Docker Sandboxes & Agent Containment Walkthrough

Steps

1. 1

   Step 1: Inspect Rootless Daemon & User Namespaces

   Inspect the rootless Docker daemon socket, subuid/subgid allocations, and unprivileged user mappings in the container sandbox environment.

   docker info
   id -u
   cat /etc/subuid
   

2. 2

   Step 2: Verify Network Isolation & Read-Only Rootfs

   Review the container containment execution profile: verify that the workspace runs with --network none, a read-only root filesystem, and strict memory/CPU bounds.

   docker run --rm --network none alpine ip addr
   

3. 3

   Step 3: Validate Declarative Docker Sandbox Configuration

   Run terraform init -backend=false and terraform validate to verify the declarative Docker sandbox infrastructure and container resource specifications offline.

   terraform init -backend=false
   terraform validate
   

   Checked by the agent (terraform-validate): The runner checks that all Docker provider definitions, image tags, and sandbox container resources validate cleanly.