GitHub - cdr-chakotay/sbx-mistral: sbx-mistral is a Docker sandbox for running Mistral Vibe CLI in full isolation. It launches in YOLO mode (auto-approve) by default, letting you run freely without risking your host system. You can switch to confirmation-based modes using Shift+Tab for more controlled execution.

3 min read Original article ↗

sbx-mistral is a Docker sandbox for running Mistral Vibe CLI in full isolation. It launches in YOLO mode (auto-approve) by default, letting you run freely without risking your host system. You can switch to confirmation-based modes using Shift+Tab for more controlled execution.

Before You Start

Setup Docker SBX

  • Install Docker Sandboxes CLI (sbx):
    • macOS: brew install docker/tap/sbx
    • Windows: winget install Docker.sbx
    • See Docker Sandboxes for more

Note: Docker Desktop is not required to use sandboxes.

Register Mistral Vibe API Token

  1. Go to Mistral AI Console and sign in
  2. Find the API Keys section in your account
  3. Create a new API key and copy it
  4. Store it in your system's keychain by running the command below and typing in the token, when being asked for. This has the benefit of your container never seeing the API Token. (Token is inserted through a proxy running on your machine.) 
    sbx secret set -g mistral

Local Mode

Assumed, you just downloaded the kit, and it is placed under ~/Downloads/sbx-mistral. It does not matter where you put it, but for the examples we are using the Download folder path.

You can run a sandbox from any directory on your computer. By default, this will scope the sandbox to your current working directory.

Say we want to edit the project project_awesome located under ~/Code/project_awesome.

cd ~/code/project_awesome  # Change Directory to your project folder

# Use the full path to start the `vibe` agent.
sbx run --kit ~/Downloads/sbx-mistral vibe

You can give it a custom name:

sbx run --kit ~/Downloads/sbx-mistral vibe --name myVibeSandbox

You can scope it to a certain directory other than your current working directory:

sbx run --kit ~/Downloads/sbx-mistral vibe --name myVibeSandbox ~/other/dir/scope

If working on a git project, you can use the clone mode to prevent it being able to alter your main project. However, this is optional! After altering your code, you can fetch it from the sandbox like a git remote.

sbx run --kit ~/Downloads/sbx-mistral vibe --name myVibeSandbox --clone ~/other/dir/scope

Remote Mode

You can use this kit from GitHub without downloading it locally. In general, it works identical to the local approach, but you are referencing a GitHub URL.

# Run from GitHub repository (replace with your actual GitHub URL)
sbx run --kit git+https://github.com/cdr-chakotay/sbx-mistral.git vibe ~/directory/you/want

Troubleshooting

No API key? Make sure you set your API-Key as showed in the setup instructions.

Network issues? The sandbox can connect to:

  • Mistral AI servers
  • GitHub
  • Python package index

Investigate what is failing:

Need more domains? Add a network policy:

sbx policy allow network --sandbox myVibeSandbox "example.com"

Or allow all domains (dangerous):

sbx policy allow network --sandbox myVibeSandbox "*"

Clean up

Remove a sandbox by name:

List all sandboxes:

Additional Resources

Disclaimer

This is a best-effort approach and sandboxing may not be fully effective. Users are required to assess the software's risks themselves. Note: The Mistral Vibe CLI is configured to run in YOLO mode by default and will not prompt for confirmation before using tools.