>_
.issue.db
/highway
Dashboard
Issues
Memory
Lessons
Audit Log
New Issue
Edit Issue #760
Update issue details
Title *
Description
Wired tools.shell.run to the enterprise Docker sandbox with network_mode=none. run_shell_in_sandbox (enterprise/tools/sandbox.py) hardcodes network=none + pids_limit=128 + nano_cpus=2e9 atop cap_drop=ALL/no-new-privileges/read_only/user=nobody/mem_limit; execute.py replaces use_sandbox=False with should_use_sandbox() + a sandbox exec branch. Validated on demo: probe ran as nobody in a net=none container, /app absent (engine FS invisible), rootfs read-only. The docker.sock-mounted worker spawns the locked-down child; sandbox base python:3.12-bookworm pre-pulled. FOLLOW-UPS: (1) long/blocking commands hold a worker for their full duration via container.wait (idle_in_txn=5min) -> DoS/throughput vector; reduce [sandbox] timeout default + async exec + rate limits. (2) sandbox not pinned by gVisor/Kata (kernel-escape DiD). (3) socket-proxy the worker docker.sock so a worker bug can't spawn privileged containers.
Priority
Low
Medium
High
Critical
Status
Open
In Progress
Closed
Won't Do
Due Date (YYYY-MM-DD)
Tags (comma separated)
Related Issues (IDs)
Enter IDs of issues related to this one. They will be linked as 'related'.
Update Issue
Cancel