sha256:c7d55a71a96f6dd3a897b079bdc49115f2283d4a19f123cdef099395b0495060
Last pushed
1 day by dhibot
Type
Sandbox Kit
Manifest digest
sha256:c7d55a71a96f6dd3a897b079bdc49115f2283d4a19f123cdef099395b0495060
schemaVersion: "3"
displayName: Pi
author: Docker, Inc. https://docker.com
description: Earendil Works' pi coding agent on Docker Hardened Images
sourceUrl: https://github.com/docker-hardened-images/definitions
version: 1.5.1
licenses:
- MIT
kind: workload
provides:
- [email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/ca-certificates@20250419
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/iputils-ping@20240905
- deb/[email protected]
- deb/less@668
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
- deb/[email protected]
capabilities:
- type: com.docker.sandbox/sbx@1
- type: com.docker.sandbox/network-policy@1
config:
runtime:
allow:
- api.anthropic.com:443
- platform.claude.com:443
- registry.npmjs.org:443
- pi.dev:443
- deb.debian.org:80
- dhi.io:80
- type: com.docker.sandbox/credential@1
name: Anthropic access
optional: true
config:
apiKey:
inject:
- domain: api.anthropic.com
format: '%s'
header: x-api-key
name: ANTHROPIC_API_KEY
proxyManaged: true
oauth:
credentialFile:
path: ~/.pi/agent/auth.json
structure:
anthropic:
access: '{{.AccessToken}}'
expires: '{{.ExpiresAt}}'
refresh: '{{.RefreshToken}}'
type: oauth
resourceHosts:
- api.anthropic.com
sentinels:
accessToken: sk-ant-oat01-proxy-managed
refreshToken: sk-ant-ort01-proxy-managed
tokenEndpoint:
host: platform.claude.com
path: /v1/oauth/token
phase: runtime
service: anthropic
description: Anthropic API access (API key or claude.ai OAuth)
- type: com.docker.sandbox/agent-sessions@1
config:
continue:
- --continue
list:
- /opt/pi-sessions/list-sessions.sh
prompt:
- -p
- --
- '{{.Prompt}}'
resume:
- --session
- '{{.SessionID}}'
description: Drive pi sessions programmatically
- type: com.docker.sandbox/agent-interactive-sessions@1
optional: true
config:
continue:
- --continue
prompt:
- --
- '{{.Prompt}}'
resume:
- --session
- '{{.SessionID}}'
sessionPicker:
- --resume
description: Open pi's terminal UI on a chosen session
- type: com.docker.sandbox/lifecycle@1
config:
install:
- command: mkdir -p /home/agent/.pi/agent && chown agent:agent /home/agent/.pi /home/agent/.pi/agent
description: Ensure ~/.pi is agent-owned before the settings seed
user: "0"
- command: |
set -e
# The args' patterns admit no quote or backslash, so the expanded
# values are safe inside the JSON strings.
model='${{ kit.args.model }}'
thinking='${{ kit.args.thinkingLevel }}'
MODEL=''
THINKING=''
if [ -n "$model" ]; then
provider=anthropic
case "$model" in
*/*) provider=${model%%/*}; model=${model#*/} ;;
esac
MODEL=" \"defaultProvider\": \"$provider\",
\"defaultModel\": \"$model\",
"
fi
[ -z "$thinking" ] || THINKING=" \"defaultThinkingLevel\": \"$thinking\",
"
mkdir -p /home/agent/.pi/agent
printf '%s' "{
\"\$schema\": \"https://pi.dev/schemas/settings.schema.json\",
${MODEL}${THINKING} \"defaultProjectTrust\": \"always\"
}
" > /home/agent/.pi/agent/settings.json
description: Seed pi settings.json (project trust, model, thinking level)
user: agent
- command: if [ -n "${HTTP_PROXY:-}" ]; then npm config set proxy="$HTTP_PROXY" https-proxy="${HTTPS_PROXY:-$HTTP_PROXY}"; fi
description: Point npm at the sandbox proxy for pi's runtime package installs
env:
- HTTP_PROXY
- HTTPS_PROXY
user: agent
- command: |
set -e
[ -n "$MCP_GATEWAY_URL" ] || exit 0
pi mcp add mcp-gateway \
--url "$MCP_GATEWAY_URL" \
--header "Authorization=Bearer $MCP_SENTINEL_TOKEN_NAME"
description: Register the sandbox MCP gateway (install-time, race-free)
env:
- MCP_GATEWAY_URL
- MCP_SENTINEL_TOKEN_NAME
user: agent
startup:
- background: true
command:
- sh
- -c
- command -v apt-get > /dev/null 2>&1 && (apt-get update -qq -y > /dev/null 2>&1 || true)
description: Update apt package cache in background
user: "0"
- type: com.docker.sandbox/agent-skills@1
optional: true
config:
path: /home/agent/.agents/skills
- type: com.docker.sandbox/agent-context@1
optional: true
config:
content: |
## Pi
pi is installed at `/usr/local/share/npm-global/bin/pi`, which is on `PATH`; the image entrypoint starts it. Run
`pi` for the interactive TUI, or `pi -p "<prompt>"` for a one-shot run. `pi --continue` resumes the most recent
session for this directory and `pi --resume` opens the session selector.
pi does not ask for approval before tool calls, so there is no permission mode to turn off. The one prompt it
would raise — project trust — is pre-answered in `~/.pi/agent/settings.json`
(`defaultProjectTrust: "always"`). That is deliberate: the container is the sandbox, and a prompt nobody can
answer just deadlocks a non-interactive session.
Authentication is proxy-mediated. `ANTHROPIC_API_KEY` in this container is a sentinel, not a key; the sandbox
proxy substitutes the real credential bound on the host on requests to `api.anthropic.com`. If the host's
credential is a Claude subscription (OAuth) login rather than an API key, it is materialized into
`~/.pi/agent/auth.json`, pi's native auth store, which pi prefers over the environment. Either way there is no
real credential in this container. Do not run `pi auth login` — it would try to complete a browser flow against
a host the sandbox does not allow, and write a real token over that file. Never print or reconfigure the
sentinel.
Skills are read from `~/.agents/skills`, where the host's shared skills store mounts. `pi install npm:<pkg>`
and `pi update` reach `registry.npmjs.org`, which is allowed; a package that pulls from anywhere else will be
refused by the sandbox's network policy. The `find` tool uses the `fd` binary this image carries, and `grep`
uses `rg`.
## Installing Packages
The image ships a small toolset: shell and CLI tools, git, gh, Docker, and Node 24 with npm. Install anything
else with `sudo apt-get update && sudo apt-get install -y <package>`; `sudo` needs no password. Two apt
repositories are configured and reachable through the sandbox proxy: Debian trixie (`deb.debian.org`) and
Docker Hardened Images (`dhi.io/deb/debian/main`). The DHI repository carries versioned toolchains such as
`golang-1.26` and `python-3.14`; Debian supplies the rest, for example `default-jdk-headless`. `apt-cache
search <term>` lists what is available.
directory: /home/agent/.pi/agent
filename: AGENTS.md
- type: com.docker.sandbox/agent-context@2
optional: true
config:
content: |
## Pi
pi is installed at `/usr/local/share/npm-global/bin/pi`, which is on `PATH`; the image entrypoint starts it. Run
`pi` for the interactive TUI, or `pi -p "<prompt>"` for a one-shot run. `pi --continue` resumes the most recent
session for this directory and `pi --resume` opens the session selector.
pi does not ask for approval before tool calls, so there is no permission mode to turn off. The one prompt it
would raise — project trust — is pre-answered in `~/.pi/agent/settings.json`
(`defaultProjectTrust: "always"`). That is deliberate: the container is the sandbox, and a prompt nobody can
answer just deadlocks a non-interactive session.
Authentication is proxy-mediated. `ANTHROPIC_API_KEY` in this container is a sentinel, not a key; the sandbox
proxy substitutes the real credential bound on the host on requests to `api.anthropic.com`. If the host's
credential is a Claude subscription (OAuth) login rather than an API key, it is materialized into
`~/.pi/agent/auth.json`, pi's native auth store, which pi prefers over the environment. Either way there is no
real credential in this container. Do not run `pi auth login` — it would try to complete a browser flow against
a host the sandbox does not allow, and write a real token over that file. Never print or reconfigure the
sentinel.
Skills are read from `~/.agents/skills`, where the host's shared skills store mounts. `pi install npm:<pkg>`
and `pi update` reach `registry.npmjs.org`, which is allowed; a package that pulls from anywhere else will be
refused by the sandbox's network policy. The `find` tool uses the `fd` binary this image carries, and `grep`
uses `rg`.
## Installing Packages
The image ships a small toolset: shell and CLI tools, git, gh, Docker, and Node 24 with npm. Install anything
else with `sudo apt-get update && sudo apt-get install -y <package>`; `sudo` needs no password. Two apt
repositories are configured and reachable through the sandbox proxy: Debian trixie (`deb.debian.org`) and
Docker Hardened Images (`dhi.io/deb/debian/main`). The DHI repository carries versioned toolchains such as
`golang-1.26` and `python-3.14`; Debian supplies the rest, for example `default-jdk-headless`. `apt-cache
search <term>` lists what is available.
directory: /home/agent/.pi/agent
filename: AGENTS.md
args:
model:
default: ""
description: pi model as provider/model or an Anthropic model ID; empty keeps the CLI default
pattern: ^[A-Za-z0-9._/:-]*$
env: PI_KIT_MODEL
thinkingLevel:
default: ""
description: Thinking level (settings.json `defaultThinkingLevel`); empty keeps pi's default of medium
enum:
- ""
- "off"
- minimal
- low
- medium
- high
- xhigh
- max
env: PI_KIT_THINKING_LEVEL
version:
required: true
description: pi release the image carries
pattern: ^[0-9]+\.[0-9]+\.[0-9]+$
buildArg: VERSION