tai42-sandbox-docker
Docker sandbox provider for the TAI ecosystem — per-session containers on a REMOTE Docker engine over the Docker Engine API.
Each session runs as its own hardened container on a remote engine reached over mTLS. The app container spawns no local process, holds no host Docker socket, and mounts no host path; real work is driven through the engine's exec API against an idle session container.
Enable it
sandbox_module: tai42_sandbox_docker
Configuration
The SANDBOX_DOCKER_ env group. SANDBOX_DOCKER_HOST is required (a
unix:///var/run/... socket path or a tcp://host:port) and is the only variable
that enters the recycle-pinned app env; the mTLS client certificates are read from
the canonical /certs/client mount. Resource-cap fallbacks
(SANDBOX_DOCKER_DEFAULT_CPU / SANDBOX_DOCKER_DEFAULT_MEMORY_MB), the image
SANDBOX_DOCKER_PULL_POLICY, and the shared TTL / reap / exec-timeout knobs round
out the group.
Security model
- Remote engine over mTLS — no host Docker socket, no privilege in the app container.
- Per-session containers hardened with
no-new-privileges, all capabilities dropped, never privileged, and no host bind mount. - Single-workspace-mount isolation invariant: a session mounts ONLY its own workspace volume and can never read the engine's mTLS client identity.
- Network tiers
none/internal/egressmap onto the engine's network mode; egress default is OPEN, so tool-result data is exfiltratable under open egress (the egress firewall is provisioned at the tai-distribution layer).
Durability model
An ephemeral session's workspace is an anonymous volume reaped with the session; a
persistent session binds a durable named tai-sbx-<workspace_key> volume that
survives the session and its reap, removed only by an explicit unforced teardown.
The durable store is provisioned at the tai-distribution layer.
See docs/index.mdx and the tai-docs operate page for the full settings table and
deployment topology.
The current release line tracks the 7.x contract (tai42-contract>=7,<8).
1 maintainer
Metadata
1 maintainer
Release files for tai42-sandbox-docker 1.1.3
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| tai42_sandbox_docker-1.1.3.tar.gz | 36.9 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| tai42_sandbox_docker-1.1.3-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 60.5 kB
Release files / tai42_sandbox_docker-1.1.3.tar.gz
| Download URL | tai42_sandbox_docker-1.1.3.tar.gz |
|---|---|
| Size | 36.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
0061896241d69092aed2e696ea35cfba77aa9555ffaa2f0aa917ad9f27f4eb57
|
|
BLAKE2b-256 checksum How to use checksums |
c4d4c9c94e858a1c2d6ab7d2d71b1dbe6268d6dc4be1e1c09f2e8e10d8627a18
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / tai42_sandbox_docker-1.1.3-py3-none-any.whl
| Download URL | tai42_sandbox_docker-1.1.3-py3-none-any.whl |
|---|---|
| Size | 23.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
8aee6eb50cfa7ea7d905e97ec7cc74d04c6444611d44c58bdac4de2e85e4e4f4
|
|
BLAKE2b-256 checksum How to use checksums |
e0f048e23d04928ca4614e7a0ae3e6833525a1b93708de841940cd5b2525d777
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
