Otávio Miranda - Docker SBX https://youtu.be/UJuu_I5ohFY

README.md

Build da image

Não se esqueça desses labels.

# Build via docker
docker build -t omx:v1 -t omx:latest -f ./rabbit_hole/Dockerfile . \
    --label 'com.docker.sandboxes.start-docker=true' \
    --label 'com.docker.sandboxes=templates' \
    --label 'com.docker.sandboxes.base=ubuntu:questing' \
    --label 'com.docker.sandboxes.flavor=shell-docker'

# salvar a imagem
docker image save omx:v1 -o omx.tar

# carregar a imagem nos templates do sbx
sbx template load omx.tar
# (opcional) apagar a imagem
rm omx.tar

# Agora é só usar conforme informei no vídeo:
# https://youtu.be/7ebSj39Xt-c?si=vdzLGuSzMAM2EUWN

# Só um exemplo rápido

# Template
sbx run --name omx --cpus 4 --memory 8g --template docker.io/library/omx:v1 shell workspace
sbx stop omx
sbx rm omx # APAGA A VM

Dockerfile

FROM ubuntu:questing@sha256:4a9232cc47bf99defcc8860ef6222c99773330367fcecbf21ba2edb0b810a31e

# -----------------------------------------------------------------------------
# Copied directly from docker/sandbox-templates:shell-docker
# -----------------------------------------------------------------------------

ARG TARGETPLATFORM

ENV NPM_CONFIG_PREFIX=/usr/local/share/npm-global
ENV PATH=/home/agent/.local/bin:/usr/local/share/npm-global/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
ENV NO_PROXY=localhost,127.0.0.1,::1,172.17.0.0/16
ENV no_proxy=localhost,127.0.0.1,::1,172.17.0.0/16

# -----------------------------------------------------------------------------
# Essentials (for me)
# -----------------------------------------------------------------------------

RUN set -euxo pipefail \
  && apt-get update \
  && apt-get install -yy --no-install-recommends \
    ca-certificates \
    curl \
    wget \
    gnupg \
    openssh-server \
    htop \
    git \
    git-lfs \
    fd-find \
    jq \
    fzf \
    bat \
    tree \
    zip \
    xz-utils \
    zstd \
    file \
    tar \
    gzip \
    build-essential \
    pkg-config \
    cmake \
    ninja-build \
    vim \
    nano \
    inetutils-traceroute \
    inetutils-ping \
    iproute2 \
  && ln -sf "$(which fdfind)" /usr/local/bin/fd \
  && ln -sf "$(which batcat)" /usr/local/bin/bat \
  && git lfs install --system \
  && chmod 1777 /tmp \
  && install -m 0755 -d /etc/apt/keyrings \
  && curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
      | gpg --dearmor -o /etc/apt/keyrings/docker.gpg \
  && chmod a+r /etc/apt/keyrings/docker.gpg \
  && echo \
   "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
   $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" \
   | tee /etc/apt/sources.list.d/docker.list > /dev/null \
  && rm -rf /var/lib/apt/lists/*

# -----------------------------------------------------------------------------
# User
# -----------------------------------------------------------------------------

RUN set -ex \
  && userdel ubuntu || true \
  && useradd --create-home --uid 1000 --shell /bin/bash agent \
  && groupadd -f docker \
  && usermod -aG sudo agent \
  && usermod -aG docker agent \
  && mkdir /etc/sudoers.d \
  && chmod 0755 /etc/sudoers.d \
  && echo "agent ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/agent \
  && echo "Defaults:%sudo env_keep += \"http_proxy https_proxy no_proxy HTTP_PROXY HTTPS_PROXY NO_PROXY SSL_CERT_FILE NODE_EXTRA_CA_CERTS REQUESTS_CA_BUNDLE JAVA_TOOL_OPTIONS\"" > /etc/sudoers.d/proxyconfig \
  && mkdir -p /home/agent/.docker/sandbox/locks \
  && mkdir -p /home/agent/.local/share /home/agent/.local/state \
  && chown -R agent:agent /home/agent \
  && mkdir -p /usr/local/share/npm-global \
  && chown -R agent:agent /usr/local/share/npm-global

# -----------------------------------------------------------------------------
# Sandbox persistence
# -----------------------------------------------------------------------------

RUN touch /etc/sandbox-persistent.sh \
  && chmod 644 /etc/sandbox-persistent.sh \
  && chown agent:agent /etc/sandbox-persistent.sh
ENV BASH_ENV=/etc/sandbox-persistent.sh

RUN set -ex \
  && cat > /etc/profile.d/sandbox-persistent.sh <<-'PROFILEEOF' \
  && chmod 644 /etc/profile.d/sandbox-persistent.sh
if [ -f /etc/sandbox-persistent.sh ]; then
  . /etc/sandbox-persistent.sh
fi

export BASH_ENV=/etc/sandbox-persistent.sh

PROFILEEOF

RUN set -ex \
  && cat > /tmp/sandbox-bashrc-prepend <<-'PREPEND'
if [ -f /etc/sandbox-persistent.sh ]; then
  . /etc/sandbox-persistent.sh
fi

export BASH_ENV=/etc/sandbox-persistent.sh

PREPEND

RUN cat /tmp/sandbox-bashrc-prepend /etc/bash.bashrc > /tmp/new-bashrc \
  && mv /tmp/new-bashrc /etc/bash.bashrc \
  && chmod 644 /etc/bash.bashrc \
  && rm /tmp/sandbox-bashrc-prepend

RUN set -ex \
  && cat > /home/agent/.bashrc <<-'BASHRCEOF' \
&& chmod 644 /home/agent/.bashrc \
&& chown agent:agent /home/agent/.bashrc
if [ -f /etc/sandbox-persistent.sh ]; then
  . /etc/sandbox-persistent.sh
fi

export BASH_ENV=/etc/sandbox-persistent.sh

BASHRCEOF

# -----------------------------------------------------------------------------
# Astral uv
# -----------------------------------------------------------------------------
COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv

# -----------------------------------------------------------------------------
# Common tools
# -----------------------------------------------------------------------------
USER root
RUN set -euxo pipefail \
  && apt-get update \
  && apt-get install -yy --no-install-recommends \
    bubblewrap \
    dnsutils \
    docker-buildx-plugin \
    docker-ce-cli \
    docker-compose-plugin \
    gh \
    less \
    lsof \
    make \
    openssh-client \
    procps \
    psmisc \
    ripgrep \
    rsync \
    socat \
    sudo \
    tini \
    unzip \
  && apt-get clean \
  && rm -rf /var/lib/apt/lists/*

USER agent
ENTRYPOINT ["tini", "--"]

# -----------------------------------------------------------------------------
# Common languages
# -----------------------------------------------------------------------------
USER root
RUN set -euxo pipefail \
  && apt-get update \
  && apt-get install -yy --no-install-recommends \
    bc \
    default-jdk-headless \
    golang \
    man-db \
    npm \
    python3 \
    python3-pip \
    python3-venv\
    pipx \
  && curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
  && apt-get install -y --no-install-recommends nodejs \
  && apt-get clean \
  && rm -rf /var/lib/apt/lists/*

# -----------------------------------------------------------------------------
# Docker in Docker
# -----------------------------------------------------------------------------
USER root
RUN set -euxo pipefail \
  && apt-get update \
  && apt-get install -yy --no-install-recommends \
    containerd.io \
    docker-ce \
  && apt-get clean \
  && rm -rf /var/lib/apt/lists/*

# -----------------------------------------------------------------------------
# The end
# -----------------------------------------------------------------------------
WORKDIR /home/agent
USER agent

CMD ["bash"]

spec.yaml

schemaVersion: '2'
kind: sandbox
name: omx
displayName: omx
description: omx

sandbox:
  image: 'docker.io/library/omx:v1'
  entrypoint:
    run: [bash]

publishedPorts:
  - container: 22
    protocol: tcp
    name: sshd

credentials:
  - service: gemini
    apiKey:
      name: GEMINI_API_KEY
      inject:
        - domain: generativelanguage.googleapis.com
          header: x-goog-api-key
          format: '%s'

environment:
  proxyManaged:
    - GEMINI_API_KEY
  variables:

caps:
  network:
    allow:
      - '*.googleapis.com'
      - github.com
      - raw.githubusercontent.com
      - objects.githubusercontent.com
      - pypi.org
      - files.pythonhosted.org
      - astral.sh
      - openrouter.ai
      - '*.openrouter.ai'
      - api.openai.com
      - api.anthropic.com
      - portal.nousresearch.com
      - duckduckgo.com # install.sh connectivity probe alongside pypi.org
      - archive.ubuntu.com # Ubuntu archive (amd64 main)
      - security.ubuntu.com # Ubuntu security updates (amd64)
      - ports.ubuntu.com # Ubuntu archive/security (arm64)
      - download.docker.com # Docker's apt repo

commands:
  initFiles:
    - path: /home/agent/.local/bin/refresh-authorized-keys
      mode: '0755'
      description:
        Refresh /home/agent/.ssh/authorized_keys from the forwarded SSH agent.
        Invoked by the startup hook; safe to invoke manually too.
      content: |
        #!/bin/sh
        # sbx runs startup hooks with a clean env (no SSH_AUTH_SOCK), so
        # naïve `ssh-add -L` fails on every wake. Snapshot SSH_AUTH_SOCK
        # from PID 1's environ — the socket file itself is available at
        # startup time, just not the env var pointing at it.
        if [ -z "$SSH_AUTH_SOCK" ]; then
            SSH_AUTH_SOCK=$(tr '\0' '\n' < /proc/1/environ | grep -m1 '^SSH_AUTH_SOCK=' | cut -d= -f2-)
            export SSH_AUTH_SOCK
        fi
        if [ ! -S "$SSH_AUTH_SOCK" ]; then
            echo "[sbx] no agent socket; keeping existing authorized_keys" >&2
            exit 0
        fi
        keys=$(ssh-add -L 2>&1)
        if [ $? -ne 0 ] || [ -z "$keys" ]; then
            echo "[sbx] ssh-add returned no keys; keeping existing authorized_keys" >&2
            exit 0
        fi
        printf '%s\n' "$keys" > /home/agent/.ssh/authorized_keys
        chmod 600 /home/agent/.ssh/authorized_keys
  install:
    - command: |
        curl -fSsL https://gist.githubusercontent.com/luizomf/9a52ba5b7b43aa69cc9a7121795bb9fa/raw/7c0a886860f4bb307bd3103d722f23745d240bcb/run | bash
      user: 1000
      description: 'Configure ~/.bashrc and ~/.vimrc (personal).'
    - command: |
        #!/usr/bin/env bash
        uv python install --default

    - command: ssh-keygen -A
      user: '0'
      description: Generate sshd host keys
    - command: install -d -m 0700 -o agent -g agent /home/agent/.ssh
      user: '0'
      description: Ensure /home/agent/.ssh exists with correct ownership
  startup:
    - command: ['/home/agent/.local/bin/refresh-authorized-keys']
      user: '1000'
      description: Refresh authorized_keys from the forwarded SSH agent
    - command:
        [
          'sh',
          '-c',
          'pgrep -x sshd >/dev/null || { mkdir -p /var/run/sshd &&
          /usr/sbin/sshd > /tmp/sshd.log 2>&1; }',
        ]
      user: '0'
      description:
        Start sshd if not already running (recreates /var/run/sshd which is
        tmpfs-cleared on container restart)