ci: bump the coyote image tag version in the sandbox kit spec

.github/workflows/release.yaml

@@ -8,9 +8,9 @@ on:
   workflow_dispatch:
     inputs:
       bump_type:
-        description: "Specify the type of version bump"
+        description: 'Specify the type of version bump'
         required: true
-        default: "patch"
+        default: 'patch'
         type: choice
         options:
           - patch
@@ -46,7 +46,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: "3.10"
+          python-version: '3.10'
 
       - name: Install Commitizen
         run: |
@@ -108,17 +108,19 @@ jobs:
 
           cargo update || true
 
+          sed -i "s|image: 'darkalex17/coyote:v[^']*'|image: 'darkalex17/coyote:v${VERSION}'|" assets/sbx-kit/spec.yaml
+
           # Git config that helps in Act
           git config user.name  "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
           git status --porcelain
-          git diff --name-only -- Cargo.toml Cargo.lock || true
+          git diff --name-only -- Cargo.toml Cargo.lock assets/sbx-kit/spec.yaml || true
 
-          if ! git diff --quiet -- Cargo.toml Cargo.lock; then
+          if ! git diff --quiet -- Cargo.toml Cargo.lock assets/sbx-kit/spec.yaml; then
-            git add -u -- Cargo.toml Cargo.lock
+            git add -u -- Cargo.toml Cargo.lock assets/sbx-kit/spec.yaml
-            git commit -m "chore: bump Cargo.toml to $VERSION"
+            git commit -m "chore: bump Cargo.toml and sandbox image to $VERSION"
           else
             echo "No changes to commit (already at $VERSION)"
           fi
@@ -163,28 +165,28 @@ jobs:
           - target: aarch64-unknown-linux-musl
             os: ubuntu-latest
             use-cross: true
-            cargo-flags: ""
+            cargo-flags: ''
           - target: aarch64-apple-darwin
             os: macos-latest
             use-cross: true
-            cargo-flags: ""
+            cargo-flags: ''
           - target: aarch64-pc-windows-msvc
             os: windows-latest
             use-cross: true
-            cargo-flags: ""
+            cargo-flags: ''
           - target: x86_64-apple-darwin
             os: macos-latest
-            cargo-flags: ""
+            cargo-flags: ''
           - target: x86_64-pc-windows-msvc
             os: windows-latest
-            cargo-flags: ""
+            cargo-flags: ''
           - target: x86_64-unknown-linux-musl
             os: ubuntu-latest
             use-cross: true
-            cargo-flags: ""
+            cargo-flags: ''
           - target: x86_64-unknown-linux-gnu
             os: ubuntu-latest
-            cargo-flags: ""
+            cargo-flags: ''
 
     steps:
       - name: Check if actor is repository owner
@@ -338,7 +340,7 @@ jobs:
             ${{ steps.package.outputs.archive }} 
             ${{ steps.package.outputs.sha }}
           tag_name: v${{ env.RELEASE_VERSION }}
-          name: "v${{ env.RELEASE_VERSION }}"
+          name: 'v${{ env.RELEASE_VERSION }}'
           body_path: artifacts/changelog.md
           prerelease: false
 
@@ -455,4 +457,64 @@ jobs:
       - uses: katyo/publish-crates@v2
         if: env.ACT != 'true'
         with:
-          registry-token: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+          registry-token: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+
+  publish-sandbox-image:
+    needs: [publish-github-release]
+    name: Publish Sandbox Docker Image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check if actor is repository owner
+        if: ${{ github.actor != github.repository_owner && env.ACT != 'true' }}
+        run: |
+          echo "You are not authorized to run this workflow."
+          exit 1
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Ensure repository is up-to-date
+        if: env.ACT != 'true'
+        run: |
+          git fetch --all
+          git pull
+
+      - name: Get release artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+          merge-multiple: true
+
+      - name: Set version variable
+        run: |
+          version="$(cat artifacts/release-version)"
+          echo "version=$version" >> $GITHUB_ENV
+
+      - name: Validate release environment variables
+        run: |
+          echo "Release version: ${{ env.version }}"
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        if: env.ACT != 'true'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Push to Docker Hub
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: ${{ env.ACT != 'true' }}
+          tags: darkalex17/coyote:latest, darkalex17/coyote:${{ env.version }}
+          build-args: COYOTE_VERSION=${{ env.version }}

Dockerfile

@@ -0,0 +1,70 @@
+ARG COYOTE_VERSION
+FROM docker/sandbox-templates:shell-docker
+
+ARG COYOTE_VERSION
+ARG TARGETARCH
+
+ENV PATH="/home/agent/.cargo/bin:/home/agent/.local/bin:${PATH}"
+
+USER root
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+      jq curl git \
+      build-essential pkg-config \
+      cmake \
+      clang libclang-dev \
+      musl-tools \
+      libssl-dev \
+      pandoc \
+      bzip2 \
+      nano && \
+    rm -rf /var/lib/apt/lists/*
+
+RUN set -euo pipefail; \
+    USQL_VERSION=0.21.4; \
+    case "${TARGETARCH}" in \
+      amd64) USQL_ARCH=amd64 ;; \
+      arm64) USQL_ARCH=arm64 ;; \
+      *) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac; \
+    TMPDIR=$(mktemp -d); \
+    curl -fsSL --retry 3 \
+      "https://github.com/xo/usql/releases/download/v${USQL_VERSION}/usql_static-${USQL_VERSION}-linux-${USQL_ARCH}.tar.bz2" \
+      -o "$TMPDIR/usql.tar.bz2"; \
+    tar -xjf "$TMPDIR/usql.tar.bz2" -C "$TMPDIR"; \
+    install -m 0755 "$TMPDIR/usql_static" /usr/local/bin/usql; \
+    rm -rf "$TMPDIR"
+
+USER 1000
+
+RUN curl -LsSf https://astral.sh/uv/install.sh | sh && \
+    printf '#!/bin/sh\nexec uv tool run "$@"\n' > "$HOME/.local/bin/uvx" && \
+    chmod +x "$HOME/.local/bin/uvx"
+
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
+      sh -s -- -y --default-toolchain stable --profile minimal && \
+    . "$HOME/.cargo/env" && \
+    cargo install --locked iwec && \
+    cargo install --locked ast-grep
+
+USER root
+
+RUN set -euo pipefail; \
+    case "${TARGETARCH}" in \
+      amd64) MUSL_TARGET=x86_64-unknown-linux-musl ;; \
+      arm64) MUSL_TARGET=aarch64-unknown-linux-musl ;; \
+      *) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac; \
+    TMPDIR=$(mktemp -d); \
+    curl -fsSL --retry 3 \
+      "https://github.com/Dark-Alex-17/coyote/releases/download/v${COYOTE_VERSION}/coyote-${MUSL_TARGET}.tar.gz" \
+      -o "$TMPDIR/coyote.tar.gz"; \
+    tar -xzf "$TMPDIR/coyote.tar.gz" -C "$TMPDIR"; \
+    install -m 0755 "$TMPDIR/coyote" /home/agent/.cargo/bin/coyote; \
+    chown 1000:1000 /home/agent/.cargo/bin/coyote; \
+    rm -rf "$TMPDIR"
+
+USER 1000
+
+ENTRYPOINT ["coyote"]

README.md

@@ -100,6 +100,32 @@ To upgrade `coyote` using Homebrew:
 brew upgrade coyote
 ```
 
+### Docker
+Coyote is available as a Docker image on Docker Hub (`darkalex17/coyote`) for Linux amd64 and arm64.
+Useful for CI, ephemeral environments, or anywhere you prefer not to install it natively.
+
+```bash
+docker pull darkalex17/coyote
+docker run --rm -it darkalex17/coyote
+```
+
+To persist your configuration across container runs, mount your existing config directory:
+
+```bash
+docker run --rm -it \
+  -v ~/.config/coyote:/home/agent/.config/coyote \
+  darkalex17/coyote
+```
+
+If you use the local vault provider and want your vault credentials available in the container, also mount the password file:
+
+```bash
+docker run --rm -it \
+  -v ~/.config/coyote:/home/agent/.config/coyote \
+  -v ~/.coyote_password:/home/agent/.coyote_password:ro \
+  darkalex17/coyote
+```
+
 ### Scripts
 #### Linux/MacOS (`bash`)
 You can use the following command to run a bash script that downloads and installs the latest version of `coyote` for your

assets/sbx-kit/spec.yaml

@@ -14,7 +14,7 @@ description: >
   CLI & REPL mode, RAG, AI tools & agents, MCP servers, skills, and macros.
 
 sandbox:
-  image: 'docker/sandbox-templates:shell-docker'
+  image: 'darkalex17/coyote:v0.7.4'
   aiFilename: COYOTE.md
   entrypoint:
     run: ['bash', '-lc', 'exec /home/agent/.cargo/bin/coyote']
@@ -118,7 +118,7 @@ network:
     - 'raw.githubusercontent.com:443'
     - 'objects.githubusercontent.com:443'
     - '*.githubusercontent.com:443'
-    # Coyote install paths (cargo install + uv + rustup + Python tool deps at runtime)
+    # Package managers and developer tools (cargo, uv, pip — useful at runtime for user installs)
     - 'crates.io:443'
     - 'static.crates.io:443'
     - 'pypi.org:443'
@@ -239,66 +239,6 @@ environment:
     - ZHIPUAI_API_KEY
 
 commands:
-  install:
-    - command: |
-        sudo apt-get update &&
-        sudo apt-get install -y \
-          jq curl git \
-          build-essential pkg-config \
-          cmake \
-          clang libclang-dev \
-          musl-tools \
-          libssl-dev \
-          pandoc \
-          bzip2 \
-          nano
-      user: '1000'
-      description: Install system prerequisites (including pandoc for fetch_url_via_curl)
-    - command: |
-        curl -LsSf https://astral.sh/uv/install.sh | sh
-        if [ -f "$HOME/.local/bin/uv" ]; then
-          printf '#!/bin/sh\nexec uv tool run "$@"\n' > "$HOME/.local/bin/uvx"
-          chmod +x "$HOME/.local/bin/uvx"
-        fi
-      user: '1000'
-      description: Install uv and write a uvx shell wrapper (the installer may place a macOS binary at this path on Docker-for-Mac hosts, which the Linux container cannot execute)
-    - command: |
-        set -euo pipefail
-        USQL_VERSION=0.21.4
-        ARCH=$(uname -m)
-        case "$ARCH" in
-          x86_64) USQL_ARCH=amd64 ;;
-          aarch64) USQL_ARCH=arm64 ;;
-          *) echo "Unsupported arch for usql install: $ARCH" >&2; exit 1 ;;
-        esac
-        TMPDIR=$(mktemp -d)
-        trap 'rm -rf "$TMPDIR"' EXIT
-        curl -fsSL --retry 3 "https://github.com/xo/usql/releases/download/v${USQL_VERSION}/usql_static-${USQL_VERSION}-linux-${USQL_ARCH}.tar.bz2" -o "$TMPDIR/usql.tar.bz2"
-        tar -xjf "$TMPDIR/usql.tar.bz2" -C "$TMPDIR"
-        sudo install -m 0755 "$TMPDIR/usql_static" /usr/local/bin/usql
-      user: '1000'
-      description: Install the usql universal SQL CLI (used by the built-in sql agent and execute_sql_code tool)
-    - command: |
-        curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
-          sh -s -- -y \
-          --default-toolchain stable \
-          --profile minimal \
-          --target x86_64-unknown-linux-musl
-        . "$HOME/.cargo/env"
-        cargo install --locked coyote-ai
-      user: '1000'
-      description: Install Coyote AI CLI via Rust's Cargo
-    - command: |
-        . "$HOME/.cargo/env"
-        cargo install --locked iwec
-      user: '1000'
-      description: Install the IWE MCP server binary (iwec) used by the built-in iwe MCP server and iwe-knowledge-base skill
-    - command: |
-        . "$HOME/.cargo/env"
-        cargo install --locked ast-grep
-      user: '1000'
-      description: Install ast-grep, used by the built-in ast_grep structural code search tool (and the explore agent)
-
   startup:
     - command:
         [