feat(code) add Docker sandbox - #5700
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
| check=False, | ||
| capture_output=True, | ||
| text=True, | ||
| timeout=timeout, |
There was a problem hiding this comment.
The _run_docker() helper buffers all stdout/stderr into host memory via capture_output=True before execute() applies max_output_bytes. A user-controlled command like dd if=/dev/zero bs=1M can exhaust host RAM within the 120-second timeout window; the Docker --memory container limit does not protect the host-side pipe buffer.
return subprocess.run( # noqa: S603
["docker", *args], # noqa: S607
check=False,
capture_output=True,
text=True,
timeout=timeout,
)Remediation: Switch _run_docker to subprocess.Popen with chunked reads capped at max_output_bytes, killing the process once the cap is reached. Alternatively, enable the existing capture-offload path by default — it already uses head -c to cap output at 10 MB before data enters the host pipe.
Attack Path
- LLM agent issues
execute(command='dd if=/dev/zero bs=1M count=100000 | cat') FilesystemMiddlewarepasses command verbatim tobackend.execute()(filesystem.py:2883)DockerSandbox.execute()calls_run_docker()withdocker exec sh -c <command>(backend.py:180)subprocess.run(capture_ou AF49 tput=True)reads the pipe into host memory with no bound- Container
--memory 256mlimits the container process, not the host pipe buffer - Host Python process OOM-crashes;
max_output_bytescheck is never reached (backend.py:220)
For more details, see the finding in Corridor.
Provide feedback: Reply with whether this is a valid vulnerability or false positive to help improve Corridor's accuracy.
Closes #3128
Adds a local Docker sandbox partner so Deep Agents can run shell commands in an isolated container.
This is a port of deepagents-docker.
When you construct
DockerSandbox, it starts a container and keeps it live for the whole session. You can pass ashared_diron the host (or let it make a temp one). That folder is mounted at/sharedinside the container. File tools read and write the host folder, so if the agent writesreport.md, you can open it on your machine.execute()isdocker execwith working directory/shared, so pip installs and anything else the shell does, stays in the container.It uses the Docker CLI rather than the Python SDK, so the only package dependency is
deepagents. The original knobs are still there:memory,cpus,pids_limit,allow_outbound_traffic,extra_run_args. Defaults stay tight (256MB, half a CPU).PLAESE NOTE:
langchain-dockeris already taken on PyPI, so the first release will need a different name or a transfer.