cdupuis/sbx-kit-gemini-mixin:0.61.0

schemaVersion: "3"
displayName: Gemini CLI (mixin)
author: Docker, Inc.
description: Google's Gemini CLI as a mixin — node and the CLI in an overlay, with a proxy-managed Gemini API key and the hooks the agent needs. Layer it onto a shell base and run `gemini`.
sourceUrl: https://github.com/google-gemini/gemini-cli
kind: mixin
provides:
    - [email protected]
capabilities:
    - type: com.docker.sandbox/network-policy@1
      config:
        runtime:
            allow:
                - accounts.google.com:443
                - aiplatform.googleapis.com:443
                - generativelanguage.googleapis.com:443
                - oauth2.googleapis.com:443
                - vertexai.googleapis.com:443
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: aiplatform.googleapis.com
                  format: '%s'
                  header: x-goog-api-key
                - domain: generativelanguage.googleapis.com
                  format: '%s'
                  header: x-goog-api-key
                - domain: oauth2.googleapis.com
                  format: '%s'
                  header: x-goog-api-key
                - domain: vertexai.googleapis.com
                  format: '%s'
                  header: x-goog-api-key
            name: GEMINI_API_KEY
            proxyManaged: true
        phase: runtime
        service: google
      description: Google AI API access (Gemini API key)
    - type: com.docker.sandbox/lifecycle@1
      config:
        files:
            - content: '{"tools":{"sandbox":false},"security":{"disableYoloMode":false,"folderTrust":{"enabled":false}},"ui":{"useFullWidth":true}}'
              description: Baseline gemini settings for sandbox use
              overwrite: false
              path: /home/agent/.gemini/settings.json
        install:
            - command: mkdir -p /home/agent/.gemini && chown 1000:1000 /home/agent/.gemini && (chmod 644 /home/agent/.gemini/settings.json 2>/dev/null || true)
              description: Ensure ~/.gemini exists with agent ownership
              user: "0"
        startup:
            - command: |
                set -e
                [ -n "$MCP_GATEWAY_URL" ] || exit 0
                frag=/tmp/sandbox-mcp-gateway.json
                jq -n --arg url "$MCP_GATEWAY_URL" --arg auth "Bearer $MCP_SENTINEL_TOKEN_NAME" \
                  '{mcpServers: {"mcp-gateway": {httpUrl: $url, headers: {Authorization: $auth}}}}' > "$frag"
                [ -f "$HOME/.gemini/settings.json" ] || echo '{}' > "$HOME/.gemini/settings.json"
                jq -s '.[0] * .[1]' "$HOME/.gemini/settings.json" "$frag" \
                  > "$HOME/.gemini/settings.json.tmp"
                mv "$HOME/.gemini/settings.json.tmp" "$HOME/.gemini/settings.json"
                rm -f "$frag"
              description: Register the sandbox MCP gateway in ~/.gemini/settings.json
              env:
                - MCP_GATEWAY_URL
                - MCP_SENTINEL_TOKEN_NAME
              user: agent
    - type: com.docker.sandbox/agent-context@1
      config:
        contentFile: /usr/share/sandbox/kit/gemini-mixin/gemini-context.md
args:
    version:
        default: 0.61.0
        description: Gemini CLI release to install
        pattern: ^[0-9]+\.[0-9]+\.[0-9]+$
        buildArg: GEMINI_VERSION
dockerfile: ./gemini-mixin.dockerfile