# config for ai-sandbox -- copy to ~/.config/ai-sandbox/config and edit
#
# Format: key = value.  '#' starts a comment.
# Precedence: built-in default < this file (user) < ./.ai-sandbox/config (repo)
#             < AISB_* environment variable < command line flag.
#
# Keys listed under "repeatable" accumulate; every other key replaces.

# --- network ---------------------------------------------------------------
# none | allow | full.  allow is the safe default and requires an allowlist.
net = allow

# Address that stands for the host's loopback inside the container
# (--network=pasta:--map-host-loopback,<addr>).  Change only if it collides
# with a real network you need to reach.
# gate_addr = 100.64.0.1

# Preferred first port for the per-session egress gate; the next free port is
# used if it is busy.
# gate_port = 18081

# --- harness ---------------------------------------------------------------
# Default in-container command: pi | codex | claude | none | "<your command>"
# harness = pi

# --- mounts and layout -----------------------------------------------------
# workdir = /project

# --- limits ----------------------------------------------------------------
# cpus = 4
# memory = 4g
# pids = 512
# tmpfs_size = 1g

# --- image -----------------------------------------------------------------
# base_image = docker.io/library/ubuntu:24.04
# node_version = 22.23.4
# pi_version = 1.4.0

# --- behaviour -------------------------------------------------------------
# SELinux bind-mount option: ':z' (shared), ':Z' (private) or empty to disable.
# Defaults to ':z' when getenforce exists.
# selinux = :z

# Persist /home/sandbox in a named volume so harness logins and tool caches
# survive between runs.  0 = use a throwaway tmpfs instead.
# home_cache = 1

# Appended verbatim to the podman invocation (power users; word-split).
# extra_args = --annotation io.k8s.description="agent sandbox"

# --- repeatable keys -------------------------------------------------------
# These may appear more than once, and are merged with --allow / --env / etc.
#
# allow = api.anthropic.com
# allow = registry.npmjs.org:443
# allow = 10.20.0.5:5432
#
# env = ANTHROPIC_API_KEY
# env = CI_JOB_TOKEN
#
# mount = ~/.ssh:ro
# mount = ../docs:/docs:ro
#
# install = postgresql-client
#
# label = team=platform