sbx/kit-builder repository overview

⁠Kit Builder for Docker Sandboxes

This v3 workload Kit provides Docker Engine, Buildx, and QEMU emulators for building Sandbox Kits across architectures. Docker Sandboxes starts the engine and selects the sbx-builder container-driver builder.

This Kit is built on Docker Hardened Images.

Kit Builder requires a local Docker Sandboxes runtime with com.docker.sandbox/dockerd@1 and com.docker.sandbox/kit-registry@1 support. Cloud Sandboxes currently supports neither capability, so sbx --cloud run sbx/kit-builder:latest is unsupported.

⁠Run

sbx run sbx/kit-builder:latest /path/to/workspace

⁠Kit arguments

Set these arguments when creating the sandbox with --kit-arg <name>=<value>. Repeat the flag for multiple arguments. Use --kit-arg <kit>.<name>=<value> to target one kit in a composition, as in the example below.

buildkitPort selects the port inside the sandbox, not the published host port. buildkitExpose=false keeps the TCP listener disabled. Enable it only when the runtime binds the published endpoint to host loopback; the endpoint is an unauthenticated root build API. Read the host port from sbx kit builder status.

sbx run sbx/kit-builder:latest \
  --kit-arg kit-builder.buildkitExpose=true --kit-arg kit-builder.buildkitPort=3330 \
  /path/to/workspace

⁠Authentication and configuration

Inside the sandbox, build a kit with the selected builder.

docker buildx build --platform linux/amd64,linux/arm64 -f kit.yaml .

Add --output type=oci,dest=out.tar to export an OCI archive. The Docker store persists across sandbox restarts and provides the build cache. It is not retained after sandbox deletion.

Builds can fetch arbitrary registries, package repositories, and source hosts, subject to host and organization policy. This workload has no general package manager or development toolchain.

Remote BuildKit access is off by default. Set the create-time kit argument buildkitExpose=true only when the runtime binds its published endpoint to host loopback. The endpoint is an unauthenticated root build API. Read the assigned port from sbx kit builder status before creating a remote Buildx client.

⁠Related kits

• sbx/shell⁠ provides a general development workload. Kit Builder provides the dedicated build engine.

⁠Source and security

For the Kit format and capability contracts, see the Sandbox Kit v3 specification⁠.

For runtime setup, see the Docker Sandboxes documentation⁠. For provenance, SBOM, VEX, and image verification, see the Docker Hardened Images documentation⁠.

Docker and the Docker logo are trademarks or registered trademarks of Docker, Inc. Product names and logos do not imply sponsorship or endorsement.