sbx/cloudsmith-kit repository overview

⁠cloudsmith - Cloudsmith artifact management

A mixin kit that installs the official Cloudsmith⁠ CLI wired to Cloudsmith's cloud API, so an agent can push, pull, list, and manage packages across 30+ formats (Docker, npm, PyPI, Maven, Debian, RPM, Helm, Cargo, Go, NuGet, and more). The API key stays on the host; the sandbox only ever sees a placeholder.

Pairs with any base agent.

⁠Usage

Store a Cloudsmith API key (read + write) once on the host:

sbx secret set cloudsmith

Then create a sandbox with the kit:

sbx run --kit "docker.io/sbx/cloudsmith-kit:latest" claude

Or target this repo directly over git, or a local clone:

sbx run --kit "git+https://github.com/docker/sbx-kits-contrib.git#dir=cloudsmith" claude
sbx run --kit ./cloudsmith/ claude

Inside the sandbox:

cloudsmith whoami                                  # verify auth
cloudsmith list packages OWNER/REPO                # list packages
cloudsmith push python OWNER/REPO dist/pkg.whl     # upload a Python wheel
cloudsmith push docker OWNER/REPO image.tar        # upload a Docker image tarball

OWNER is your Cloudsmith workspace (organization) slug and REPO is the repository slug. Run cloudsmith push --help for the full list of formats.

⁠How auth works

The kit declares a cloudsmith credential with one inject rule for api.cloudsmith.io. Cloudsmith uses Authorization: token <key> (not Bearer, not Basic), so the header and format are spelled out by hand rather than via the scheme: sugar. Inside the container CLOUDSMITH_API_KEY is the placeholder proxy-managed; the proxy swaps in the real token on outbound requests to api.cloudsmith.io, so the key never touches the sandbox filesystem or environment. Run the CLI directly; do not try to read or echo the key.

The egress allowlist also covers the Cloudsmith content hosts (dl.cloudsmith.io, docker.cloudsmith.io, npm.cloudsmith.io) plus PyPI for the CLI install.

⁠Cleanup

sbx secret rm -g --service cloudsmith