ducoterra
144e322391
Everything else in the file gates egress, which left an everyday request unanswered: the agent starts a dev server inside the sandbox and a human wants to look at it. This puts a listener on the host that forwards into the container, so a browser, curl or an API tester reaches the server the sandboxed process runs. `--publish [ADDR:]HOST:CONTAINER`, config `publish` and AISB_PUBLISH, repeatable, with the cost named in the flag: it is ingress, so whatever that server serves is reachable from the address it binds. The default address is 127.0.0.1 because a bare podman -p binds every interface (measured) -- a port committed in a repo config must not quietly be a port on the LAN. publish_addr changes the default machine-wide; a spec with a non-loopback address warns on every run. The grammar is smaller than podman's on purpose: one port per entry, no ranges, no /udp, no `*` -- this list is reviewed line by line, and typing 0.0.0.0 is the whole warning. An address means three parts, so `127.0.0.1:8000` is refused rather than guessed. No -p alias: that flag belongs to the harness (claude -p prints). Fail closed, as elsewhere: --net none cannot forward a port and podman discards the mapping while starting the container anyway, so "it ran" would mean "nothing is listening"; a host port already in use is named before the container starts, not after a build; pick_port() will not hand the gate a port this run publishes. The container is labelled with the ports it was given, and doctor reports them. Inside, publish_rules() accepts tcp on the published ports in the input chain and never the output one. Measured (docs/networking.md): pasta delivers the connection over loopback, so that rule counts 0 packets on the reference host; it is there for a host or a bridge network that delivers on the interface, and so that `nft list table inet aisb` answers "what can reach this container". The ports are validated again inside the entrypoint, because a ruleset is not somewhere to splice an unvalidated string. And the measurement that makes a configured preview look broken: a server bound to 127.0.0.1 inside answers inside and refuses the published port outside, so dev servers must bind 0.0.0.0 -- both skills say so in the change that writes the port. Tests. Unit: the grammar and every port list that looks right and is not, config/env/flag precedence and dedup, the canonical spec in --print-policy, the `# ingress:` header, the flags reaching the invocation before the image, egress enforcement byte-identical with a port open, which chain the rule lands in and that a non-numeric port never reaches nft as code. e2e (tests/e2e/13_publish.sh): one real container with enforce=nft where the host gets its 200 and the same run still refuses a domain outside the allowlist at 403, the server runs as uid 1000 with no capabilities so it cannot widen its own port, and the host listener is gone when the container exits. LLM-Generated: true
143 lines
6.3 KiB
Plaintext
143 lines
6.3 KiB
Plaintext
# config for ai-sandbox -- copy to ~/.config/ai-sandbox/config and edit
|
|
#
|
|
# Format: key = value. '#' starts a comment.
|
|
# Precedence: built-in default < this file (user) < ./.ai-sandbox/config (repo)
|
|
# < AISB_* environment variable < command line flag.
|
|
#
|
|
# Keys listed under "repeatable" accumulate; every other key replaces.
|
|
|
|
# --- network ---------------------------------------------------------------
|
|
# none | allow | full. allow is the safe default and requires an allowlist.
|
|
net = allow
|
|
|
|
# Address that stands for the host's loopback inside the container
|
|
# (--network=pasta:--map-host-loopback,<addr>). Change only if it collides
|
|
# with a real network you need to reach.
|
|
# gate_addr = 100.64.0.1
|
|
|
|
# Preferred first port for the per-session egress gate; the next free port is
|
|
# used if it is busy.
|
|
# gate_port = 18081
|
|
|
|
# --- published ports (ingress) ----------------------------------------------
|
|
# Everything else here is egress. 'publish' opens a listener on the host that
|
|
# forwards into the container, so a browser on the host can look at a dev server the
|
|
# sandbox is running. Repeatable; shapes are 'port', 'host:container' and
|
|
# 'addr:host:container'. One port per entry: no ranges, no /udp.
|
|
#
|
|
# The cost is ingress: whatever that server serves, or accepts, is reachable from the
|
|
# address it is bound to. Egress is untouched either way.
|
|
# publish = 8000 # 127.0.0.1:8000 -> container 8000
|
|
# publish = 18080:3000 # 127.0.0.1:18080 -> container 3000
|
|
# publish = 0.0.0.0:18080:3000 # every interface -- warned about, do not commit it
|
|
#
|
|
# A server inside the container has to listen on 0.0.0.0 to be reachable this way:
|
|
# pasta delivers the connection to the container's own address, not to its loopback.
|
|
#
|
|
# The address a bare 'publish = 8000' binds on the host. Machine-wide, not per-project:
|
|
# leave it loopback in a repo config. Set it in this file only, and only if you know
|
|
# what is routed to you.
|
|
# publish_addr = 127.0.0.1
|
|
|
|
# --- harness ---------------------------------------------------------------
|
|
# Default in-container command: pi | codex | claude | none | "<your command>"
|
|
# harness = pi
|
|
|
|
# --- mounts and layout -----------------------------------------------------
|
|
# Where the current directory is mounted inside the container, which is also the
|
|
# working directory. 'auto' (the default) uses the path it has on the host, so the
|
|
# agent's pwd and the paths it prints are the ones you act on afterwards. It falls
|
|
# back to /project when the host path would cover something the image or the sandbox
|
|
# owns (/usr, /etc, /var, /opt, /tmp, /run, /home/sandbox) and announces the fallback.
|
|
# workdir = auto
|
|
|
|
# --- limits ----------------------------------------------------------------
|
|
# cpus = 4
|
|
# memory = 4g
|
|
# pids = 512
|
|
# tmpfs_size = 1g
|
|
|
|
# --- image -----------------------------------------------------------------
|
|
# One base for both images (the gate is squid from this distro's apt, not a
|
|
# third-party image). base_image may itself be pinned: name@sha256:...
|
|
# base_image = docker.io/library/ubuntu:24.04
|
|
# node_version = 22.23.4
|
|
# pi_version = 1.4.0
|
|
#
|
|
# The tag is resolved to a registry digest and that digest becomes part of the
|
|
# image tag, so builds are reproducible and a base patch is visible instead of
|
|
# quietly folding into an existing image. Every base_ttl_days the digest is
|
|
# re-resolved -- a manifest read, not a download. 0 re-resolves on every build,
|
|
# -1 never does.
|
|
# base_ttl_days = 7
|
|
#
|
|
# 0 keeps the recorded digest even past its TTL: nothing reaches the registry
|
|
# unless you say so. An explicit refresh is `ai-sandbox update [--check]`.
|
|
# base_auto_update = 1
|
|
|
|
# --- pi --------------------------------------------------------------------
|
|
# Bridge ~/.pi/agent/{models,settings}.json into the sandbox, with every provider
|
|
# apiKey replaced by an environment reference (nothing secret is written into the
|
|
# container). 0 = pi starts with its own defaults.
|
|
# pi_config = 1
|
|
#
|
|
# The variable the bridged config reads the credential from, and whether ai-sandbox
|
|
# passes that one variable automatically when it is set. If it reaches neither, the
|
|
# run is refused instead of launching a pi that cannot talk to its model.
|
|
# pi_token_env = AI_API_TOKEN
|
|
# pi_token_auto = 1
|
|
#
|
|
# The thinking level a sandboxed pi reasons at: off, minimal, low, medium, high, xhigh
|
|
# or max. pi's own default is medium; ai-sandbox states xhigh and re-applies it on every
|
|
# run, so one run cannot lower the thinking of the next. 'host' stops forcing it and lets
|
|
# settings.json decide. pi only -- other harnesses read their own config.
|
|
# thinking = xhigh
|
|
#
|
|
# Where to read the host config from (default ~/.pi/agent).
|
|
# pi_agent_dir = ~/.pi/agent
|
|
|
|
# --- skills and standing instructions ---------------------------------------
|
|
# Your host ~/.agents is bind-mounted read-only at /home/sandbox/.agents, which is
|
|
# where pi (and the other harnesses) look for user-level skills, prompt templates and
|
|
# standing instructions. Read-only, and there is no way to make it writable: a skill is
|
|
# an instruction the model follows later, on the host, so a sandbox that could write one
|
|
# would have a persistence path out of itself. 0 = your skills stay at home.
|
|
# agents = 1
|
|
#
|
|
# Which directory to share ('~' is expanded). A project's own .agents/ needs no setting
|
|
# here: it comes in with the project mount, alongside this one.
|
|
# agents_dir = ~/.agents
|
|
#
|
|
# Where it lands in the container. Keep it under HOME -- that is the only place a
|
|
# harness looks for user-level skills.
|
|
# agents_dest = /home/sandbox/.agents
|
|
|
|
# --- behaviour -------------------------------------------------------------
|
|
# SELinux bind-mount option: ':z' (shared), ':Z' (private) or empty to disable.
|
|
# Defaults to ':z' when getenforce exists.
|
|
# selinux = :z
|
|
|
|
# Persist /home/sandbox in a named volume so harness logins and tool caches
|
|
# survive between runs. 0 = use a throwaway tmpfs instead.
|
|
# home_cache = 1
|
|
|
|
# Appended verbatim to the podman invocation (power users; word-split).
|
|
# extra_args = --annotation io.k8s.description="agent sandbox"
|
|
|
|
# --- repeatable keys -------------------------------------------------------
|
|
# These may appear more than once, and are merged with --allow / --env / etc.
|
|
#
|
|
# allow = aipi.reeseapps.com
|
|
# allow = registry.npmjs.org:443
|
|
# allow = 10.20.0.5:5432
|
|
#
|
|
# env = AI_API_TOKEN
|
|
# env = CI_JOB_TOKEN
|
|
#
|
|
# mount = ~/.ssh:ro
|
|
# mount = ../docs:/docs:ro
|
|
#
|
|
# install = postgresql-client
|
|
#
|
|
# label = team=platform
|