kienxuandaoit/sandboxd-for-sbx:dev

schemaVersion: "3"
displayName: sandboxd sidecar (Mastra data plane)
description: for-docker base (opencode + sandboxd) with boot assurance for the sandboxd sidecar. opencode.json comes ONLY from provider env (OPENCODE_CONFIG_MERGE / _FILE, merged by a startup hook) — no kit args, no hardcoded provider.
kind: workload
provides:
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/tzdata@2026
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
capabilities:
    - type: com.docker.sandbox/sbx@1
    - type: com.docker.sandbox/long-running@1
      optional: true
    - type: com.docker.sandbox/network-policy@1
      config:
        runtime:
            allow:
                - opencode.ai
                - models.opencode.ai
                - models.dev
                - registry.npmjs.org
                - 192.168.1.10
    - type: com.docker.sandbox/lifecycle@1
      config:
        startup:
            - command:
                - sh
                - -c
                - if [ -z "${OPENCODE_CONFIG_MERGE:-}" ] && [ -z "${OPENCODE_CONFIG_MERGE_FILE:-}" ]; then exit 0; fi; node /opt/sandbox/render-opencode-config.mjs
              description: render provider opencode config
              env:
                - OPENCODE_CONFIG_MERGE
                - OPENCODE_CONFIG_MERGE_FILE
            - command:
                - sh
                - -c
                - 'for i in 1 2 3 4 5; do curl -sf -H "x-sandbox-token: $SANDBOX_TOKEN" http://127.0.0.1:${PORT:-8090}/health && exit 0; (node /opt/sandbox/sandboxd.mjs >>/tmp/sandboxd.log 2>&1 &); sleep 1; done; exit 1'
              description: ensure sandboxd sidecar answers /health
              env:
                - SANDBOX_TOKEN
                - PORT
    - type: com.docker.sandbox/agent-context@1
      config:
        contentFile: /usr/share/sandbox/kit/for-sbx/context.md
        filename: AGENTS.md