tai42-sandbox-docker
Docker sandbox provider for the TAI ecosystem — per-session containers on a REMOTE Docker engine over the Docker Engine API.
Each session runs as its own hardened container on a remote engine reached over mTLS. The app container spawns no local process, holds no host Docker socket, and mounts no host path; real work is driven through the engine's exec API against an idle session container.
Enable it
sandbox_module: tai42_sandbox_docker
Configuration
The SANDBOX_DOCKER_ env group. SANDBOX_DOCKER_HOST is required (a
unix:///var/run/... socket path or a tcp://host:port); the mTLS client
certificates are read from the canonical /certs/client mount, never from the
environment. Resource-cap fallbacks (SANDBOX_DOCKER_DEFAULT_CPU /
SANDBOX_DOCKER_DEFAULT_MEMORY_MB), the image SANDBOX_DOCKER_PULL_POLICY, the
opt-in egress-firewall readiness probe (SANDBOX_DOCKER_READINESS_PROBE_ENABLED /
SANDBOX_DOCKER_READINESS_PROBE_IMAGE /
SANDBOX_DOCKER_READINESS_PROBE_TIMEOUT_SECONDS), and the shared TTL / reap /
exec-timeout knobs round out the group.
Security model
- Remote engine over mTLS — no host Docker socket, no privilege in the app container.
- Per-session containers hardened with
no-new-privileges, all capabilities dropped, never privileged, and no host bind mount. - Single-workspace-mount isolation invariant: a session mounts ONLY its own workspace volume and can never read the engine's mTLS client identity.
- Network tiers
none/internal/egressmap onto the engine's network mode; egress default is OPEN, so tool-result data is exfiltratable under open egress (the egress firewall is provisioned by the deployment that runs the engine). - Egress-firewall readiness (opt-in): with
SANDBOX_DOCKER_READINESS_PROBE_ENABLED, a create first proves the engine's egress firewall is in force — a throwaway, unprivileged probe container on the egress tier must not reach the engine's control address and must reach its own resolver — and refuses the create loudly otherwise. Both probe targets are derived, so there is nothing to mis-set.
Durability model
An ephemeral session's workspace is an anonymous volume reaped with the session; a
persistent session binds a durable named tai-sbx-<workspace_key> volume that
survives the session and its reap, removed only by an explicit unforced teardown.
The durable store is provisioned by the deployment that runs the engine.
See docs/index.mdx and the tai-docs operate page for the full settings table and
deployment topology.
1 maintainer
Metadata
1 maintainer
Release files for tai42-sandbox-docker 3.0.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| tai42_sandbox_docker-3.0.0.tar.gz | 46.9 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| tai42_sandbox_docker-3.0.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 76.9 kB
Release files / tai42_sandbox_docker-3.0.0.tar.gz
| Download URL | tai42_sandbox_docker-3.0.0.tar.gz |
|---|---|
| Size | 46.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
d284334a1aa98ee1f6b1f8735bde6e9d7e61bf72e8dd34eab0fb16ca1eda451f
|
|
BLAKE2b-256 checksum How to use checksums |
8edd6404256d7c0ef31ab7063047954468f43ebf591cc5edaa1b9f08e095b394
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / tai42_sandbox_docker-3.0.0-py3-none-any.whl
| Download URL | tai42_sandbox_docker-3.0.0-py3-none-any.whl |
|---|---|
| Size | 29.9 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
bc5c266014921fa923fe7bd5c57460985a55e6e38e460ac3430f5fb207dee2a0
|
|
BLAKE2b-256 checksum How to use checksums |
c822d2ee250b591d058a29cb2f88da18d37d17a27831a17c3214785cb4c3ca69
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Security for tai42-sandbox-docker 3.0.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
