Optionaloptions: {OptionaldefaultImage?: stringOptionaldockerRunner?: (args: string[]) => Promise<string>Test seam overriding the docker CLI command runner.
OptionalexecutorFactory?: (containerName: string, hostPath: string) => SandboxExecutorTest seam overriding the per-container executor; runs commands outside the container.
OptionalhostRootPath?: stringReleases the workspace.
Must be safe to call on every exit path including crash and cancellation, and must not throw — a finalize that throws inside a failure path masks the original error with a cleanup error.
Checks whether the container for handle is still running via docker container inspect.
Returns false when inspect prints false or fails with No such container / No such object.
Any other error or unclear output returns true (fail-safe) so callers never delete bind-mounted
host directories while a container process might still be alive.
Provisions (or reattaches to) the workspace identified by key.
Runs each harness turn inside a per-run container.
Why this exists
LocalDirectorySandboxProvider scopes a directory but does not contain the process: the harness runs on the MJAPI host with that host's network reach and cloud credentials. For a feature whose entire purpose is executing an autonomous agent's shell commands, that is the wrong blast radius anywhere but a developer's laptop.
Here the harness runs in a container with the workspace bind-mounted, so a file write outside the workspace hits the container's filesystem and dies with it, and
networkPolicyis enforced by Docker rather than merely documented.Container per RUN, exec per TURN
The container starts once at Provision and every turn is a
docker execinto it. The alternative —docker runper turn — would pay container startup on every turn and, worse, lose any in-container state the harness accumulated outside the mounted workspace. A run is the natural lifetime because it is exactly the span over which a harness session is continuous.Network policy
nonemaps to--network none.mcp-onlyandallowlistcurrently map to a bridge network and are NOT yet enforced at the packet level — enforcing them properly needs a per-run network with egress rules, which is the next increment. They are documented here as not-yet-enforced rather than quietly treated as equivalent toopen, because an operator who believesmcp-onlyis enforced has a false sense of containment, which is worse than knowing the boundary is soft.