docs: document sandbox media staging

2026-01-05 06:37:12 +01:00
parent 545f52d7d5
commit 4305472787
2 changed files with 2 additions and 0 deletions
--- a/docs/docker.md
+++ b/docs/docker.md
@@ -73,6 +73,7 @@ container. The gateway stays on your host, but the tool execution is isolated:
 - one container per session (hard wall)
 - per-session workspace folder mounted at `/workspace`
 - allow/deny tool policy (deny wins)
+- inbound media is copied into the sandbox workspace (`media/inbound/*`) so tools can read it

 ### Default behavior