sha256:1b401f645d23f93ffd0fc75f740720e97595e5fa0162f9ec0bf3813db43eecd5
Last pushed
about 5 hours by dhibot
Type
Sandbox Kit
Manifest digest
sha256:1b401f645d23f93ffd0fc75f740720e97595e5fa0162f9ec0bf3813db43eecd5
schemaVersion: "3"
displayName: Google Antigravity
author: Docker, Inc. https://docker.com
description: Google's agent-first development platform, available as the agy terminal coding agent.
sourceUrl: https://github.com/docker-hardened-images/definitions
version: 1.5.5
licenses:
- LicenseRef-Proprietary
kind: workload
provides:
- [email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/ca-certificates@20250419
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/iputils-ping@20240905
- deb/[email protected]
- deb/less@668
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
capabilities:
- type: com.docker.sandbox/sbx@1
- type: com.docker.sandbox/network-policy@1
config:
runtime:
allow:
- accounts.google.com:443
- oauth2.googleapis.com:443
- www.googleapis.com:443
- lh3.googleusercontent.com:443
- aicode.googleapis.com:443
- cloudcode-pa.googleapis.com:443
- daily-cloudcode-pa.googleapis.com:443
- generativelanguage.googleapis.com:443
- antigravity.google:443
- antigravity.google.com:443
- antigravity-unleash.goog:443
- play.googleapis.com:443
- safebrowsing.googleapis.com:443
- www.gstatic.com:443
- antigravity-cli-auto-updater-974169037036.us-central1.run.app:443
- storage.googleapis.com:443
- raw.githubusercontent.com:443
- deb.debian.org:80
- dhi.io:80
- type: com.docker.sandbox/credential@1
optional: true
config:
apiKey:
inject:
- domain: generativelanguage.googleapis.com
format: '%s'
header: x-goog-api-key
name: GEMINI_API_KEY
proxyManaged: true
phase: runtime
service: google
description: Gemini API key for Antigravity's headless API-key mode
- type: com.docker.sandbox/lifecycle@1
config:
startup:
- command: |
set -e
cfg="$HOME/.gemini/antigravity-cli/settings.json"
mkdir -p "$(dirname "$cfg")"
[ -s "$cfg" ] || echo '{}' > "$cfg"
if [ "${SBX_CRED_GOOGLE_MODE:-none}" = apikey ]; then
jq '.modelProvider = "gemini"' "$cfg" > "$cfg.tmp"
else
jq 'del(.modelProvider)' "$cfg" > "$cfg.tmp"
fi
mv "$cfg.tmp" "$cfg"
description: Select Gemini API-key mode only when a Google credential is available
env:
- SBX_CRED_GOOGLE_MODE
user: "1000"
- command: |
set -e
[ -n "$MCP_GATEWAY_URL" ] || exit 0
cfg="$HOME/.gemini/config/mcp_config.json"
mkdir -p "$(dirname "$cfg")"
[ -s "$cfg" ] || echo '{}' > "$cfg"
frag=/tmp/antigravity-mcp-gateway.json
cat > "$frag" <<EOF
{
"mcpServers": {
"mcp-gateway": {
"serverUrl": "$MCP_GATEWAY_URL",
"headers": {
"Authorization": "Bearer $MCP_SENTINEL_TOKEN_NAME"
}
}
}
}
EOF
jq -s '.[0] * .[1]' "$cfg" "$frag" > "$cfg.tmp"
mv "$cfg.tmp" "$cfg"
rm -f "$frag"
description: Register the sandbox MCP gateway in Antigravity's user configuration
env:
- MCP_GATEWAY_URL
- MCP_SENTINEL_TOKEN_NAME
user: "1000"
- type: com.docker.sandbox/agent-context@1
optional: true
config:
content: |
# Google Antigravity
This sandbox runs Google's Antigravity agent as `agy`. Authentication has two
modes and the sandbox picks between them for you: with a Google credential
bound, `GEMINI_API_KEY` carries a sentinel the egress proxy swaps for the real
key at Google's endpoints, and a startup hook sets `modelProvider: gemini` in
`~/.gemini/antigravity-cli/settings.json`. With nothing bound, that key is
removed and `agy` falls back to its interactive Google sign-in.
Egress is limited to Google's own hosts plus Antigravity's product and
update hosts, so an MCP server or a tool that reaches anywhere else will be
refused by the sandbox rather than by the agent.
directory: /home/agent
filename: AGENTS.md
- type: com.docker.sandbox/agent-context@2
optional: true
config:
content: |
# Google Antigravity
This sandbox runs Google's Antigravity agent as `agy`. Authentication has two
modes and the sandbox picks between them for you: with a Google credential
bound, `GEMINI_API_KEY` carries a sentinel the egress proxy swaps for the real
key at Google's endpoints, and a startup hook sets `modelProvider: gemini` in
`~/.gemini/antigravity-cli/settings.json`. With nothing bound, that key is
removed and `agy` falls back to its interactive Google sign-in.
Egress is limited to Google's own hosts plus Antigravity's product and
update hosts, so an MCP server or a tool that reaches anywhere else will be
refused by the sandbox rather than by the agent.
directory: /home/agent
filename: AGENTS.md
- type: com.docker.sandbox/acp@1
optional: true
config:
agent: antigravity
command:
- agy
- acp
- --dangerously-skip-permissions
args:
version:
required: true
description: Antigravity CLI version asserted after installation
pattern: ^[0-9]+\.[0-9]+\.[0-9]+$
buildArg: VERSION