DHI workload with Docker Engine, Buildx, and QEMU for building kits across architectures.
2.1K
DHI workload with Docker Engine, Buildx, and QEMU for building kits across architectures.
| Name | Required | Default | Description |
|---|---|---|---|
buildkitExpose | Optional | false | Let BuildKit listen on TCP for the host's remote driver (unauthenticated root build API) Options: false, true |
buildkitPort | Optional | 3330 | In-container TCP port BuildKit listens on when buildkitExpose is true |
version | Required | — | Kit Builder policy revision |
[email protected], deb/[email protected], deb/[email protected], deb/ca-certificates@20250419, deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/[email protected], deb/tzdata@2026, deb/[email protected], deb/[email protected]| Type | Required | Description | |
|---|---|---|---|
com.docker.sandbox/dockerd@1 | Required | Builds kit images with Docker-in-Docker | |
com.docker.sandbox/long-running@1 | Required | Keep the builder available between build clients | |
com.docker.sandbox/kit-registry@1 | Required | Push built kit images into the runtime's image store | |
com.docker.sandbox/port@1 | Required | — | |
com.docker.sandbox/resources@1 | Required | — | |
com.docker.sandbox/network-policy@1 | Required | — | |
com.docker.sandbox/lifecycle@1 | Required | — | |
com.docker.sandbox/agent-context@1 | Optional | — | |
com.docker.sandbox/agent-context@2 | Optional | — | |
sbx run sbx/kit-builder:latestRun the following command to install sbx on your machine.
brew install docker/tap/sbxwinget install Docker.sbxKit Builder is a Docker Hardened Images workload for building Sandbox Kits. It includes Docker Engine, Buildx, and QEMU
emulators for cross-architecture builds. Docker Sandboxes starts the engine and selects the sbx-builder
container-driver builder.
Kit Builder requires a local Docker Sandboxes runtime with com.docker.sandbox/dockerd@1 and
com.docker.sandbox/kit-registry@1 support. Cloud Sandboxes currently supports neither capability, so
sbx --cloud run sbx/kit-builder:latest is unsupported.
sbx run sbx/kit-builder:latest /path/to/workspace
Use a versioned tag from the Tags tab to pin this kit release. The sbx/kit-builder tags mirror the corresponding
dhi/kit-builder tags after a successful build.
Inside the sandbox, build a kit with the selected builder.
docker buildx build --platform linux/amd64,linux/arm64 -f kit.yaml .
Add --output type=oci,dest=out.tar to export an OCI archive. The Docker store persists across sandbox restarts and
provides the build cache. It is not retained after sandbox deletion.
Builds can fetch arbitrary registries, package repositories, and source hosts, subject to host and organization policy. This workload has no general package manager or development toolchain.
Remote BuildKit access is off by default. Set the create-time kit argument buildkitExpose=true only when the runtime
binds its published endpoint to host loopback. The endpoint is an unauthenticated root build API. Read the assigned port
from sbx kit builder status before creating a remote Buildx client.
sbx/shell provides a general development workload. Kit Builder provides the
dedicated build engine.For runtime setup, see the Docker Sandboxes documentation. For provenance, SBOM, VEX, and image verification, see the Docker Hardened Images documentation.
Docker and the Docker logo are trademarks or registered trademarks of Docker, Inc. Product names and logos do not imply sponsorship or endorsement.