Sign inSign up

docker/sbx-kit-zeroclaw-mixin

Verified Publisher

By Docker, Inc.

•Updated 1 day ago

ZeroClaw as a mixin — the pinned, digest-verified static binary in an overlay, with the Anthrop...

Sandbox Kit
0

41

docker/sbx-kit-zeroclaw-mixin repository overview

Digest

sha256:f100181ed76a…

Size

19 MB

Schema

v3

Pushed

1 day ago

Specificationspec.yaml
MIXIN

ZeroClaw as a mixin — the pinned, digest-verified static binary in an overlay, with the Anthropic credential (API key or claude.ai OAuth), the published gateway port and the hook that resolves the credential into config.toml. Layer it onto a shell base and run `zeroclaw`.

Arguments
NameRequiredDefaultDescription
versionOptional0.8.0

ZeroClaw release to install

Provides[email protected]
CapabilitiesExpand a row to see its full configuration. See the full spec for the complete descriptor.
TypeRequiredDescription
com.docker.sandbox/network-policy@1Required—
com.docker.sandbox/port@1Required—
com.docker.sandbox/credential@1OptionalAnthropic API access (API key or claude.ai OAuth)
com.docker.sandbox/lifecycle@1Required—
com.docker.sandbox/agent-context@1Required—

Apply this mixin to a sandbox

sbx run <agent> --kit docker/sbx-kit-zeroclaw-mixin:latest

Make sure you have docker sbx installed

Run the following command to install sbx on your machine.

macOS
brew install docker/tap/sbx
Windows
winget install Docker.sbx
Learn more about docker sbx⁠

Note

Experimental: Sandbox Kit v3

This kit uses the experimental Sandbox Kit specification⁠, specifically v3⁠. The format and runtime behavior may change before v3 is stable.

⁠zeroclaw-mixin

ZeroClaw⁠ as a mixin — the same agent as the zeroclaw⁠ workload kit, packaged as an overlay you layer onto a shell base instead of running as the sandbox's own image.

⁠Usage

sbx run --kit ./zeroclaw-mixin/ <shell-workload>

Or from a git URL targeting this repo:

sbx run --kit "git+https://github.com/docker/sbx-kits-contrib.git#dir=zeroclaw-mixin" <shell-workload>

The base workload keeps its own launch command. The startup hook resolves the credential, but the daemon is not started for you — in the standalone kit that is the entrypoint's job:

zeroclaw --help
zeroclaw-start              # re-resolves the credential, then execs `zeroclaw daemon`

⁠What it carries

  • The pinned, digest-verified zeroclaw release binary at /usr/local/bin/zeroclaw. One static Rust binary with nothing to relocate, which is why this overlay takes the plain FROM <base> AS build → /out → FROM scratch shape rather than the copy-the-install-out shape the npm and uv kits need.
  • The kit's seed ~/.zeroclaw/config.toml, the credential resolver, and zeroclaw-start on PATH.
  • The proxy-managed anthropic credential (API key or claude.ai OAuth), the gateway port (42617), and the credential-resolution startup hook.
  • ZEROCLAW_gateway__host as a /etc/profile.d snippet: a mixin's image config is not the composed image's, so ENV would be dropped at assembly.

⁠A note on files/

files/ here is a byte-identical copy of ../zeroclaw/files/. A kit's build context is its own directory, so an overlay cannot reach its sibling workload's assets; diff -r between the two directories is what catches drift.

⁠What it deliberately leaves to the base workload

  • The launch command. A mixin does not set an entrypoint, which is why the daemon waits for zeroclaw-start.
  • The context-file profile. filename: is workload-only; this kit contributes a body through contentFile.
  • sbx@1. A mixin's image config never becomes the composed image's, so there is no identity for the host to honor here.