sha256:9cb01a0a420e61dd1efeaa03f73d73d0a591728baa46452af01ccd1c3345420b
Last pushed
4 days by ajeetraina777
Type
Sandbox Kit
Manifest digest
sha256:9cb01a0a420e61dd1efeaa03f73d73d0a591728baa46452af01ccd1c3345420b
schemaVersion: "3"
displayName: Datadog AI Guard
author: Ajeet Singh Raina
description: Installs the Datadog AI Guard SDKs (Python ddtrace + Node dd-trace) and wires agentless credentials/env so AI apps and agents built inside the sandbox can screen LLM prompts, tool calls, and outputs for prompt injection, jailbreaks, tool misuse, and sensitive-data exfiltration via client.evaluate(...). Datadog API/APP keys are proxy-injected and never enter the container. Sets DD_* environment variables (last-wins if a later --kit overrides them). Layer it onto any agent base (claude, codex, gemini, …); no agent affinity.
sourceUrl: https://github.com/ajeetraina/sbx-kits-datadog
version: 0.1.0
licenses:
- Apache-2.0
kind: mixin
capabilities:
- type: com.docker.sandbox/credential@1
config:
apiKey:
inject:
- domain: app.${{ kit.args.site }}
format: '%s'
header: DD-API-KEY
- domain: ${{ kit.args.site }}
format: '%s'
header: DD-API-KEY
- domain: trace.agent.${{ kit.args.site }}
format: '%s'
header: DD-Api-Key
- domain: api.${{ kit.args.site }}
format: '%s'
header: DD-API-KEY
name: DD_API_KEY
proxyManaged: true
phase: runtime
service: datadogapi
description: Datadog API key (sent as the DD-API-KEY header).
- type: com.docker.sandbox/credential@1
config:
apiKey:
inject:
- domain: app.${{ kit.args.site }}
format: '%s'
header: DD-APPLICATION-KEY
- domain: ${{ kit.args.site }}
format: '%s'
header: DD-APPLICATION-KEY
name: DD_APP_KEY
proxyManaged: true
phase: runtime
service: datadogapp
description: Datadog application key (sent as the DD-APPLICATION-KEY header).
- type: com.docker.sandbox/network-policy@1
config:
install:
allow:
- pypi.org
- files.pythonhosted.org
- registry.npmjs.org
runtime:
allow:
- app.${{ kit.args.site }}
- ${{ kit.args.site }}
- '*.${{ kit.args.site }}'
- trace.agent.${{ kit.args.site }}
- api.${{ kit.args.site }}
- pypi.org
- files.pythonhosted.org
- registry.npmjs.org
- registry-1.docker.io
- auth.docker.io
- production.cloudflare.docker.com
- type: com.docker.sandbox/lifecycle@1
config:
install:
- command: 'command -v python3 >/dev/null 2>&1 && (python3 -c ''import ddtrace'' 2>/dev/null || python3 -m pip install --break-system-packages ''ddtrace>=3.19.0'' || python3 -m pip install ''ddtrace>=3.19.0'') || echo ''datadog-ai-guard: python3 not found, skipping ddtrace'''
description: Install the Datadog Python SDK (ddtrace) for AI Guard
env:
- HTTP_PROXY
- HTTPS_PROXY
- NO_PROXY
- http_proxy
- https_proxy
- no_proxy
- SSL_CERT_FILE
- SSL_CERT_DIR
- CURL_CA_BUNDLE
- REQUESTS_CA_BUNDLE
- PIP_CERT
- command: |
command -v python3 >/dev/null 2>&1 && python3 -c '
import glob, os, sysconfig, site, shutil
cands = glob.glob("/home/*/.datadog/_sbx_proxy_tunnel.py") + ["/root/.datadog/_sbx_proxy_tunnel.py"]
src = next((c for c in cands if os.path.isfile(c)), None)
if not src:
print("datadog-ai-guard: proxy shim source not found; SDK calls may 401"); raise SystemExit(0)
dirs = set()
try:
dirs.update(p for p in site.getsitepackages() if p)
except Exception:
pass
for k in ("purelib", "platlib"):
p = sysconfig.get_paths().get(k)
if p:
dirs.add(p)
done = []
for d in dirs:
try:
os.makedirs(d, exist_ok=True)
shutil.copyfile(src, os.path.join(d, "_sbx_proxy_tunnel.py"))
with open(os.path.join(d, "aaa_sbx_proxy_tunnel.pth"), "w") as f:
f.write("import _sbx_proxy_tunnel\n")
done.append(d)
except Exception:
pass
print("datadog-ai-guard: proxy tunnel shim installed ->", done or "(no writable site dir)")
' || echo "datadog-ai-guard: python3 not found, skipping proxy shim"
description: Route Python stdlib HTTPS through the sbx proxy so the AI Guard SDK works
- command: 'command -v npm >/dev/null 2>&1 && (npm ls -g dd-trace >/dev/null 2>&1 || npm install -g ''dd-trace@^5.69.0'') || echo ''datadog-ai-guard: npm not found, skipping dd-trace'''
description: Install the Datadog Node SDK (dd-trace) for AI Guard
env:
- HTTP_PROXY
- HTTPS_PROXY
- NO_PROXY
- http_proxy
- https_proxy
- no_proxy
- SSL_CERT_FILE
- SSL_CERT_DIR
- CURL_CA_BUNDLE
- NODE_EXTRA_CA_CERTS
- NPM_CONFIG_PREFIX
user: agent
startup:
- background: false
command: |
if [ "${{ kit.args.apm }}" != "true" ]; then
echo "datadog-ai-guard: apm=false (agentless) — skipping Datadog Agent; evaluate() still returns live verdicts."
elif ! command -v docker >/dev/null 2>&1; then
echo "datadog-ai-guard: apm=true but docker is unavailable — cannot run the trace Agent."
else
s="$(ls /home/*/.datadog/start-agent.sh /root/.datadog/start-agent.sh 2>/dev/null | head -1)"
if [ -n "$s" ]; then
sh "$s" || echo "datadog-ai-guard: agent start deferred — run 'sh ~/.datadog/start-agent.sh' from a shell."
else
echo "datadog-ai-guard: start-agent.sh not found; cannot start the trace Agent."
fi
fi
description: Start an in-sandbox Datadog Agent for the AI Guard trace UI (apm=true only)
env:
- DD_APM_TRACING_ENABLED
- DD_SITE
- DD_API_KEY
- HTTP_PROXY
- HTTPS_PROXY
- NO_PROXY
- http_proxy
- https_proxy
- no_proxy
- DOCKER_HOST
- SSL_CERT_FILE
- SSL_CERT_DIR
- CURL_CA_BUNDLE
- DD_AGENT_IMAGE
- DD_AGENT_CONTAINER
- DD_HOSTNAME
- DD_AGENT_LOG_LEVEL
user: agent
- type: com.docker.sandbox/agent-context@1
config:
contentFile: /usr/share/sandbox/kit/datadog-ai-guard/datadog-ai-guard-context.md
args:
apm:
default: "false"
description: Send AI Guard evaluations as APM traces so they appear in the Datadog UI ("AI Guard / Submit your first trace"). "true" runs a Datadog Agent container in the sandbox (trace intake on 127.0.0.1:8126) that forwards through the credential-injecting proxy. Default "false" keeps the kit fully agentless — evaluate() still returns live verdicts for inline enforcement, they just won't show in the trace UI.
pattern: ^(true|false)$
env: DD_APM_TRACING_ENABLED
env:
default: sandbox
description: Value for DD_ENV (deployment environment tag).
pattern: ^[A-Za-z0-9._:/-]+$
env: DD_ENV
service:
default: sbx-ai-guard
description: Value for DD_SERVICE (service name tag).
pattern: ^[A-Za-z0-9._:/-]+$
env: DD_SERVICE
site:
default: datadoghq.com
description: 'Datadog site (DD_SITE): datadoghq.com | datadoghq.eu | us3.datadoghq.com | us5.datadoghq.com | ap1.datadoghq.com'
pattern: ^[a-z0-9.-]+\.[a-z]{2,}$
env: DD_SITE