sbx/pi-sessions:latest

schemaVersion: "3"
displayName: Pi host sessions
author: Docker, Inc. https://docker.com
description: Retain pi session state and agent-authored extensions on the host across sandbox removal
sourceUrl: https://github.com/docker-hardened-images/definitions
version: 1.1.0
licenses:
    - Apache-2.0
kind: mixin
requires:
    - pi
capabilities:
    - type: com.docker.sandbox/host-mount@1
      config:
        mode: "0700"
        path: /home/agent/pi-history
    - type: com.docker.sandbox/lifecycle@1
      config:
        install:
            - command: |
                set -eu
                case "${SANDBOX_NAME:-}" in
                  "" | . | .. | */*)
                    printf 'SANDBOX_NAME must be one path segment, got: "%s"\n' "${SANDBOX_NAME:-}" >&2
                    exit 1
                    ;;
                esac
                state="/home/agent/.pi/agent"
                history="/home/agent/pi-history/$SANDBOX_NAME"
                mkdir -p "$state"
                for name in sessions extensions skills prompts themes; do
                  link="$state/$name"
                  target="$history/$name"
                  mkdir -p "$target"
                  if [ -L "$link" ]; then
                    if [ "$(readlink "$link")" != "$target" ]; then
                      printf 'Refusing to replace unexpected symlink: %s\n' "$link" >&2
                      exit 1
                    fi
                    continue
                  fi
                  # rmdir preserves existing sessions and refuses mounted volumes.
                  if [ -e "$link" ]; then
                    if ! rmdir "$link"; then
                      printf 'Cannot replace %s; move existing state to the host directory first.\n' "$link" >&2
                      exit 1
                    fi
                  fi
                  ln -s "$target" "$link"
                done
              description: Link pi session state and authored resources to this sandbox's host-shared directory
              env:
                - SANDBOX_NAME
              user: agent
args:
    version:
        required: true
        description: Revision of the session-linking hook
        pattern: ^[0-9]+\.[0-9]+\.[0-9]+$
        buildArg: VERSION