sbx/kiro-mixin:latest

schemaVersion: "3"
displayName: Kiro (mixin)
description: AWS's Kiro CLI as a mixin — kiro-cli and its device-flow launcher in an overlay, with the egress policy Kiro's auth, chat and telemetry backends need and the hooks that set up its state directory and MCP gateway. Layer it onto a shell base and run `kiro`.
version: 1.0.0
kind: mixin
provides:
    - kiro
capabilities:
    - type: com.docker.sandbox/network-policy@1
      config:
        install:
            allow:
                - cli.kiro.dev
                - prod.download.cli.kiro.dev
                - kiro.dev
        runtime:
            allow:
                - cli.kiro.dev
                - prod.download.cli.kiro.dev
                - kiro.dev
                - archive.ubuntu.com
                - security.ubuntu.com
                - ports.ubuntu.com
                - download.docker.com
                - client-telemetry.us-east-1.amazonaws.com
                - cognito-identity.us-east-1.amazonaws.com
                - desktop-release.q.us-east-1.amazonaws.com
                - management.us-east-1.kiro.dev
                - prod.us-east-1.auth.desktop.kiro.dev
                - prod.us-east-1.telemetry-v2.kiro.dev
                - runtime.us-east-1.kiro.dev
                - q.us-east-1.amazonaws.com
                - view.awsapps.com
    - type: com.docker.sandbox/lifecycle@1
      config:
        install:
            - command: kiro-cli setup --no-confirm
              description: Run Kiro CLI setup
              user: agent
        startup:
            - background: true
              command:
                - sh
                - -c
                - command -v apt-get > /dev/null 2>&1 && (apt-get update -qq -y > /dev/null 2>&1 || true)
              description: Update apt package cache in background
              user: root
            - command:
                - sh
                - -c
                - |
                  set -e
                  [ -n "$MCP_GATEWAY_URL" ] || exit 0
                  mkdir -p "$HOME/.kiro/settings"
                  cat > "$HOME/.kiro/settings/mcp.json" <<EOF
                  {
                    "mcpServers": {
                      "mcp-gateway": {
                        "url": "$MCP_GATEWAY_URL",
                        "headers": {
                          "Authorization": "Bearer $MCP_SENTINEL_TOKEN_NAME"
                        }
                      }
                    }
                  }
                  EOF
              description: Register the sandbox MCP gateway in ~/.kiro/settings/mcp.json
              env:
                - MCP_GATEWAY_URL
                - MCP_SENTINEL_TOKEN_NAME
              user: agent
    - type: com.docker.sandbox/agent-context@1
      config:
        contentFile: /usr/share/sandbox/kit/kiro-mixin/kiro-mixin-context.md