Secure container for executing skills. Supports two execution modes: - use_sandbox=True: Execute in Docker sandbox via ms-enclave (recommended for untrusted code) - use_sandbox=False: Execute locally with security checks (for trusted code or no Docker) Features: - Docker-b
| 323 | |
| 324 | |
| 325 | class SkillContainer: |
| 326 | """ |
| 327 | Secure container for executing skills. |
| 328 | |
| 329 | Supports two execution modes: |
| 330 | - use_sandbox=True: Execute in Docker sandbox via ms-enclave (recommended for untrusted code) |
| 331 | - use_sandbox=False: Execute locally with security checks (for trusted code or no Docker) |
| 332 | |
| 333 | Features: |
| 334 | - Docker-based isolation via ms-enclave |
| 335 | - Python scripts, Python code, shell commands, and JavaScript support |
| 336 | - Cross-platform support (Mac/Linux/Windows) |
| 337 | - RCE prevention and security checks |
| 338 | """ |
| 339 | |
| 340 | # Container paths for sandbox (following AgentSkill pattern) |
| 341 | SANDBOX_ROOT = '/sandbox' |
| 342 | SANDBOX_OUTPUT_DIR = '/sandbox/outputs' |
| 343 | SANDBOX_WORK_DIR = '/sandbox/scripts' |
| 344 | |
| 345 | def __init__(self, |
| 346 | workspace_dir: Optional[Union[str, Path]] = None, |
| 347 | timeout: int = 300, |
| 348 | image: str = 'python:3.11-slim', |
| 349 | memory_limit: str = '512m', |
| 350 | enable_security_check: bool = True, |
| 351 | network_enabled: bool = False, |
| 352 | use_sandbox: bool = True): |
| 353 | """ |
| 354 | Initialize the skill container. |
| 355 | |
| 356 | Args: |
| 357 | workspace_dir: Host working directory for I/O. Creates temp dir if None. |
| 358 | timeout: Default execution timeout in seconds. |
| 359 | image: Docker image for sandbox execution. |
| 360 | memory_limit: Memory limit for sandbox container. |
| 361 | enable_security_check: Whether to check code for dangerous patterns. |
| 362 | network_enabled: Whether to enable network in sandbox (disabled by default for security). |
| 363 | use_sandbox: Whether to use Docker sandbox (True) or local execution (False). |
| 364 | """ |
| 365 | # Ensure workspace_dir is an absolute path (required by Docker) |
| 366 | if workspace_dir: |
| 367 | self.workspace_dir = Path(workspace_dir).resolve() |
| 368 | else: |
| 369 | self.workspace_dir = Path( |
| 370 | tempfile.mkdtemp(prefix='skill_container_')).resolve() |
| 371 | self.workspace_dir.mkdir(parents=True, exist_ok=True) |
| 372 | |
| 373 | self.timeout = timeout |
| 374 | self.image = image |
| 375 | self.memory_limit = memory_limit |
| 376 | self.enable_security_check = enable_security_check |
| 377 | self.network_enabled = network_enabled |
| 378 | self.use_sandbox = use_sandbox |
| 379 | self.spec = ExecutionSpec() |
| 380 | |
| 381 | # Host directories for I/O management (only outputs, scripts, logs) |
| 382 | self.output_dir = self.workspace_dir / 'outputs' |