sbx/vibe-kit repository overview

⁠Mistral Vibe

A standalone Docker Sandboxes kit for Mistral Vibe⁠, Mistral AI's open source coding agent. It runs the vibe CLI inside a sandbox with the workspace pre-trusted, tool approval pre-granted, and the Mistral API key held by the sandbox proxy rather than by the container.

⁠Usage

Use the published kit:

sbx run --kit "docker.io/sbx/vibe-kit:latest" vibe

Or load it directly from this repository:

sbx run --kit "git+https://github.com/docker/sbx-kits-contrib.git#dir=vibe" vibe

Or use a local clone:

sbx run --kit ./vibe/ vibe

⁠Authentication

Get a key from the Mistral console⁠, then store it on the host under the mistral service — the name the kit's credentials block declares:

printf '%s' "$MISTRAL_API_KEY" | sbx secret set mistral

Piping the key in keeps it out of your shell history and out of the process table, where -t/--token would put it.

sbx secret set mistral on its own is equally valid — it prompts for the value on a TTY. Either way the secret is stored once on the host; sbx also offers to configure the credential on first launch if none is stored.

Then launch:

sbx run --kit "docker.io/sbx/vibe-kit:latest" vibe

The container only ever sees MISTRAL_API_KEY set to a proxy sentinel. The real key is substituted by the proxy on requests to api.mistral.ai, chat.mistral.ai and console.mistral.ai, and on no other host — so a prompt injection that talks the agent into exfiltrating the variable exfiltrates the sentinel.

⁠Agent profile

Vibe's agent profile⁠ decides which tool calls need confirmation. The kit starts auto-approve, on the same reasoning as the crush and grok kits: the sandbox is the security boundary, so a confirmation prompt inside it buys little and blocks non-interactive use.

Pick another one at install time:

sbx run --kit "docker.io/sbx/vibe-kit:latest" --kit-arg agent=plan vibe

The value is any builtin (ask, plan, accept-edits, auto-approve) or a custom agent declared in ~/.vibe/agents/NAME.toml.

⁠Persistence

~/.vibe is a 1 GB volume, so config.toml, sessions, logs, custom agents and .env survive recreating a sandbox of the same name. .env is Vibe's own key store; the environment takes precedence over it, so the proxy-managed MISTRAL_API_KEY is what Vibe uses regardless of what lands there. The volume is mounted root-owned, which is why a startup command hands it back to the agent user before Vibe writes to it.

⁠Network

The allow list is the four hosts Vibe reaches for, and nothing else:

Anything else your work needs — a package registry, a git host — has to be added to permissions.network.allow or allowed on the host with sbx policy allow network.

Telemetry and Vibe's self-update are both switched off through VIBE_ENABLE_TELEMETRY / VIBE_ENABLE_AUTO_UPDATE, so a run is reproducible and needs no egress to PyPI: the version is whatever the image ships.

⁠Image

The companion image, docker.io/sbx/vibe-image, is built from docker/sandbox-templates:shell-docker and installs mistral-vibe from PyPI with uv tool install. Pin a release at build time with --build-arg VIBE_VERSION=2.25.0; the default, latest, is what CI's nightly rebuild tracks.