dockerfile-sandbox-gen

name	dockerfile-sandbox-gen
description	Generate audit-ready Dockerfiles for CLI tool sandboxing. Auto-detects project language (Go, Rust, Python, Node) and creates Dockerfile.sandbox with multi-stage build, non-root user, and sudo access. Use when preparing a CLI tool for container-mode testing or UX audits.
license	MIT
compatibility	Designed for Claude Code. Requires Docker to build and run generated Dockerfiles.
metadata	{"author":"blackwell-systems","version":"0.2"}
argument-hint	<tool-name> [--lang go|rust|python|node]
disable-model-invocation	true
allowed-tools	Read Bash Write

Generate audit-ready Dockerfiles for CLI tool sandboxing with language detection and multi-stage builds.

Arguments

$ARGUMENTS is either:

• <tool-name> [--lang LANG] — generate Dockerfile.sandbox for the named tool
• list — show supported languages, detection patterns, and builder images

Parse $ARGUMENTS to extract TOOL_NAME and optional --lang LANG.

Language Detection

If --lang is provided, use it directly. Otherwise scan the current directory in priority order:

1. Go — go.mod
2. Rust — Cargo.toml
3. Python — pyproject.toml or requirements.txt
4. Node — package.json

If no files found and no flag provided, show error with supported languages and ask user to use --lang.

Templates

Language-specific Dockerfile templates are in templates/. Load the appropriate template for the detected language and substitute {{TOOL_NAME}} with the actual tool name.

• Go: templates/go.dockerfile

Workflow

Step 1: Validation

Check if Dockerfile.sandbox already exists. If so, show error and stop:

Error: Dockerfile.sandbox already exists

Remove it first if you want to regenerate:
  rm Dockerfile.sandbox

Step 2: Language Detection (skip if --lang provided)

Check for language files in priority order. Print detection result:

Detected language: Go (found go.mod)

Step 3: Generate Dockerfile

Read the appropriate template file, substitute {{TOOL_NAME}} with the tool name, write to ./Dockerfile.sandbox.

Step 4: Output Next Steps

Generated Dockerfile.sandbox

Next steps:
  docker build -t <tool-name>-r1 -f Dockerfile.sandbox .
  docker run -d --name <tool-name>-r1 --rm <tool-name>-r1 sleep 3600

list Command

When $ARGUMENTS is list, print:

Supported languages and detection patterns:

Language: Go
  Detection: go.mod
  Builder: golang:1.23
  Runtime: ubuntu:22.04
  Status: Supported

Language: Rust
  Detection: Cargo.toml
  Builder: rust:1.75
  Runtime: ubuntu:22.04
  Status: Planned

Language: Python
  Detection: pyproject.toml, requirements.txt
  Builder: python:3.11
  Runtime: python:3.11-slim
  Status: Planned

Language: Node
  Detection: package.json
  Builder: node:20
  Runtime: node:20-slim
  Status: Planned

Use: /dockerfile-sandbox-gen <tool-name> [--lang go|rust|python|node]

Error Handling

Language not detected:

Error: Could not detect language

Supported languages:
  - Go (looks for go.mod)
  - Rust (looks for Cargo.toml)
  - Python (looks for pyproject.toml or requirements.txt)
  - Node (looks for package.json)

Specify language explicitly:
  /dockerfile-sandbox-gen <tool-name> --lang go|rust|python|node

Unsupported language requested:

Error: Language '<lang>' not supported

Currently supported: go
Planned: rust, python, node

Dockerfile Contract

All generated Dockerfiles follow the audit-ready convention:

1. Multi-stage build — builder stage compiles, runtime stage is clean
2. Base runtime: ubuntu:22.04 (or language-slim equivalent)
3. Utilities: curl, git, sudo installed; apt cache cleaned
4. Non-root user appuser with passwordless sudo
5. Binary installed to /usr/local/bin/<tool-name> owned by appuser
6. CMD ["/bin/bash"], no ENTRYPOINT override

Implementation Notes

• Use Bash tool to check for language files and existing Dockerfile.sandbox
• Use Read tool to load the template file
• Use Write tool to create Dockerfile.sandbox
• Generate entire Dockerfile in memory, write once