8000
Skip to content

feat(code) add Docker sandbox - #5700

Open
Andrea Bruno (andybbruno) wants to merge 2 commits into
langchain-ai:mainfrom
andybbruno:andybbruno/feat/add-docker-sandbox
Open

feat(code) add Docker sandbox#5700
Andrea Bruno (andybbruno) wants to merge 2 commits into
langchain-ai:mainfrom
andybbruno:andybbruno/feat/add-docker-sandbox

Conversation

@andybbruno
Copy link
Copy Markdown

Closes #3128

Adds a local Docker sandbox partner so Deep Agents can run shell commands in an isolated container.


This is a port of deepagents-docker.

When you construct DockerSandbox, it starts a container and keeps it live for the whole session. You can pass a shared_dir on the host (or let it make a temp one). That folder is mounted at /shared inside the container. File tools read and write the host folder, so if the agent writes report.md, you can open it on your machine. execute() is docker exec with working directory /shared, so pip installs and anything else the shell does, stays in the container.

It uses the Docker CLI rather than the Python SDK, so the only package dependency is deepagents. The original knobs are still there: memory, cpus, pids_limit, allow_outbound_traffic, extra_run_args. Defaults stay tight (256MB, half a CPU).

PLAESE NOTE: langchain-docker is already taken on PyPI, so the first release will need a different name or a transfer.

@github-actions github-actions Bot added dependencies Pull requests that update a dependency file github_actions PR touching `.github` size: XL 1000+ LOC labels Aug 20, 2026
@langchain-oss-automated-triage langchain-oss-automated-triage Bot added new-contributor First-time contributor to this repo external User is not a member of the `langchain-ai` GitHub organization labels Aug 20, 2026
@socket-security
Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedpypi/​langchain-core@​1.5.677100100100100
Addedpypi/​langsmith@​0.11.096100100100100
Addedpypi/​packaging@​26.399100100100100
Addedpypi/​langchain-anthropic@​1.5.6100100100100100
Addedpypi/​ty@​0.0.73100100100100100
Addedpypi/​wcmatch@​11.0.1100100100100100

View full report

@corridor-security corridor-security Bot left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Docker sandbox backend buffers all subprocess stdout/stderr into host memory before truncation, allowing a user-controlled command to exhaust host memory and crash the Python process despite the container memory limit.

check=False,
capture_output=True,
text=True,
timeout=timeout,
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The _run_docker() helper buffers all stdout/stderr into host memory via capture_output=True before execute() applies max_output_bytes. A user-controlled command like dd if=/dev/zero bs=1M can exhaust host RAM within the 120-second timeout window; the Docker --memory container limit does not protect the host-side pipe buffer.

return subprocess.run(  # noqa: S603
    ["docker", *args],  # noqa: S607
    check=False,
    capture_output=True,
    text=True,
    timeout=timeout,
)

Remediation: Switch _run_docker to subprocess.Popen with chunked reads capped at max_output_bytes, killing the process once the cap is reached. Alternatively, enable the existing capture-offload path by default — it already uses head -c to cap output at 10 MB before data enters the host pipe.

Attack Path
  1. LLM agent issues execute(command='dd if=/dev/zero bs=1M count=100000 | cat')
  2. FilesystemMiddleware passes command verbatim to backend.execute() (filesystem.py:2883)
  3. DockerSandbox.execute() calls _run_docker() with docker exec sh -c <command> (backend.py:180)
  4. subprocess.run(capture_ou AF49 tput=True) reads the pipe into host memory with no bound
  5. Container --memory 256m limits the container process, not the host pipe buffer
  6. Host Python process OOM-crashes; max_output_bytes check is never reached (backend.py:220)

For more details, see the finding in Corridor.

Provide feedback: Reply with whether this is a valid vulnerability or false positive to help improve Corridor's accuracy.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file external User is not a member of the `langchain-ai` GitHub organization github_actions PR touching `.github` new-contributor First-time contributor to this repo size: XL 1000+ LOC

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add Docker sandbox

1 participant

0