2026-09-18 — Publishing the ori kit to Docker Hub

State

Kit fixed so that sbx kit pack / push accept it (see history). Ready to publish; not pushed yet:

sbx kit push kits/ori docker.io/k33g/ori-kit:latest      # add --sign for a Sigstore signature
sbx kit inspect docker.io/k33g/ori-kit:latest            # check after push
sbx run -d claude . --template k33g/ori:0.0.1 --kit docker.io/k33g/ori-kit:latest --name ori -p 5555:8888

Auth order for push: sbx login session → sbx secret set --registry → Docker credential store (~/.docker/config.json has a docker.io entry).

Traps

No sbx kit package; verbs are pack, push, validate, inspect, pull, sign, verify, provenance. They take the kit directory.
sbx kit validate succeeding does not guarantee pack/push will: validate expands ${{ kit.args.* }} first, pack/push decode the raw YAML. Never put a placeholder in a non-string field (ports.container). Trial recipe: copy the kit to /tmp, edit, sbx kit pack /tmp/copy -o /tmp/x.zip.
Provenance records the git commit of the directory: commit before pushing for a meaningful attestation.
After publishing, the quickstart/README launch commands could reference --kit docker.io/k33g/ori-kit:latest instead of ./kits/ori — not done, the user decides.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


# 2026-09-18 — Publishing the ori kit to Docker Hub

## State

Kit fixed so that `sbx kit pack` / `push` accept it (see history). Ready to publish; **not pushed yet**:

```bash
sbx kit push kits/ori docker.io/k33g/ori-kit:latest      # add --sign for a Sigstore signature
sbx kit inspect docker.io/k33g/ori-kit:latest            # check after push
sbx run -d claude . --template k33g/ori:0.0.1 --kit docker.io/k33g/ori-kit:latest --name ori -p 5555:8888
```
Auth order for push: `sbx login` session → `sbx secret set --registry` → Docker credential store (`~/.docker/config.json` has a docker.io entry).

## Traps

- No `sbx kit package`; verbs are `pack`, `push`, `validate`, `inspect`, `pull`, `sign`, `verify`, `provenance`. They take the kit **directory**.
- `sbx kit validate` succeeding does **not** guarantee `pack`/`push` will: validate expands `${{ kit.args.* }}` first, pack/push decode the raw YAML. Never put a placeholder in a non-string field (ports.container). Trial recipe: copy the kit to /tmp, edit, `sbx kit pack /tmp/copy -o /tmp/x.zip`.
- Provenance records the git commit of the directory: commit before pushing for a meaningful attestation.
- After publishing, the quickstart/README launch commands could reference `--kit docker.io/k33g/ori-kit:latest` instead of `./kits/ori` — not done, the user decides.