Setting up Docker Sandbox with DHI MCP and AI Governance

enable-dhi-mcp-sbx

## Setup Docker Sandbox 


$ brew install docker/tap/sbx
$ export SBX_MCP_URL=https://gateway.docker.com
$ sbx daemon stop && sbx daemon start -d
$ sbx mcp --help
$ sbx mcp ls

## Setup MCP Access Policy:

```
permit (
    principal,
    action == MCP::Action::"register",
    resource
);

permit (
    principal,
    action == MCP::Action::"invokeTool",
    resource
);

permit (
    principal,
    action == MCP::Action::"invokePrimordial",
    resource
);
```


## Add DHI MCP via Docker MCP Gateway

$ sbx mcp add remotedhi --url https://dhi.io/mcp 

$ sbx mcp inspect remotedhi                                       
Name:      remotedhi
Type:      remote
URL:       https://dhi.io/mcp
Transport: streamable-http

## Accessing DHI MCP Tools

$ cd ~/workdemo
$ sbx run codex --static-mcp remotedhi

Type /mcp

🔌  MCP Tools

    • mcp-gateway
      • Auth: Unsupported
      • Tools: code-mode, mcp-config-set, mcp-exec, remotedhi__dhi_create_mirror,
      remotedhi__dhi_get_image_attestations, remotedhi__dhi_get_image_cves, remotedhi__dhi_get_image_details,
      remotedhi__dhi_get_image_packages, remotedhi__dhi_get_repository, remotedhi__dhi_get_tag_definition,
      remotedhi__dhi_list_mirrors, remotedhi__dhi_list_repositories, remotedhi__dhi_remove_mirror
      
  Two things to flag about this policy as written:

1. It's allow-everything. permit(principal, action == …, resource) with no when/resource scoping permits every principal against every resource for all three actions. That unblocks your lab, but it's the anti-pattern a governance course exists to warn against — it's "governance turned off." Fine as a temporary unblock; don't ship it as the lab's exemplar.
2. Your lab doc is out of date on the action name. 06-mcp-hands-on.md uses MCP::Action::"invoke" (line ~332, 372, 394). The real schema here is invokeTool (+ invokePrimordial, + register). If learners copy the doc's invoke, it won't match — the lab needs updating to the actual action names.

For the DHI story you're building, the far better teaching artifact is a scoped version of this — permit register and the read-only dhi_get_*/dhi_list_* tools, but not dhi_create_mirror/dhi_remove_mirror, and not invokePrimordial wide-open. Something like:

// Anyone in the org may register servers
permit (principal, action == MCP::Action::"register", resource);

// Read-only DHI tools are invocable; mirror-mutation + primordials are not
permit (
  principal,
  action == MCP::Action::"invokeTool",
  resource
) when {
  resource.server == "remotedhi" &&
  ["dhi_get_image_cves","dhi_get_image_details","dhi_get_image_packages",
   "dhi_get_image_attestations","dhi_get_tag_definition","dhi_get_repository",
   "dhi_list_repositories","dhi_list_mirrors"].contains(resource.tool)
};

╭─────────────────────────────────────────────────╮
│ ✨ Update available! 0.146.0 -> 0.146.1 │
│ Run npm install -g @openai/codex to update. │
│ │
│ See full release notes: │
│ https://github.com/openai/codex/releases/latest │
╰─────────────────────────────────────────────────╯

╭──────────────────────────────────────────────────────────╮
│ >_ OpenAI Codex (v0.146.0) │
│ │
│ model: gpt-5.6-sol /model to change │
│ directory: /Users/…/work/labspace-docker-ai-governance │
│ permissions: YOLO mode │
╰──────────────────────────────────────────────────────────╯

Tip: Our most capable model yet. GPT-5.6 Sol can tackle complex code changes, dig into research, produce polished documents, and take on your most ambitious
work. Sol is highly capable at lower reasoning efforts—try starting lower, then turn it up for harder jobs.

/mcp

🔌 MCP Tools

• mcp-gateway
• Auth: Unsupported
• Tools: code-mode, dhi_create_mirror, dhi_get_image_attestations, dhi_get_image_cves, dhi_get_image_details, dhi_get_image_packages, dhi_get_repository,
dhi_get_tag_definition, dhi_list_mirrors, dhi_list_repositories, dhi_remove_mirror, mcp-exec

› Find NodeJS DHI images available in our catalog

⚠ Falling back from WebSockets to HTTPS transport. stream disconnected before completion: Attack attempt detected

• I’ll check the connected catalog sources for Node.js Docker Hardened Images and return the available entries.

› List the DHI variants (dev vs runtime) for the nginx repository.

• I’ll inspect the live dhi/nginx repository metadata and group its supported tags into development and runtime variants.

• Called mcp-gateway.dhi_get_repository({"repoName":"nginx","includeUnsupportedTagDefinitions":false})
└ {"type": "IMAGE", "namespace": "dhi", "name": "nginx", "displayName": "Nginx", "shortDescription": "nginx ("engine x") is an HTTP web server, reverse proxy,
content cache, load balancer, TCP/UDP proxy server, and mail proxy server.", "featured": true, "fipsCompliant": true, "stigCertified": true, "homeUrl":
"https://nginx.org/", "categories": [{"id": "web-servers", "name": "Web servers"}], "alternatives": ["nginx:stable", "nginx:mainline"], "overview": "##
About Nginx\n\nNginx (pronounced "engine-x") is an open source reverse proxy server for HTTP, HTTPS, SMTP, POP3, and IMAP protocols, as\nwell as a load
balancer, HTTP cache, and a web server (origin server). The nginx project started with a strong focus on\nhigh concurrency, high performance and low
memory usage. It...

• Called mcp-gateway.dhi_get_repository({"repoName":"nginx","includeUnsupportedTagDefinitions":false})
└ {"type": "IMAGE", "namespace": "dhi", "name": "nginx", "displayName": "Nginx", "shortDescription": "nginx ("engine x") is an HTTP web server, reverse proxy,
content cache, load balancer, TCP/UDP proxy server, and mail proxy server.", "featured": true, "fipsCompliant": true, "stigCertified": true, "homeUrl":
"https://nginx.org/", "categories": [{"id": "web-servers", "name": "Web servers"}], "alternatives": ["nginx:stable", "nginx:mainline"], "overview": "##
About Nginx\n\nNginx (pronounced "engine-x") is an open source reverse proxy server for HTTP, HTTPS, SMTP, POP3, and IMAP protocols, as\nwell as a load
balancer, HTTP cache, and a web server (origin server). The nginx project started with a strong focus on\nhigh concurrency, high performance and low
memory usage. It...

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

• The dhi/nginx repository has these supported variants:

Variant Stable Mainline
━━━━━━━━━ ━━━━━━━━━━━━━━━━ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Runtime Standard, FIPS Standard, FIPS, Debian compat
───────── ──────────────── ───────────────────────────────
Dev Standard, FIPS Standard, FIPS

Available bases: Alpine 3.23, Alpine 3.24, and Debian 13.

Tag suffixes identify the variant:

• Runtime: no -dev, e.g. dhi.io/nginx:1.31.3-alpine
• Dev: -dev, e.g. dhi.io/nginx:1.31.3-alpine-dev
• Runtime FIPS: -fips
• Dev FIPS: -fips-dev
• Compatibility runtime: -compat (Debian mainline only)

Runtime images are minimal and non-root. Dev images run as root and include a shell, package manager, envsubst entrypoint support, and nginx-debug.

──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────