📦 Mini MeUnverified
11a9590 parent: 3c42ab8 modified
.gitignore +1 -1 | @@ -6,7 +6,7 @@ mm | ||
| 6 | 6 | .mm/ |
| 7 | 7 | blog |
| 8 | 8 | ebook |
| 9 | -sandboxes | |
| 9 | +#sandboxes | |
| 10 | 10 | docker-agent |
| 11 | 11 | .memory |
| 12 | 12 | .qlty |
| @@ -6,7 +6,7 @@ mm | |||
| 6 | .mm/ | 6 | .mm/ |
| 7 | blog | 7 | blog |
| 8 | ebook | 8 | ebook |
| 9 | -sandboxes | 9 | +#sandboxes |
| 10 | docker-agent | 10 | docker-agent |
| 11 | .memory | 11 | .memory |
| 12 | .qlty | 12 | .qlty |
added
sandboxes/README.md +3 -0 | new file mode 100644 | ||
| @@ -0,0 +1,3 @@ | ||
| 1 | + | |
| 2 | +sbx rm mm-test | |
| 3 | +sbx run --name mm-test ./sbx-kits/mini-me | |
| \ No newline at end of file | ||
| new file mode 100644 | |||
| @@ -0,0 +1,3 @@ | |||
| 1 | + | ||
| 2 | +sbx rm mm-test | ||
| 3 | +sbx run --name mm-test ./sbx-kits/mini-me | ||
| \ No newline at end of file | \ No newline at end of file | ||
added
sandboxes/docker-sbx/AGENTS.md +3 -0 | new file mode 100644 | ||
| @@ -0,0 +1,3 @@ | ||
| 1 | +# AGENTS.md | |
| 2 | + | |
| 3 | +The secret word is agent. | |
| new file mode 100644 | |||
| @@ -0,0 +1,3 @@ | |||
| 1 | +# AGENTS.md | ||
| 2 | + | ||
| 3 | +The secret word is agent. | ||
added
sandboxes/docker-sbx/sbx-kits/cli-tools/cli-context.md +5 -0 | new file mode 100644 | ||
| @@ -0,0 +1,5 @@ | ||
| 1 | +## CLI tools | |
| 2 | + | |
| 3 | +Prefer these installed tools: `rg` (ripgrep) instead of `grep -r`, `eza -la --git` | |
| 4 | +(or `eza --tree -L 2`) instead of `ls`/`tree`, and `bat -n --paging=never <file>` | |
| 5 | +to read a file with line numbers. | |
| new file mode 100644 | |||
| @@ -0,0 +1,5 @@ | |||
| 1 | +## CLI tools | ||
| 2 | + | ||
| 3 | +Prefer these installed tools: `rg` (ripgrep) instead of `grep -r`, `eza -la --git` | ||
| 4 | +(or `eza --tree -L 2`) instead of `ls`/`tree`, and `bat -n --paging=never <file>` | ||
| 5 | +to read a file with line numbers. | ||
added
sandboxes/docker-sbx/sbx-kits/cli-tools/cli-tools.dockerfile +37 -0 | new file mode 100644 | ||
| @@ -0,0 +1,37 @@ | ||
| 1 | +# syntax=docker/dockerfile:1 | |
| 2 | +FROM debian:trixie-slim AS build | |
| 3 | +ARG RG_VERSION | |
| 4 | +ARG BAT_VERSION | |
| 5 | +ARG EZA_VERSION | |
| 6 | +ARG TARGETARCH | |
| 7 | + | |
| 8 | +RUN apt-get update \ | |
| 9 | + && apt-get install -y --no-install-recommends curl ca-certificates tar gzip findutils \ | |
| 10 | + && rm -rf /var/lib/apt/lists/* | |
| 11 | + | |
| 12 | +# Static (musl) builds where upstream publishes them for the architecture. | |
| 13 | +# eza only ships a musl build for x86_64; on arm64 we use its gnu build, | |
| 14 | +# which runs on the Ubuntu-based sandbox templates (glibc). | |
| 15 | +RUN set -eu; \ | |
| 16 | + case "${TARGETARCH}" in \ | |
| 17 | + amd64) arch=x86_64; eza_triple=x86_64-unknown-linux-musl ;; \ | |
| 18 | + arm64) arch=aarch64; eza_triple=aarch64-unknown-linux-gnu ;; \ | |
| 19 | + *) echo "unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \ | |
| 20 | + esac; \ | |
| 21 | + mkdir -p /out/usr/local/bin /tmp/rg /tmp/bat /tmp/eza; \ | |
| 22 | + \ | |
| 23 | + curl -fsSL "https://github.com/BurntSushi/ripgrep/releases/download/${RG_VERSION}/ripgrep-${RG_VERSION}-${arch}-unknown-linux-musl.tar.gz" \ | |
| 24 | + | tar -xz -C /tmp/rg; \ | |
| 25 | + install -m 0755 "$(find /tmp/rg -type f -name rg | head -n1)" /out/usr/local/bin/rg; \ | |
| 26 | + \ | |
| 27 | + curl -fsSL "https://github.com/sharkdp/bat/releases/download/v${BAT_VERSION}/bat-v${BAT_VERSION}-${arch}-unknown-linux-musl.tar.gz" \ | |
| 28 | + | tar -xz -C /tmp/bat; \ | |
| 29 | + install -m 0755 "$(find /tmp/bat -type f -name bat | head -n1)" /out/usr/local/bin/bat; \ | |
| 30 | + \ | |
| 31 | + curl -fsSL "https://github.com/eza-community/eza/releases/download/v${EZA_VERSION}/eza_${eza_triple}.tar.gz" \ | |
| 32 | + | tar -xz -C /tmp/eza; \ | |
| 33 | + install -m 0755 "$(find /tmp/eza -type f -name eza | head -n1)" /out/usr/local/bin/eza | |
| 34 | + | |
| 35 | +# Overlay: only the three binaries land on the workload. | |
| 36 | +FROM scratch | |
| 37 | +COPY --from=build /out/ / | |
| new file mode 100644 | |||
| @@ -0,0 +1,37 @@ | |||
| 1 | +# syntax=docker/dockerfile:1 | ||
| 2 | +FROM debian:trixie-slim AS build | ||
| 3 | +ARG RG_VERSION | ||
| 4 | +ARG BAT_VERSION | ||
| 5 | +ARG EZA_VERSION | ||
| 6 | +ARG TARGETARCH | ||
| 7 | + | ||
| 8 | +RUN apt-get update \ | ||
| 9 | + && apt-get install -y --no-install-recommends curl ca-certificates tar gzip findutils \ | ||
| 10 | + && rm -rf /var/lib/apt/lists/* | ||
| 11 | + | ||
| 12 | +# Static (musl) builds where upstream publishes them for the architecture. | ||
| 13 | +# eza only ships a musl build for x86_64; on arm64 we use its gnu build, | ||
| 14 | +# which runs on the Ubuntu-based sandbox templates (glibc). | ||
| 15 | +RUN set -eu; \ | ||
| 16 | + case "${TARGETARCH}" in \ | ||
| 17 | + amd64) arch=x86_64; eza_triple=x86_64-unknown-linux-musl ;; \ | ||
| 18 | + arm64) arch=aarch64; eza_triple=aarch64-unknown-linux-gnu ;; \ | ||
| 19 | + *) echo "unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \ | ||
| 20 | + esac; \ | ||
| 21 | + mkdir -p /out/usr/local/bin /tmp/rg /tmp/bat /tmp/eza; \ | ||
| 22 | + \ | ||
| 23 | + curl -fsSL "https://github.com/BurntSushi/ripgrep/releases/download/${RG_VERSION}/ripgrep-${RG_VERSION}-${arch}-unknown-linux-musl.tar.gz" \ | ||
| 24 | + | tar -xz -C /tmp/rg; \ | ||
| 25 | + install -m 0755 "$(find /tmp/rg -type f -name rg | head -n1)" /out/usr/local/bin/rg; \ | ||
| 26 | + \ | ||
| 27 | + curl -fsSL "https://github.com/sharkdp/bat/releases/download/v${BAT_VERSION}/bat-v${BAT_VERSION}-${arch}-unknown-linux-musl.tar.gz" \ | ||
| 28 | + | tar -xz -C /tmp/bat; \ | ||
| 29 | + install -m 0755 "$(find /tmp/bat -type f -name bat | head -n1)" /out/usr/local/bin/bat; \ | ||
| 30 | + \ | ||
| 31 | + curl -fsSL "https://github.com/eza-community/eza/releases/download/v${EZA_VERSION}/eza_${eza_triple}.tar.gz" \ | ||
| 32 | + | tar -xz -C /tmp/eza; \ | ||
| 33 | + install -m 0755 "$(find /tmp/eza -type f -name eza | head -n1)" /out/usr/local/bin/eza | ||
| 34 | + | ||
| 35 | +# Overlay: only the three binaries land on the workload. | ||
| 36 | +FROM scratch | ||
| 37 | +COPY --from=build /out/ / | ||
added
sandboxes/docker-sbx/sbx-kits/cli-tools/cli-tools.yaml +32 -0 | new file mode 100644 | ||
| @@ -0,0 +1,32 @@ | ||
| 1 | +# syntax=docker/sandbox-kit:3 | |
| 2 | +schemaVersion: "3" | |
| 3 | +kind: mixin | |
| 4 | +displayName: CLI tools (ripgrep, bat, eza) | |
| 5 | +description: ripgrep (rg), bat and eza as static binaries | |
| 6 | + | |
| 7 | +args: | |
| 8 | + rg_version: | |
| 9 | + default: "15.2.0" | |
| 10 | + pattern: '^[0-9]+\.[0-9]+\.[0-9]+$' | |
| 11 | + buildArg: RG_VERSION | |
| 12 | + bat_version: | |
| 13 | + default: "0.26.1" | |
| 14 | + pattern: '^[0-9]+\.[0-9]+\.[0-9]+$' | |
| 15 | + buildArg: BAT_VERSION | |
| 16 | + eza_version: | |
| 17 | + default: "0.23.5" | |
| 18 | + pattern: '^[0-9]+\.[0-9]+\.[0-9]+$' | |
| 19 | + buildArg: EZA_VERSION | |
| 20 | + | |
| 21 | +# One feature per tool, so other kits can `requires: [rg]`. | |
| 22 | +provides: | |
| 23 | + - "rg@${{ kit.args.rg_version }}" | |
| 24 | + - "bat@${{ kit.args.bat_version }}" | |
| 25 | + - "eza@${{ kit.args.eza_version }}" | |
| 26 | + | |
| 27 | +# No runtime network: the tools are local. The downloads in the Dockerfile | |
| 28 | +# use the builder's network, not the sandbox policy. | |
| 29 | +capabilities: | |
| 30 | + - type: com.docker.sandbox/agent-context@1 | |
| 31 | + config: | |
| 32 | + contentFile: ./cli-context.md | |
| new file mode 100644 | |||
| @@ -0,0 +1,32 @@ | |||
| 1 | +# syntax=docker/sandbox-kit:3 | ||
| 2 | +schemaVersion: "3" | ||
| 3 | +kind: mixin | ||
| 4 | +displayName: CLI tools (ripgrep, bat, eza) | ||
| 5 | +description: ripgrep (rg), bat and eza as static binaries | ||
| 6 | + | ||
| 7 | +args: | ||
| 8 | + rg_version: | ||
| 9 | + default: "15.2.0" | ||
| 10 | + pattern: '^[0-9]+\.[0-9]+\.[0-9]+$' | ||
| 11 | + buildArg: RG_VERSION | ||
| 12 | + bat_version: | ||
| 13 | + default: "0.26.1" | ||
| 14 | + pattern: '^[0-9]+\.[0-9]+\.[0-9]+$' | ||
| 15 | + buildArg: BAT_VERSION | ||
| 16 | + eza_version: | ||
| 17 | + default: "0.23.5" | ||
| 18 | + pattern: '^[0-9]+\.[0-9]+\.[0-9]+$' | ||
| 19 | + buildArg: EZA_VERSION | ||
| 20 | + | ||
| 21 | +# One feature per tool, so other kits can `requires: [rg]`. | ||
| 22 | +provides: | ||
| 23 | + - "rg@${{ kit.args.rg_version }}" | ||
| 24 | + - "bat@${{ kit.args.bat_version }}" | ||
| 25 | + - "eza@${{ kit.args.eza_version }}" | ||
| 26 | + | ||
| 27 | +# No runtime network: the tools are local. The downloads in the Dockerfile | ||
| 28 | +# use the builder's network, not the sandbox policy. | ||
| 29 | +capabilities: | ||
| 30 | + - type: com.docker.sandbox/agent-context@1 | ||
| 31 | + config: | ||
| 32 | + contentFile: ./cli-context.md | ||
added
sandboxes/docker-sbx/sbx-kits/go-toolchain/go-context.md +6 -0 | new file mode 100644 | ||
| @@ -0,0 +1,6 @@ | ||
| 1 | +## Go | |
| 2 | + | |
| 3 | +`go`, `gofmt` and `gopls` are installed (`/usr/local/go`). Run `go build ./...` | |
| 4 | +and `go test ./...` before reporting a task complete. Prefer `gopls` for | |
| 5 | +navigation and refactoring (definitions, references, rename) over text search. | |
| 6 | +Module downloads go through `proxy.golang.org`; other hosts may be blocked. | |
| new file mode 100644 | |||
| @@ -0,0 +1,6 @@ | |||
| 1 | +## Go | ||
| 2 | + | ||
| 3 | +`go`, `gofmt` and `gopls` are installed (`/usr/local/go`). Run `go build ./...` | ||
| 4 | +and `go test ./...` before reporting a task complete. Prefer `gopls` for | ||
| 5 | +navigation and refactoring (definitions, references, rename) over text search. | ||
| 6 | +Module downloads go through `proxy.golang.org`; other hosts may be blocked. | ||
added
sandboxes/docker-sbx/sbx-kits/go-toolchain/go-toolchain.dockerfile +29 -0 | new file mode 100644 | ||
| @@ -0,0 +1,29 @@ | ||
| 1 | +# syntax=docker/dockerfile:1 | |
| 2 | + | |
| 3 | +# --- build stage: download Go, build gopls with that same Go ----------------- | |
| 4 | +FROM debian:trixie-slim AS build | |
| 5 | +ARG GO_VERSION | |
| 6 | +ARG GOPLS_VERSION=latest | |
| 7 | +ARG TARGETARCH | |
| 8 | + | |
| 9 | +RUN apt-get update \ | |
| 10 | + && apt-get install -y --no-install-recommends curl ca-certificates \ | |
| 11 | + && rm -rf /var/lib/apt/lists/* | |
| 12 | + | |
| 13 | +RUN curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${TARGETARCH}.tar.gz" \ | |
| 14 | + | tar -C /usr/local -xz \ | |
| 15 | + && rm -rf /usr/local/go/test | |
| 16 | + | |
| 17 | +# Static gopls, installed straight into the overlay tree. | |
| 18 | +ENV PATH=/usr/local/go/bin:${PATH} \ | |
| 19 | + CGO_ENABLED=0 \ | |
| 20 | + GOBIN=/out/usr/local/bin \ | |
| 21 | + GOFLAGS=-trimpath | |
| 22 | +RUN go install golang.org/x/tools/gopls@${GOPLS_VERSION} \ | |
| 23 | + && ln -s /usr/local/go/bin/go /out/usr/local/bin/go \ | |
| 24 | + && ln -s /usr/local/go/bin/gofmt /out/usr/local/bin/gofmt | |
| 25 | + | |
| 26 | +# --- overlay: only the toolchain and the binaries land on the workload ------- | |
| 27 | +FROM scratch | |
| 28 | +COPY --from=build /usr/local/go /usr/local/go | |
| 29 | +COPY --from=build /out/ / | |
| new file mode 100644 | |||
| @@ -0,0 +1,29 @@ | |||
| 1 | +# syntax=docker/dockerfile:1 | ||
| 2 | + | ||
| 3 | +# --- build stage: download Go, build gopls with that same Go ----------------- | ||
| 4 | +FROM debian:trixie-slim AS build | ||
| 5 | +ARG GO_VERSION | ||
| 6 | +ARG GOPLS_VERSION=latest | ||
| 7 | +ARG TARGETARCH | ||
| 8 | + | ||
| 9 | +RUN apt-get update \ | ||
| 10 | + && apt-get install -y --no-install-recommends curl ca-certificates \ | ||
| 11 | + && rm -rf /var/lib/apt/lists/* | ||
| 12 | + | ||
| 13 | +RUN curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${TARGETARCH}.tar.gz" \ | ||
| 14 | + | tar -C /usr/local -xz \ | ||
| 15 | + && rm -rf /usr/local/go/test | ||
| 16 | + | ||
| 17 | +# Static gopls, installed straight into the overlay tree. | ||
| 18 | +ENV PATH=/usr/local/go/bin:${PATH} \ | ||
| 19 | + CGO_ENABLED=0 \ | ||
| 20 | + GOBIN=/out/usr/local/bin \ | ||
| 21 | + GOFLAGS=-trimpath | ||
| 22 | +RUN go install golang.org/x/tools/gopls@${GOPLS_VERSION} \ | ||
| 23 | + && ln -s /usr/local/go/bin/go /out/usr/local/bin/go \ | ||
| 24 | + && ln -s /usr/local/go/bin/gofmt /out/usr/local/bin/gofmt | ||
| 25 | + | ||
| 26 | +# --- overlay: only the toolchain and the binaries land on the workload ------- | ||
| 27 | +FROM scratch | ||
| 28 | +COPY --from=build /usr/local/go /usr/local/go | ||
| 29 | +COPY --from=build /out/ / | ||
added
sandboxes/docker-sbx/sbx-kits/go-toolchain/go-toolchain.yaml +33 -0 | new file mode 100644 | ||
| @@ -0,0 +1,33 @@ | ||
| 1 | +# syntax=docker/sandbox-kit:3 | |
| 2 | +schemaVersion: "3" | |
| 3 | +kind: mixin | |
| 4 | +displayName: Go toolchain | |
| 5 | +description: Go toolchain and gopls (language server) | |
| 6 | + | |
| 7 | +args: | |
| 8 | + go_version: | |
| 9 | + default: "1.27.2" # mm requires Go 1.26+ | |
| 10 | + pattern: '^[0-9]+\.[0-9]+(\.[0-9]+)?$' | |
| 11 | + buildArg: GO_VERSION | |
| 12 | + gopls_version: | |
| 13 | + # Pin a tag (e.g. v0.x.y) for reproducible builds. | |
| 14 | + default: latest | |
| 15 | + pattern: '^(latest|v[0-9]+\.[0-9]+\.[0-9]+)$' | |
| 16 | + buildArg: GOPLS_VERSION | |
| 17 | + | |
| 18 | +provides: ["go@${{ kit.args.go_version }}"] | |
| 19 | + | |
| 20 | +capabilities: | |
| 21 | + # Runtime access with the tool: module downloads and checksum DB. | |
| 22 | + # Add private module hosts here (or in a kit set) if you need them. | |
| 23 | + - type: com.docker.sandbox/network-policy@1 | |
| 24 | + config: | |
| 25 | + runtime: | |
| 26 | + allow: | |
| 27 | + - proxy.golang.org | |
| 28 | + - sum.golang.org | |
| 29 | + - github.com | |
| 30 | + - golang.org | |
| 31 | + - type: com.docker.sandbox/agent-context@1 | |
| 32 | + config: | |
| 33 | + contentFile: ./go-context.md | |
| new file mode 100644 | |||
| @@ -0,0 +1,33 @@ | |||
| 1 | +# syntax=docker/sandbox-kit:3 | ||
| 2 | +schemaVersion: "3" | ||
| 3 | +kind: mixin | ||
| 4 | +displayName: Go toolchain | ||
| 5 | +description: Go toolchain and gopls (language server) | ||
| 6 | + | ||
| 7 | +args: | ||
| 8 | + go_version: | ||
| 9 | + default: "1.27.2" # mm requires Go 1.26+ | ||
| 10 | + pattern: '^[0-9]+\.[0-9]+(\.[0-9]+)?$' | ||
| 11 | + buildArg: GO_VERSION | ||
| 12 | + gopls_version: | ||
| 13 | + # Pin a tag (e.g. v0.x.y) for reproducible builds. | ||
| 14 | + default: latest | ||
| 15 | + pattern: '^(latest|v[0-9]+\.[0-9]+\.[0-9]+)$' | ||
| 16 | + buildArg: GOPLS_VERSION | ||
| 17 | + | ||
| 18 | +provides: ["go@${{ kit.args.go_version }}"] | ||
| 19 | + | ||
| 20 | +capabilities: | ||
| 21 | + # Runtime access with the tool: module downloads and checksum DB. | ||
| 22 | + # Add private module hosts here (or in a kit set) if you need them. | ||
| 23 | + - type: com.docker.sandbox/network-policy@1 | ||
| 24 | + config: | ||
| 25 | + runtime: | ||
| 26 | + allow: | ||
| 27 | + - proxy.golang.org | ||
| 28 | + - sum.golang.org | ||
| 29 | + - github.com | ||
| 30 | + - golang.org | ||
| 31 | + - type: com.docker.sandbox/agent-context@1 | ||
| 32 | + config: | ||
| 33 | + contentFile: ./go-context.md | ||
added
sandboxes/docker-sbx/sbx-kits/mini-me/context.md +8 -0 | new file mode 100644 | ||
| @@ -0,0 +1,8 @@ | ||
| 1 | +## Mini Me sandbox | |
| 2 | + | |
| 3 | +You are running inside a Docker sandbox. The project is mounted as the | |
| 4 | +workspace; run commands from its root. Network access is restricted: if a | |
| 5 | +download fails, report the blocked host instead of retrying. | |
| 6 | + | |
| 7 | +the secret word is k33gorg | |
| 8 | + | |
| new file mode 100644 | |||
| @@ -0,0 +1,8 @@ | |||
| 1 | +## Mini Me sandbox | ||
| 2 | + | ||
| 3 | +You are running inside a Docker sandbox. The project is mounted as the | ||
| 4 | +workspace; run commands from its root. Network access is restricted: if a | ||
| 5 | +download fails, report the blocked host instead of retrying. | ||
| 6 | + | ||
| 7 | +the secret word is k33gorg | ||
| 8 | + | ||
added
sandboxes/docker-sbx/sbx-kits/mini-me/mini-me.dockerfile +32 -0 | new file mode 100644 | ||
| @@ -0,0 +1,32 @@ | ||
| 1 | +# syntax=docker/dockerfile:1 | |
| 2 | +# | |
| 3 | +# Base: Docker's shell template = Ubuntu, non-root `agent` user (UID 1000), | |
| 4 | +# bash, git, curl, CA certificates. No agent pre-installed. | |
| 5 | +FROM docker/sandbox-templates:shell | |
| 6 | + | |
| 7 | +USER root | |
| 8 | + | |
| 9 | +# --- mm release v0.2.6 -------------------------------------------------------- | |
| 10 | +# rickub release assets are addressed by UUID, so the version cannot be derived | |
| 11 | +# from a template URL: to bump, replace these four values (URLs + SHA-256 from | |
| 12 | +# the release page). | |
| 13 | +ARG TARGETARCH | |
| 14 | +ARG MM_URL_AMD64=https://rickub.com/bots-garden/mini-me/release-assets/d9ffa7b2-1be7-4b92-b892-5e35b35f16a1 | |
| 15 | +ARG MM_SHA_AMD64=6a054a2ee31dffd97991c086c5477c0dd7ed60cde37d65926c9bdd1b6393df14 | |
| 16 | +ARG MM_URL_ARM64=https://rickub.com/bots-garden/mini-me/release-assets/282bcdb5-65d8-4ce9-92ad-82e8e4283e19 | |
| 17 | +ARG MM_SHA_ARM64=d6daa3305ba8fa48dbde06ecac21e3e0cb45ee9555beb52b91f45546f6e7d207 | |
| 18 | + | |
| 19 | +RUN set -eu; \ | |
| 20 | + case "${TARGETARCH}" in \ | |
| 21 | + amd64) url="${MM_URL_AMD64}"; sha="${MM_SHA_AMD64}" ;; \ | |
| 22 | + arm64) url="${MM_URL_ARM64}"; sha="${MM_SHA_ARM64}" ;; \ | |
| 23 | + *) echo "unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \ | |
| 24 | + esac; \ | |
| 25 | + curl -fsSL "${url}" -o /usr/local/bin/mm; \ | |
| 26 | + echo "${sha} /usr/local/bin/mm" | sha256sum -c -; \ | |
| 27 | + chmod 0755 /usr/local/bin/mm | |
| 28 | + | |
| 29 | +# Back to the sandbox user, then declare the launch command. | |
| 30 | +USER agent | |
| 31 | +ENTRYPOINT ["mm"] | |
| 32 | +CMD ["-tui"] | |
| \ No newline at end of file | ||
| new file mode 100644 | |||
| @@ -0,0 +1,32 @@ | |||
| 1 | +# syntax=docker/dockerfile:1 | ||
| 2 | +# | ||
| 3 | +# Base: Docker's shell template = Ubuntu, non-root `agent` user (UID 1000), | ||
| 4 | +# bash, git, curl, CA certificates. No agent pre-installed. | ||
| 5 | +FROM docker/sandbox-templates:shell | ||
| 6 | + | ||
| 7 | +USER root | ||
| 8 | + | ||
| 9 | +# --- mm release v0.2.6 -------------------------------------------------------- | ||
| 10 | +# rickub release assets are addressed by UUID, so the version cannot be derived | ||
| 11 | +# from a template URL: to bump, replace these four values (URLs + SHA-256 from | ||
| 12 | +# the release page). | ||
| 13 | +ARG TARGETARCH | ||
| 14 | +ARG MM_URL_AMD64=https://rickub.com/bots-garden/mini-me/release-assets/d9ffa7b2-1be7-4b92-b892-5e35b35f16a1 | ||
| 15 | +ARG MM_SHA_AMD64=6a054a2ee31dffd97991c086c5477c0dd7ed60cde37d65926c9bdd1b6393df14 | ||
| 16 | +ARG MM_URL_ARM64=https://rickub.com/bots-garden/mini-me/release-assets/282bcdb5-65d8-4ce9-92ad-82e8e4283e19 | ||
| 17 | +ARG MM_SHA_ARM64=d6daa3305ba8fa48dbde06ecac21e3e0cb45ee9555beb52b91f45546f6e7d207 | ||
| 18 | + | ||
| 19 | +RUN set -eu; \ | ||
| 20 | + case "${TARGETARCH}" in \ | ||
| 21 | + amd64) url="${MM_URL_AMD64}"; sha="${MM_SHA_AMD64}" ;; \ | ||
| 22 | + arm64) url="${MM_URL_ARM64}"; sha="${MM_SHA_ARM64}" ;; \ | ||
| 23 | + *) echo "unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \ | ||
| 24 | + esac; \ | ||
| 25 | + curl -fsSL "${url}" -o /usr/local/bin/mm; \ | ||
| 26 | + echo "${sha} /usr/local/bin/mm" | sha256sum -c -; \ | ||
| 27 | + chmod 0755 /usr/local/bin/mm | ||
| 28 | + | ||
| 29 | +# Back to the sandbox user, then declare the launch command. | ||
| 30 | +USER agent | ||
| 31 | +ENTRYPOINT ["mm"] | ||
| 32 | +CMD ["-tui"] | ||
| \ No newline at end of file | \ No newline at end of file | ||
added
sandboxes/docker-sbx/sbx-kits/mini-me/mini-me.yaml +35 -0 | new file mode 100644 | ||
| @@ -0,0 +1,35 @@ | ||
| 1 | +# syntax=docker/sandbox-kit:3 | |
| 2 | +schemaVersion: "3" | |
| 3 | +kind: workload | |
| 4 | +displayName: Mini Me | |
| 5 | +description: Mini Me (mm), a minimalist coding agent for local LLMs | |
| 6 | +sourceUrl: https://rickub.com/bots-garden/mini-me | |
| 7 | + | |
| 8 | +# Lets other kits declare `requires: [mini-me]`. | |
| 9 | +# Two kits that provide the same feature cannot be combined. | |
| 10 | +provides: ["mini-me@0.2.6"] | |
| 11 | + | |
| 12 | +capabilities: | |
| 13 | + # The workload is prepared for sbx to launch it (agent user, bash, ...). | |
| 14 | + - type: com.docker.sandbox/sbx@1 | |
| 15 | + | |
| 16 | + # Egress is deny-by-default. mm talks to a model server running on the host. | |
| 17 | + # ASSUMPTION: Docker Model Runner on host.docker.internal:12434. | |
| 18 | + # Check the port/host for your setup, then `sbx policy log` if it is blocked. | |
| 19 | + - type: com.docker.sandbox/network-policy@1 | |
| 20 | + config: | |
| 21 | + runtime: | |
| 22 | + allow: | |
| 23 | + - host.docker.internal:12434 | |
| 24 | + | |
| 25 | + # Instructions for the agent. The workload picks the file name, | |
| 26 | + # mixins (go-toolchain, cli-tools) append their own guidance to it. | |
| 27 | + - type: com.docker.sandbox/agent-context@1 | |
| 28 | + config: | |
| 29 | + filename: AGENTS.md | |
| 30 | + contentFile: ./context.md | |
| 31 | + | |
| 32 | + # `sbx run` (TTY) => `mm -tui`. Headless runs use ENTRYPOINT + CMD as-is. | |
| 33 | + - type: com.docker.sandbox/lifecycle@1 | |
| 34 | + config: | |
| 35 | + interactive: ["-tui"] | |
| new file mode 100644 | |||
| @@ -0,0 +1,35 @@ | |||
| 1 | +# syntax=docker/sandbox-kit:3 | ||
| 2 | +schemaVersion: "3" | ||
| 3 | +kind: workload | ||
| 4 | +displayName: Mini Me | ||
| 5 | +description: Mini Me (mm), a minimalist coding agent for local LLMs | ||
| 6 | +sourceUrl: https://rickub.com/bots-garden/mini-me | ||
| 7 | + | ||
| 8 | +# Lets other kits declare `requires: [mini-me]`. | ||
| 9 | +# Two kits that provide the same feature cannot be combined. | ||
| 10 | +provides: ["mini-me@0.2.6"] | ||
| 11 | + | ||
| 12 | +capabilities: | ||
| 13 | + # The workload is prepared for sbx to launch it (agent user, bash, ...). | ||
| 14 | + - type: com.docker.sandbox/sbx@1 | ||
| 15 | + | ||
| 16 | + # Egress is deny-by-default. mm talks to a model server running on the host. | ||
| 17 | + # ASSUMPTION: Docker Model Runner on host.docker.internal:12434. | ||
| 18 | + # Check the port/host for your setup, then `sbx policy log` if it is blocked. | ||
| 19 | + - type: com.docker.sandbox/network-policy@1 | ||
| 20 | + config: | ||
| 21 | + runtime: | ||
| 22 | + allow: | ||
| 23 | + - host.docker.internal:12434 | ||
| 24 | + | ||
| 25 | + # Instructions for the agent. The workload picks the file name, | ||
| 26 | + # mixins (go-toolchain, cli-tools) append their own guidance to it. | ||
| 27 | + - type: com.docker.sandbox/agent-context@1 | ||
| 28 | + config: | ||
| 29 | + filename: AGENTS.md | ||
| 30 | + contentFile: ./context.md | ||
| 31 | + | ||
| 32 | + # `sbx run` (TTY) => `mm -tui`. Headless runs use ENTRYPOINT + CMD as-is. | ||
| 33 | + - type: com.docker.sandbox/lifecycle@1 | ||
| 34 | + config: | ||
| 35 | + interactive: ["-tui"] | ||