@lssm-tech/integration.agent-sandbox
Production Docker and development-fixture implementations of
@lssm-tech/lib.ai-agent sandbox ports.
Scope
DockerAgentSandbox creates one OS-contained container per workspace with a read-only root, private tmpfs workspace, dropped capabilities,
no-new-privileges, non-root execution, and explicit memory/PID/output/time limits.- Docker networking is deny-all by default. Each allowlisted TCP target is DNS-pinned before attachment and exposed through a dedicated restricted sidecar on an internal-only network, preventing direct DNS/IP bypass.
- Commands, read/write roots, network targets, and secrets are deny-by-default. Secrets are resolved by reference for one command, redacted from output, and rejected from reads or artifact extraction if a command persisted them.
- Extracts immutable artifacts through
@lssm-tech/lib.files.
LocalDevelopmentSandbox remains an honest policy/redaction fixture and rejects isolation, egress, and quota claims it cannot prove.
bun test src/docker-agent-sandbox.test.ts runs the adapter in an external fixture against a live Docker daemon. It covers command denial, traversal and symlink attacks, DNS/IP egress bypass, positive network allowlisting, child-process fanout, memory/CPU/output limits, cancellation, teardown, secret scrubbing, and artifact integrity.
UDP allowlisting is rejected rather than silently weakened.
Docker teardown now verifies container and network absence through inventory. A failed removal acknowledgement is recoverable only when absence is confirmed. Unconfirmed teardown throws and retains the workspace handle for retry. This is removal verification, not durable restart discovery or executor fencing.
Docker CLI operations default to a five-minute deadline. Sandbox commands use the policy timeout plus 30 seconds for transport. Deadline and input failures kill the CLI client and report an unknown external outcome; they neither retry the command nor prove the daemon-side process stopped. Reconcile the workspace before resuming effects.
Network and proxy names are tracked before allocation so lost creation acknowledgements retain cleanup targets. Container creation failures also enter cleanup. This process-local tracking does not yet provide restart discovery. Containment conformance fails on teardown errors instead of suppressing them.
