sbx/droid-mixin:latest

schemaVersion: "3"
displayName: Droid (mixin)
author: Docker, Inc. https://docker.com
description: Factory Droid CLI overlay with authentication, network policy, and native ACP support.
sourceUrl: https://github.com/docker-hardened-images/definitions
version: 1.8.0
licenses:
    - LicenseRef-Proprietary
kind: mixin
provides:
    - [email protected]
capabilities:
    - type: com.docker.sandbox/network-policy@1
      config:
        runtime:
            allow:
                - api.factory.ai:443
                - app.factory.ai:443
                - relay.factory.ai:443
                - api.workos.com:443
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.factory.ai
                  format: Bearer %s
                  header: Authorization
                - domain: app.factory.ai
                  format: Bearer %s
                  header: Authorization
                - domain: relay.factory.ai
                  format: Bearer %s
                  header: Authorization
            name: FACTORY_API_KEY
            proxyManaged: true
        oauth:
            sentinels:
                accessToken: droid-oat-proxy-managed
                refreshToken: droid-ort-proxy-managed
            tokenEndpoint:
                host: api.workos.com
                path: /user_management/authenticate
        phase: runtime
        service: droid
      description: Factory API access for Droid (API key or WorkOS OAuth)
    - type: com.docker.sandbox/lifecycle@1
      config:
        install:
            - command: mkdir -p /home/agent/.factory && chown agent:agent /home/agent/.factory
              description: Ensure .factory is owned by agent before bind mounts run
              user: "0"
    - type: com.docker.sandbox/agent-context@1
      optional: true
      config:
        content: |
            Factory Droid is installed as `droid`. Authentication and network access follow this Kit's capability declarations.
    - type: com.docker.sandbox/agent-context@2
      optional: true
      config:
        content: |
            Factory Droid is installed as `droid`. Authentication and network access follow this Kit's capability declarations.
    - type: com.docker.sandbox/acp@1
      optional: true
      config:
        agent: droid
        command:
            - droid
            - exec
            - --output-format
            - acp
args:
    version:
        required: true
        description: Factory Droid release carried by the image
        pattern: ^[0-9]+\.[0-9]+\.[0-9]+$
        buildArg: VERSION