Omar SobhandClaude Fable 5
7392ce1d08
- SandboxManager (tc-runtime): one container per agent, provisioned
lazily on first use, reused for the manager's lifetime, replaced
transparently if dead, destroyed on shutdown
- shell.exec tool: sh -lc inside the agent's sandbox; stdout/stderr/
exit_code return to the model as the step output. No external effects
declared — the sandbox boundary (uid 10001, no caps, seccomp
allowlist, read-only rootfs, zero egress) is the §15 control here,
not an approval gate
- RuntimeConfig.sandboxes (+ with_sandboxes builder); [sandbox] config
{image, enabled}; the server connects the Docker driver at boot and
tolerates an absent engine (shell.exec reports it per-call)
- Tests with the REAL DockerDriver: a scripted run executes two
commands — output proves uid 10001 from inside, and /home/agent state
written by the first call is read by the second (same sandbox); a
deployment without a sandbox runtime records honest error steps and
the run still completes
151 Rust tests + 27 Playwright journeys.
Co-Authored-By: Claude Fable 5 <[email protected]>
38 lines
973 B
TOML
38 lines
973 B
TOML
[package]
|
|
name = "tc-runtime"
|
|
version = "0.1.0"
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
publish.workspace = true
|
|
|
|
[dependencies]
|
|
async-trait = "0.1"
|
|
chrono = { version = "0.4", default-features = false, features = ["clock"] }
|
|
croner = "2"
|
|
futures = "0.3"
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
sqlx = { workspace = true }
|
|
tc-billing = { path = "../tc-billing" }
|
|
tc-db = { path = "../tc-db" }
|
|
tc-domain = { path = "../tc-domain" }
|
|
tc-files = { path = "../tc-files" }
|
|
tc-llm = { path = "../tc-llm" }
|
|
tc-safety = { path = "../tc-safety" }
|
|
tc-sandbox = { path = "../tc-sandbox" }
|
|
tc-secrets = { path = "../tc-secrets" }
|
|
tc-tools = { path = "../tc-tools" }
|
|
thiserror = { workspace = true }
|
|
time = { workspace = true }
|
|
tokio = { workspace = true }
|
|
uuid = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
axum = "0.8"
|
|
tc-secrets = { path = "../tc-secrets" }
|
|
tc-testkit = { path = "../tc-testkit" }
|
|
|
|
[lints]
|
|
workspace = true
|