djordjelukic1639080/cbx-example-secrets-demo:1

schemaVersion: "3"
displayName: Secrets demo
description: A small workload that asks for host secrets through credential@1 and shows that the sandbox only ever holds placeholders while the real values reach the APIs they are meant for.
version: 1.0.0
kind: workload
provides:
    - [email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/ca-certificates@20250419
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/tzdata@2026
    - deb/[email protected]
    - deb/[email protected]
capabilities:
    - type: com.docker.sandbox/sbx@1
    - type: com.docker.sandbox/network-policy@2
      config:
        runtime:
            allow:
                - hosts:
                    - httpbin.org
                  methods:
                    - GET
                    - POST
                - api.github.com
    - type: com.docker.sandbox/credential@1
      config:
        apiKey:
            inject:
                - domain: httpbin.org
                  format: Bearer %s
                  header: Authorization
            name: DEMO_TOKEN
            proxyManaged: true
        phase: runtime
        service: cbx-demo
      description: Token for the demo endpoint (any value works)
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.github.com
                  format: Bearer %s
                  header: Authorization
            name: GH_TOKEN
            proxyManaged: true
        phase: runtime
        service: github
      description: GitHub token for api.github.com
    - type: com.docker.sandbox/agent-context@1
      config:
        content: |
            This sandbox demonstrates proxy-managed credentials. $DEMO_TOKEN and
            $GH_TOKEN hold placeholders; the host adds the real values to
            requests for httpbin.org and api.github.com. Run `secrets-demo`.
        filename: AGENTS.md