sbx/devin-mixin:latest

schemaVersion: "3"
displayName: Devin (mixin)
author: Docker, Inc. https://docker.com
description: Devin CLI overlay for a shell workload, with its auth wrapper, credentials, and MCP setup.
sourceUrl: https://devin.ai
version: 3000.12.57
licenses:
    - LicenseRef-Proprietary
kind: mixin
provides:
    - [email protected]
capabilities:
    - type: com.docker.sandbox/network-policy@1
      config:
        runtime:
            allow:
                - '*.devin.ai:443'
                - api.devin.ai:443
                - windsurf.com:443
                - server.codeium.com:443
                - unleash.codeium.com:443
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: server.codeium.com
                  format: Bearer %s
                  header: Authorization
                - domain: api.devin.ai
                  format: Bearer %s
                  header: Authorization
        oauth:
            credentialFile:
                format: toml
                path: ~/.local/share/devin/credentials.toml
                structure:
                    api_server_url: https://server.codeium.com
                    devin_api_url: https://api.devin.ai
                    devin_webapp_host: app.devin.ai
                    windsurf_api_key: '{{.PrimaryApiKey}}'
            passthrough: true
            resourceHosts:
                - server.codeium.com
                - api.devin.ai
            responseFields:
                accessToken: token
                refreshToken: token
            tokenEndpoint:
                host: api.devin.ai
                path: /auth/cli/token
        phase: runtime
        service: devin
      description: Devin account credential captured during in-sandbox login
    - type: com.docker.sandbox/lifecycle@1
      config:
        files:
            - content: '{"auto_update": false}'
              description: Disable Devin background updates
              overwrite: false
              path: /home/agent/.config/devin/config.json
        startup:
            - command: |
                set -e
                [ -n "$MCP_GATEWAY_URL" ] || exit 0
                mkdir -p "$HOME/.config/devin"
                cat > "$HOME/.config/devin/mcp_config.json" <<EOF
                {
                  "mcpServers": {
                    "mcp-gateway": {
                      "url": "$MCP_GATEWAY_URL",
                      "transport": "http",
                      "headers": {
                        "Authorization": "Bearer $MCP_SENTINEL_TOKEN_NAME"
                      }
                    }
                  }
                }
                EOF
              description: Register the sandbox MCP gateway
              env:
                - MCP_GATEWAY_URL
                - MCP_SENTINEL_TOKEN_NAME
              user: agent
    - type: com.docker.sandbox/agent-context@1
      optional: true
      config:
        content: |
            # Devin

            Cognition's Devin CLI is available in this sandbox as `devin`. Run it from the
            shell — this kit is a mixin, so the sandbox's launch command belongs to
            whatever workload it was layered onto. The standalone kit launches it as
            `devin --permission-mode dangerous --respect-workspace-trust=false`, which is
            the invocation to reach for here too: a per-tool approval prompt with nobody
            attached to answer it deadlocks the session.

            **`devin` is not the CLI.** It is an auth wrapper installed under that name;
            the real binary is `devin-cli`. The wrapper checks authentication state, runs
            Devin's manual token flow when there is none, and replaces any real key left
            on disk with the proxy's placeholder before handing off. Invoke `devin-cli`
            directly only if you mean to bypass that.

            **The credential is proxy-held.** After sign-in, the durable key never sits in
            the container in usable form: `~/.local/share/devin/credentials.toml` carries
            a placeholder, and the sandbox's egress proxy substitutes the real key on
            requests to Devin's and Codeium's hosts. Nothing reads it from an environment
            variable, so there is no `DEVIN_*` key to set.

            Background self-update is off (`~/.config/devin/config.json`), so the binary
            will not change under a running session; `devin update` still works if you ask
            for it. This kit grants egress to Devin's and Codeium's hosts only — npm,
            GitHub and the crash-reporting ingest host are deliberately not among them,
            and anything else the sandbox reaches was granted by the base or another kit.
        directory: /home/agent
        filename: AGENTS.md
    - type: com.docker.sandbox/agent-context@2
      optional: true
      config:
        content: |
            # Devin

            Cognition's Devin CLI is available in this sandbox as `devin`. Run it from the
            shell — this kit is a mixin, so the sandbox's launch command belongs to
            whatever workload it was layered onto. The standalone kit launches it as
            `devin --permission-mode dangerous --respect-workspace-trust=false`, which is
            the invocation to reach for here too: a per-tool approval prompt with nobody
            attached to answer it deadlocks the session.

            **`devin` is not the CLI.** It is an auth wrapper installed under that name;
            the real binary is `devin-cli`. The wrapper checks authentication state, runs
            Devin's manual token flow when there is none, and replaces any real key left
            on disk with the proxy's placeholder before handing off. Invoke `devin-cli`
            directly only if you mean to bypass that.

            **The credential is proxy-held.** After sign-in, the durable key never sits in
            the container in usable form: `~/.local/share/devin/credentials.toml` carries
            a placeholder, and the sandbox's egress proxy substitutes the real key on
            requests to Devin's and Codeium's hosts. Nothing reads it from an environment
            variable, so there is no `DEVIN_*` key to set.

            Background self-update is off (`~/.config/devin/config.json`), so the binary
            will not change under a running session; `devin update` still works if you ask
            for it. This kit grants egress to Devin's and Codeium's hosts only — npm,
            GitHub and the crash-reporting ingest host are deliberately not among them,
            and anything else the sandbox reaches was granted by the base or another kit.
        directory: /home/agent
        filename: AGENTS.md
    - type: com.docker.sandbox/acp@1
      optional: true
      config:
        agent: devin
        command:
            - devin-cli
            - acp
args:
    version:
        required: true
        description: Devin CLI release to install
        pattern: ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9]+)?$
        buildArg: VERSION