docker-sandboxes

A collection of Docker sandbox kits (v3 descriptor). Each kit lives under kits/<name>/ as a self-contained companion pair — descriptor, content recipe, agent-context body and README — found by filename stem:

kits/<name>/
  <name>.yaml           # the descriptor; first line `# syntax=docker/sandbox-kit:3`
  <name>.dockerfile      # the content recipe
  <name>-context.md     # agent-context body
  README.md

Kits

Kit	Kind	What it adds
mise	mixin	mise-en-place (mise), the polyglot tool version/task manager, as a pinned static binary — no mise.toml orchestration

Using a kit

Published kits live at ghcr.io/labset/docker-sandboxes, one moving tag per kit (:<kit>) plus an immutable per-version tag (:<kit>-<version>).

Compose a kit onto a sandbox with sbx (see Docker Docs to install it). A composition needs exactly one workload-kind kit as its base — these examples use Docker's published v3 docker/sbx-kit-claude, but any v3 workload kit works. Mixing a v3 mixin like mise onto the bare claude built-in shortcut fails: that shortcut still resolves to a legacy v2 kit, and v2 and v3 kits can't be composed together.

# latest published mise
sbx run docker/sbx-kit-claude --kit ghcr.io/labset/docker-sandboxes:mise

# pinned to a specific version
sbx run docker/sbx-kit-claude --kit ghcr.io/labset/docker-sandboxes:mise-2026.9.16

Or use a local checkout while developing:

sbx run docker/sbx-kit-claude --kit ./kits/mise

Each kit's own README documents what it installs, the network access it declares and how to extend it.

Contributing

Adding a kit, the build/verify tooling and CI are covered in CONTRIBUTING.md.