Optional Docker sandbox: whole-skvm-in-container via --sandbox#39

Open

lec77 wants to merge 40 commits into

mainfrom

worktree-docker-sandbox-strategy-c

Commits on May 27, 2026

core/types: add SandboxConfigSchema for docker sandbox slice
lec77
committed
core/config: load + Zod-validate sandbox slice; expose defaults.sandbox
lec77
committed
test/core: restore SKVM_CACHE + invalidate cache in afterEach for getSandboxConfig tests
lec77
committed
core/config: env-fallback for route apiKey (SKVM_ROUTE_<id>_KEY) for sandbox key injection
lec77
committed
launcher: path-flag enumeration + resolver
lec77
committed
launcher/path-flags: complete enumeration sweep (add 9 missed flags + dup-guard test)
lec77
committed
launcher: compose default + dynamic bind mounts with path-prefix dedup
lec77
committed
launcher/mounts: default existsSync to fs.existsSync so required-path guard runs in production
lec77
committed
launcher/mounts: fix stale comments + remove dead computeInnerPath
lec77
committed
launcher: compose env (proxy passthrough + SKVM_ROUTE_<id>_KEY + sandbox markers)
lec77
committed
launcher: write sanitized in-container skvm.config.json (keys stripped)
lec77
committed
launcher: resolve image ref + ensureImagePresent (pull fallback to build hint)
lec77
committed
launcher: build docker run argv (hardening + mounts + env + labels)
lec77
committed
launcher: reap leaked containers + tmp dirs by host pid label
lec77
committed
launcher: orchestrate sandbox dispatch (compose + exec docker run)
lec77
committed
cli: --sandbox flag + SKVM_IN_SANDBOX re-entry detection + launcher dispatch
lec77
committed
cli: hard-error on --sandbox + config commands (assertSandboxCompatible + dispatch guard)
lec77
committed
launcher: add --mount-extra (repeatable) + --debug-sandbox + config extraMounts plumbing
lec77
committed
docker: add skvm-sandbox image (Ubuntu 24.04 + Bun + opencode + claude-code + skvm binary)
lec77
committed
cli-config: init prompt for defaults.sandbox
lec77
committed
cli-config: show renders sandbox slice (defaults + image + resources + extra mounts)
lec77
committed
cli-config: doctor checks docker presence + image present (sev scales with defaults.sandbox)
lec77
committed
docs: README section for --sandbox + image build + cleanup recipes
lec77
committed
launcher/image: lowercase ghcr.io org name (sjtu-ipads) per docker reference rules
lec77
committed
cli-flags: add sandbox to GLOBAL_FLAGS so --sandbox=false opt-out passes assertKnownFlags
lec77
committed

Commits on May 28, 2026

Commits on May 29, 2026

Commits on Jun 1, 2026

Commits on Jun 2, 2026

launcher: fix root-prefix precedence and pre-create rw mount sources
lec77
committed