djordjelukic1639080/daw-runner:cloud-dev

schemaVersion: "2"
kind: sandbox
name: daw-runner-v2
version: 0.2.0
displayName: Docker Agent Dashboard runner
description: Runs the dashboard coding agent API inside a Docker Sandbox.
sourceURL: https://github.com/rumpl/daw
extends: docker-agent
sandbox:
    entrypoint:
        - /bin/true
    resources:
        cpu: 2
        memory: 4096m
agentInstructions:
    filename: AGENTS.md
    content: |
        ## Docker Agent Dashboard sandbox

        This workspace is being edited by a dashboard runner inside a Docker Sandbox.
        Commands, filesystem access, child processes, and Docker containers are isolated
        in the sandbox VM rather than running directly on the host.
credentials:
    - service: sbx-login
      apiKey:
        name: DOCKER_TOKEN
        proxyManaged: true
        inject:
            - domain: gw.docker.com
              header: Authorization
              format: Bearer %s
            - domain: ai-gateway.docker.com
              header: Authorization
              format: Bearer %s
    - service: anthropic
      apiKey:
        name: ANTHROPIC_API_KEY
        proxyManaged: true
        inject:
            - domain: api.anthropic.com
              header: x-api-key
              format: '%s'
            - domain: claude.ai
              header: x-api-key
              format: '%s'
            - domain: console.anthropic.com
              header: x-api-key
              format: '%s'
    - service: github
      apiKey:
        name: ""
        inject:
            - domain: api.business.githubcopilot.com
              header: Authorization
              format: Bearer %s
            - domain: api.enterprise.githubcopilot.com
              header: Authorization
              format: Bearer %s
            - domain: api.github.com
              header: Authorization
              format: Bearer %s
            - domain: api.githubcopilot.com
              header: Authorization
              format: Bearer %s
            - domain: api.individual.githubcopilot.com
              header: Authorization
              format: Bearer %s
            - domain: copilot.github.com
              header: Authorization
              format: Bearer %s
            - domain: github.com
              header: Authorization
              format: Bearer %s
            - domain: raw.githubusercontent.com
              header: Authorization
              format: Bearer %s
    - service: google
      apiKey:
        name: GOOGLE_API_KEY
        proxyManaged: true
        inject:
            - domain: aiplatform.googleapis.com
              header: x-goog-api-key
              format: '%s'
            - domain: generativelanguage.googleapis.com
              header: x-goog-api-key
              format: '%s'
            - domain: oauth2.googleapis.com
              header: x-goog-api-key
              format: '%s'
            - domain: vertexai.googleapis.com
              header: x-goog-api-key
              format: '%s'
    - service: mistral
      apiKey:
        name: MISTRAL_API_KEY
        proxyManaged: true
    - service: nebius
      apiKey:
        name: NEBIUS_API_KEY
        proxyManaged: true
    - service: openai
      apiKey:
        name: OPENAI_API_KEY
        proxyManaged: true
        inject:
            - domain: api.openai.com
              header: Authorization
              format: Bearer %s
    - service: openrouter
      apiKey:
        name: OPENROUTER_API_KEY
        proxyManaged: true
        inject:
            - domain: openrouter.ai
              header: Authorization
              format: Bearer %s
    - service: xai
      apiKey:
        name: XAI_API_KEY
        proxyManaged: true
setup:
    files:
        - path: /home/agent/.local/bin/start-daw-runner
          content: |
            #!/bin/sh
            set -eu
            export DAW_RUNNER_WORKSPACE="${WORKDIR}"
            IFS= read -r DAW_RUNNER_TOKEN < /home/agent/.config/daw/runner-token
            export DAW_RUNNER_TOKEN
            mkdir -p /home/agent/.cagent/daw-runner /home/agent/.local/bin
            ln -sf /home/agent/.local/lib/daw-runner /home/agent/.local/bin/daw-git-sign
            pid_file=/home/agent/.cagent/daw-runner/runner.pid
            if [ -s "$pid_file" ] && kill -0 "$(cat "$pid_file")" 2>/dev/null; then
              exit 0
            fi
            echo $$ >"$pid_file"
            # stdout is the framed DAW protocol; diagnostics must stay on stderr.
            exec /home/agent/.local/lib/daw-runner
          mode: "0755"
          description: Start the code-defined dashboard runner for the mounted workspace.
        - path: /home/agent/.local/bin/daw-git-sign
          content: |
            #!/bin/sh
            exec /home/agent/.local/lib/daw-runner git-sign "$@"
          mode: "0755"
          description: Forward Git SSH signing operations to the host-held signing key.