dockerproserv/claude-tls-public-kit:0.1.0

schemaVersion: "3"
displayName: Claude TLS public kit (mounted folder)
description: Installs corporate CA certificates from a read-only mounted folder at every start, plus the docker wrapper
kind: mixin
capabilities:
    - type: com.docker.sandbox/lifecycle@1
      config:
        install:
            - command: /usr/share/corporate-ca/install-ca.sh --warn-writable "${{ kit.args.caDir }}"
              description: Install the corporate CA certificates
              user: "0"
            - command: |
                [ "${{ kit.args.dockerWrapper }}" != true ] || /usr/share/docker-ca/install.sh
              description: Install the docker wrapper, the docker-ca skill and the helper
              user: agent
        startup:
            - command: /usr/share/corporate-ca/install-ca.sh --keep-on-empty --warn-writable "${{ kit.args.caDir }}"
              description: Re-read the corporate CA certificate folder
              user: "0"
            - command: |
                [ "${{ kit.args.dockerWrapper }}" != true ] || /usr/share/docker-ca/install.sh
              description: Reinstall the docker wrapper (the same script, safe to repeat)
              user: agent
args:
    caDir:
        default: /Users/Shared/corporate-ca
        description: Path of the certificate folder inside the sandbox (*.crt and *.pem files, mounted read-only)
        pattern: ^/[A-Za-z0-9._/+-]+$
    dockerWrapper:
        default: "true"
        description: Put the docker wrapper ahead of the real docker (true), or leave docker alone (false)
        pattern: ^(true|false)$
build: |
    FROM scratch
    COPY --chmod=0755 install-ca.sh /usr/share/corporate-ca/install-ca.sh
    COPY --chmod=0755 verify-ca /usr/local/bin/verify-ca
    COPY --chmod=0755 docker-ca/skill/ /usr/share/docker-ca/skill/
    COPY --chmod=0755 docker-ca/shim/ /usr/share/docker-ca/shim/
    COPY --chmod=0755 docker-ca/install.sh /usr/share/docker-ca/install.sh