sbx/kernel:latest

schemaVersion: "3"
displayName: Kernel Browser
description: Cloud-hosted Chromium for AI agents with stealth, managed auth, and live session replay
sourceUrl: https://github.com/docker/sbx-kits-contrib/tree/main/kernel
version: 0.39.3
licenses:
    - Apache-2.0
kind: mixin
provides:
    - [email protected]
capabilities:
    - type: com.docker.sandbox/network-policy@1
      config:
        runtime:
            allow:
                - '**.onkernel.com'
                - '*.kernel.sh'
                - api.onkernel.com
                - registry.npmjs.org
                - '*.npmjs.org'
                - pypi.org
                - files.pythonhosted.org
    - type: com.docker.sandbox/credential@1
      config:
        apiKey:
            inject:
                - domain: api.onkernel.com
                  format: Bearer %s
                  header: Authorization
            name: KERNEL_API_KEY
            proxyManaged: true
        phase: runtime
        service: kernel
      description: Kernel API key
    - type: com.docker.sandbox/agent-context@1
      config:
        contentFile: /usr/share/sandbox/kit/kernel/kernel-context.md
args:
    noUpdateCheck:
        default: "1"
        description: 'Suppresses the Kernel CLI''s update check. Fixed: the CLI is pinned by the build, so an update check could only ever nag about a release this kit did not install.'
        enum:
            - "1"
        env: KERNEL_NO_UPDATE_CHECK
    version:
        default: 0.39.3
        description: Kernel CLI release to install
        pattern: ^[0-9]+\.[0-9]+\.[0-9]+$
        buildArg: KERNEL_VERSION