7902e9d98d8b13 done
#6 DONE 0.1s

View build details: docker-desktop://dashboard/build/kit-live-26938/kit-live-269380/r593fau2jbcwud213rgvm0zam
[exit 0]

$ kit-tck validate --layout $WORK/layout 0.0.0
kit-tck dev · validate · $WORK/layout 0.0.0

  19 checks · 19 passed

✓ conforms
[exit 0]

$ kit-tck inspect --descriptor --layout $WORK/layout 0.0.0
schemaVersion: "3"
displayName: Extra egress
description: Requests runtime egress to the npm registry and says so to the agent.
kind: mixin
capabilities:
  - type: com.docker.sandbox/network-policy@1
    config:
      runtime:
        allow:
          - registry.npmjs.org
  - type: com.docker.sandbox/agent-context@2
    optional: true
    config:
      content: This kit requests runtime egress to registry.npmjs.org. The host decides whether the request is granted.
[exit 0]

$ python3 -c from\ pathlib\ import\ Path\;\ import\ sys\;\ Path\(sys.argv\[2\]\).write_text\(Path\(sys.argv\[1\]\).read_text\(\).replace\(\"capabilities:\",\"capabilites:\",1\)\) $WORK/extra-egress/extra-egress.yaml $WORK/typo/typo.yaml
[exit 0]

$ docker buildx build --builder kit-live-26938 . -f typo.yaml --output type=cacheonly
#0 building with "kit-live-26938" instance using docker-container driver

#1 [internal] load build definition from typo.yaml
#1 transferring dockerfile: 928B done
#1 DONE 0.0s

#2 resolve image config for docker-image://docker.io/docker/sandbox-kit:3
#2 DONE 0.3s

#3 docker-image://docker.io/docker/sandbox-kit:3@sha256:adbc0d1ea63451871d5d78111120bb29f2fd2b265e63d39c664ae2c3d722c805
#3 resolve docker.io/docker/sandbox-kit:3@sha256:adbc0d1ea63451871d5d78111120bb29f2fd2b265e63d39c664ae2c3d722c805 done
#3 CACHED

#4 [internal] load kit descriptor typo.yaml · sandbox-kit 3.0.0-m.11 (92835bb7)
#4 transferring dockerfile: 928B done
#4 DONE 0.0s
ERROR: failed to build: failed to solve: decode kit descriptor: yaml: unmarshal errors:
  line 10: field capabilites not found in type spec.Descriptor

View build details: docker-desktop://dashboard/build/kit-live-26938/kit-live-269380/c5j2nrmc8uw2dmtrtctdfvvsz
[exit 1]

=== A7 runtime composition ===

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 run $WORK/kit-probe --kit $WORK/extra-egress --detach --name kit-v3-check --cpus 2 --memory 2g $WORK/workspace

KITS
  ○ $WORK/kit-probe — building…
  ✓ $WORK/kit-probe — built (4m31s)
      sbx-kit-src:kit-probe-6f3084bb320f
  ✓ $WORK/extra-egress — cached
      sbx-kit-src:extra-egress-53991acf39c0

SANDBOX
  Name:       kit-v3-check
  Agent:      kit-probe
  Kits:       $WORK/kit-probe
              $WORK/extra-egress
  Workspace:  $WORK/workspace (rw)
  Image:      sbx-kit-src:kit-probe-6f3084bb320f
  CPU:        2
  Memory:     2g

IMAGE
  ○ image — checking…
  ✓ image — ready

AGENT
    assembling kit image from 2 kits
    pulling kit image $WORK/extra-egress
  ✓ assembled kit image (19 layers)

  ✓ Created sandbox kit-v3-check

  ✓ sandbox kit-v3-check — running detached
      workspace $WORK/workspace
c897aa43-4036-481f-b70a-90d00fbc477a
[exit 0]

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 policy check network --sandbox kit-v3-check registry.npmjs.org
  Allowed:     registry.npmjs.org:443
  Governance:  Local policy only
  Context:     sandbox:kit-v3-check
[exit 0]

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 policy ls kit-v3-check
  Policy for sandbox:  kit-v3-check
Governance: Managed by docker · Sync: OK, last synced 17:07:59


NETWORK
  • allow 196 hosts from [managed-policy-id], local-policy

FILESYSTEM
  • read allow all paths from local-policy
  • write allow all paths from local-policy

[exit 0]

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 exec kit-v3-check curl --max-time 30 --silent --show-error --output /dev/null --write-out HTTP\ %\{http_code\}\\n https://registry.npmjs.org/
HTTP 200
[exit 0]

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 exec kit-v3-check sh -c id\;\ ls\ /usr/share/sandbox/kit\;\ cat\ /usr/share/sandbox/kit/extra-egress/kit.yaml
uid=1000(agent) gid=1000(agent) groups=1000(agent),27(sudo),1001(docker)
extra-egress
kit-probe
# syntax=docker/sandbox-kit:3
# Complete declaration-only v3 mixin. Save it as <kit>/<kit>.yaml (for example
# extra-egress/extra-egress.yaml). It ships no content, so it needs no companion
# <kit>.dockerfile. Build and conformance tested; runtime grants remain untested.
# Recheck on your tools before relying on it (see checks/verification.md).
schemaVersion: "3"
kind: mixin
displayName: Extra egress
description: Requests runtime egress to the npm registry and says so to the agent.
capabilities:
    - type: com.docker.sandbox/network-policy@1
      config:
        runtime:
            allow: [registry.npmjs.org]
    - type: com.docker.sandbox/agent-context@2
      # Explanatory only: older hosts may omit this note, but not the network request.
      optional: true
      config:
        content: This kit requests runtime egress to registry.npmjs.org. The host decides whether the request is granted.
[exit 0]

=== A8 cleanup ===

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 rm --force kit-v3-check
Removed sandbox kit-v3-check
[exit 0]

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 daemon stop
Stopped daemon
[exit 0]

$ docker buildx rm kit-live-26938
kit-live-26938 removed
[exit 0]

$ rm -rf $WORK
[exit 0]

$ test ! -e $WORK
[exit 0]

$ /opt/homebrew/bin/sbx --app-name kit-v3-1102 daemon status
  Status:  stopped
  Socket:  $HOME/.sbx/run_kit-v3-1102/d/sandboxd.sock (not connected)
[exit 0]

Final app-scoped cleanup

Scoped cleanup after daemon stop (credentials preserved; no logout)
$ du -sh $HOME/Library/Application\ Support/com.docker.sandboxes/sandboxes-kit-v3-1102
3.2G	$HOME/Library/Application Support/com.docker.sandboxes/sandboxes-kit-v3-1102
$ pgrep -lf sandboxes-kit-v3-1102
[exit 1; 1 means no matching process]
$ rm -rf $HOME/Library/Application\ Support/com.docker.sandboxes/sandboxes-kit-v3-1102 $HOME/.sbx/run_kit-v3-1102 /tmp/sboxd-501-sandboxes-kit-v3-1102
PASS: absent: $HOME/Library/Application Support/com.docker.sandboxes/sandboxes-kit-v3-1102
PASS: absent: $HOME/.sbx/run_kit-v3-1102
PASS: absent: /tmp/sboxd-501-sandboxes-kit-v3-1102
$ docker ps --filter name=kit-live- --format {{.Names}}

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs a command-line tool, Needs Python

The author says: Experimental. Needs docker buildx, kit-tck, and an sbx release with Kits v3 support (adapted from docker/sandbox-kit-spec at 4d932451613f8df89c8468e2bb7c5286882897ca; build/conformance tested 2026-11-02; authenticated inspect/validate and composition tested on sbx v0.50.1 with optional agent-context@2). Not the legacy docker sandbox wrapper. See references/sources.md.

Security

What our scanner noticed· Low risk

Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by

Docker

Publisher

Docker (Official)

Source

docker/skills · skills/docker-sandboxes-kits · commit 9f04a05

Licence

Apache License 2.0 (redistribution allowed)

LICENSE (added by AutoGineer from LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-08

AutoGineer is not affiliated with or endorsed by Docker.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download docker-sandboxes-kits.zip