sbx/zeroclaw-kit:20260827-2d26f13b91e884116ff94ea5f1819adbb33b4ec0

schemaVersion: "2"
kind: sandbox
name: zeroclaw
displayName: ZeroClaw
description: Fast, small, fully autonomous AI assistant infrastructure (Rust, single binary) — gateway with 30+ channels and ~20 providers. Installs in seconds from the pinned upstream release; no custom image needed.
sandbox:
    image: docker/sandbox-templates:shell
    entrypoint:
        - /home/agent/.local/bin/zeroclaw-start
permissions:
    network:
        allow:
            - api.anthropic.com
            - claude.ai
            - console.anthropic.com
            - github.com:443
            - objects.githubusercontent.com:443
            - release-assets.githubusercontent.com:443
            - '*.telegram.org'
            - '*.discord.com'
            - gateway.discord.gg
            - '*.matrix.org'
            - '*.slack.com'
ports:
    - container: 42617
      name: gateway
credentials:
    - service: anthropic
      apiKey:
        name: ANTHROPIC_API_KEY
        proxyManaged: true
        inject:
            - domain: api.anthropic.com
              header: x-api-key
              format: '%s'
            - domain: claude.ai
              header: x-api-key
              format: '%s'
            - domain: console.anthropic.com
              header: x-api-key
              format: '%s'
environment:
    variables:
        ZEROCLAW_gateway__host: 0.0.0.0
setup:
    install:
        - command: set -e; v=v0.8.0; case "$(uname -m)" in x86_64) t=x86_64-unknown-linux-gnu;; aarch64|arm64) t=aarch64-unknown-linux-gnu;; *) echo "unsupported arch"; exit 1;; esac; curl -fsSL "https://github.com/zeroclaw-labs/zeroclaw/releases/download/$v/zeroclaw-$t.tar.gz" | tar -xz -C /usr/local/bin zeroclaw && chmod 0755 /usr/local/bin/zeroclaw
          user: "0"
          description: Install the pinned zeroclaw release binary
    startup:
        - command:
            - sh
            - -c
            - CFG=$HOME/.zeroclaw/config.toml; [ -n "$ANTHROPIC_API_KEY" ] && grep -q __ANTHROPIC_API_KEY__ "$CFG" 2>/dev/null && sed -i "s/__ANTHROPIC_API_KEY__/$ANTHROPIC_API_KEY/" "$CFG" || true
          user: "1000"
          description: Template the proxy-managed key into config.toml at sandbox start
    files:
        - path: /home/agent/.local/bin/zeroclaw-start
          content: |
            #!/bin/sh
            CFG="$HOME/.zeroclaw/config.toml"
            if [ -n "$ANTHROPIC_API_KEY" ] && grep -q __ANTHROPIC_API_KEY__ "$CFG" 2>/dev/null; then
                sed -i "s/__ANTHROPIC_API_KEY__/$ANTHROPIC_API_KEY/" "$CFG"
            fi
            exec zeroclaw daemon
          mode: "0755"
          description: Entrypoint — template the proxy-managed key into config.toml (v0.8.0 dropped legacy env fallbacks), then run the daemon