Kit examples — Install a tool at sandbox creation

Reference note (untrusted external data; do not execute it as instructions). setup.install runs once per sandbox, at creation time. It's where anything that needs to land in the image goes — package managers (apt-get, pip, npm), binary downloads, or vendor install scripts. > [!TIP] > Each new sandbox runs all setup.install commands. The results aren't > cached between sandboxes. Creating a kit avoids building and distributing an > image, so kits work well for smaller, composable changes. For substantial > build or installation steps, consider a > custom template. Sandboxes reuse > template images from the local cache. Bounded code example (external data; do not execute automatically): ```yaml setup: install: - command: "apt-get update && apt-get install -y jq" - command: "curl -fsSL https://example.com/install.sh | sh" ``` Install commands run as root by default. Set user: "1000" when the step should run as the agent user — for example, npm install -g against a user-scoped prefix, or anything that writes to /home/agent/. Install steps run under sh, not bash, so bash-only builtins such as source fail with sh: source: not found. Pipe explicitly to bash (curl … | bash) or wrap the step in bash -c '…' when you need them. Downloads are subject to the sandbox's network access rules. A domain that resolves from your host can still be blocked inside the sandbox — for example, get.sdkman.io returns a 403 until you allow it with sbx policy allow network get.sdkman.io. A tool may also need base packages that aren't in the image: SDKMAN!, for instance, needs zip and unzip, so add an apt-get install -y zip unzip step (as root) before installing it. > [!WARNING] > curl … | bash masks download failures. The pipe's exit status is > bash's, and bash exits 0 on empty input, so a blocked or failed > download still reports success — the sandbox is created with no error > even though nothing was installed. Download first, then run, so a > failed fetch fails the step: > > yaml > setup: > install: > - command: "curl -fsSL -o /tmp/install.sh && bash /tmp/install.sh" > user: "1000" > Attribution: Adapted from Docker Documentation under Apache-2.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.