Method create_container_config

src/docker/mod.rs:384–617

Create a container configuration for both interactive and non-interactive modes. # Arguments `image` - The Docker image to use `task` - The task containing all necessary configuration `agent` - The agent to get volumes and environment variables from `network_name` - The Docker network name for the container to join `proxy_config` - The proxy configuration for env var setup

(
        &self,
        image: &str,
        task: &crate::task::Task,
        agent: &dyn Agent,
        network_name: Option<&str>,
        proxy_config: Option<&crate::context::ResolvedProxyConfig

    /// * `network_name` - The Docker network name for the container to join
    /// * `proxy_config` - The proxy configuration for env var setup
    fn create_container_config(
        &self,
        image: &str,
        task: &crate::task::Task,
        agent: &dyn Agent,
        network_name: Option<&str>,
        proxy_config: Option<&crate::context::ResolvedProxyConfig>,
        proxy_container_ip: Option<&str>,
    ) -> (ContainerCreateBody, DindStorage) {
        let resolved = resolve_config_from_task(task, &self.ctx, &self.event_sender);
        let mut binds = self.build_bind_volumes(task, agent, &resolved);
        let instructions_file_path = PathBuf::from(&task.instructions_file);
        let working_dir = container_working_dir(&task.project);

        let mut env_vars = if let Some(pc) = proxy_config {
            self.build_proxy_env_vars(&resolved, pc)
        } else if self.is_nested() {
            // Nested mode: use a default proxy config to forward env vars
            let default_pc = crate::context::ResolvedProxyConfig::default();
            self.build_proxy_env_vars(&resolved, &default_pc)
        } else {
            Vec::new()
        };

        // Add TSK environment variables for container detection
        env_vars.push("TSK_CONTAINER=1".to_string());
        env_vars.push(format!("TSK_TASK_ID={}", task.id));

        // Add agent-specific environment variables
        for (key, value) in agent.environment() {
            env_vars.push(format!("{key}={value}"));
        }

        // Add environment variables from resolved config (already merged from defaults + project)
        for env_var in &resolved.env {
            env_vars.push(format!("{}={}", env_var.name, env_var.value));
        }

        // Use chroot isolation for Podman/Buildah builds inside DIND containers.
        // Full OCI isolation fails in nested user namespaces because the kernel
        // denies devpts mounts (Permission denied). Chroot isolation avoids
        // creating new namespaces or mounting devpts/proc/sysfs during RUN steps,
        // which is safe since we're already inside a container.
        if task.dind {
            env_vars.push("BUILDAH_ISOLATION=chroot".to_string());
        }

        // Set PYTHONPATH for Python stacks so imports work from the project directory
        if task.stack == "python" {
            env_vars.push(format!("PYTHONPATH={working_dir}"));
        }

        let agent_command = agent.build_command(
            instructions_file_path.to_str().unwrap_or("instructions.md"),
            task.is_interactive,
        );

        let command = if agent_command.is_empty() {