feat(sandbox): per-agent docker overrides

src/agents/sandbox-agent-config.test.ts

@@ -1,16 +1,24 @@
 import { EventEmitter } from "node:events";
 import { Readable } from "node:stream";
-import { describe, expect, it, vi } from "vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
 import type { ClawdbotConfig } from "../config/config.js";
 
 // We need to test the internal defaultSandboxConfig function, but it's not exported.
 // Instead, we test the behavior through resolveSandboxContext which uses it.
 
+type SpawnCall = {
+  command: string;
+  args: string[];
+};
+
+const spawnCalls: SpawnCall[] = [];
+
 vi.mock("node:child_process", async (importOriginal) => {
   const actual = await importOriginal<typeof import("node:child_process")>();
   return {
     ...actual,
-    spawn: () => {
+    spawn: (command: string, args: string[]) => {
+      spawnCalls.push({ command, args });
       const child = new EventEmitter() as {
         stdout?: Readable;
         stderr?: Readable;
@@ -18,13 +26,31 @@ vi.mock("node:child_process", async (importOriginal) => {
       };
       child.stdout = new Readable({ read() {} });
       child.stderr = new Readable({ read() {} });
-      queueMicrotask(() => child.emit("close", 0));
+
+      const dockerArgs = command === "docker" ? args : [];
+      const shouldFailContainerInspect =
+        dockerArgs[0] === "inspect" &&
+        dockerArgs[1] === "-f" &&
+        dockerArgs[2] === "{{.State.Running}}";
+      const shouldSucceedImageInspect =
+        dockerArgs[0] === "image" && dockerArgs[1] === "inspect";
+
+      const code = shouldFailContainerInspect ? 1 : 0;
+      if (shouldSucceedImageInspect) {
+        queueMicrotask(() => child.emit("close", 0));
+      } else {
+        queueMicrotask(() => child.emit("close", code));
+      }
       return child;
     },
   };
 });
 
 describe("Agent-specific sandbox config", () => {
+  beforeEach(() => {
+    spawnCalls.length = 0;
+  });
+
   it("should use global sandbox config when no agent-specific config exists", async () => {
     const { resolveSandboxContext } = await import("./sandbox.js");
 
@@ -91,6 +117,15 @@ describe("Agent-specific sandbox config", () => {
 
     expect(context).toBeDefined();
     expect(context?.docker.setupCommand).toBe("echo work");
+    expect(
+      spawnCalls.some(
+        (call) =>
+          call.command === "docker" &&
+          call.args[0] === "exec" &&
+          call.args.includes("-lc") &&
+          call.args.includes("echo work"),
+      ),
+    ).toBe(true);
   });
 
   it("should ignore agent-specific docker overrides when scope is shared", async () => {
@@ -131,6 +166,57 @@ describe("Agent-specific sandbox config", () => {
     expect(context).toBeDefined();
     expect(context?.docker.setupCommand).toBe("echo global");
     expect(context?.containerName).toContain("shared");
+    expect(
+      spawnCalls.some(
+        (call) =>
+          call.command === "docker" &&
+          call.args[0] === "exec" &&
+          call.args.includes("-lc") &&
+          call.args.includes("echo global"),
+      ),
+    ).toBe(true);
+  });
+
+  it("should allow agent-specific docker settings beyond setupCommand", async () => {
+    const { resolveSandboxContext } = await import("./sandbox.js");
+
+    const cfg: ClawdbotConfig = {
+      agent: {
+        sandbox: {
+          mode: "all",
+          scope: "agent",
+          docker: {
+            image: "global-image",
+            network: "none",
+          },
+        },
+      },
+      routing: {
+        agents: {
+          work: {
+            workspace: "~/clawd-work",
+            sandbox: {
+              mode: "all",
+              scope: "agent",
+              docker: {
+                image: "work-image",
+                network: "bridge",
+              },
+            },
+          },
+        },
+      },
+    };
+
+    const context = await resolveSandboxContext({
+      config: cfg,
+      sessionKey: "agent:work:main",
+      workspaceDir: "/tmp/test-work",
+    });
+
+    expect(context).toBeDefined();
+    expect(context?.docker.image).toBe("work-image");
+    expect(context?.docker.network).toBe("bridge");
   });
 
   it("should override with agent-specific sandbox mode 'off'", async () => {

src/agents/sandbox.ts

@@ -246,6 +246,9 @@ function defaultSandboxConfig(
     perSession: agentSandbox?.perSession ?? agent?.perSession,
   });
 
+  const globalDocker = agent?.docker;
+  const agentDocker = scope === "shared" ? undefined : agentSandbox?.docker;
+
   return {
     mode: agentSandbox?.mode ?? agent?.mode ?? "off",
     scope,
@@ -256,29 +259,39 @@ function defaultSandboxConfig(
       agent?.workspaceRoot ??
       DEFAULT_SANDBOX_WORKSPACE_ROOT,
     docker: {
-      image: agent?.docker?.image ?? DEFAULT_SANDBOX_IMAGE,
+      image: agentDocker?.image ?? globalDocker?.image ?? DEFAULT_SANDBOX_IMAGE,
       containerPrefix:
-        agent?.docker?.containerPrefix ?? DEFAULT_SANDBOX_CONTAINER_PREFIX,
-      workdir: agent?.docker?.workdir ?? DEFAULT_SANDBOX_WORKDIR,
-      readOnlyRoot: agent?.docker?.readOnlyRoot ?? true,
-      tmpfs: agent?.docker?.tmpfs ?? ["/tmp", "/var/tmp", "/run"],
-      network: agent?.docker?.network ?? "none",
-      user: agent?.docker?.user,
-      capDrop: agent?.docker?.capDrop ?? ["ALL"],
-      env: agent?.docker?.env ?? { LANG: "C.UTF-8" },
-      setupCommand:
-        scope === "shared"
-          ? agent?.docker?.setupCommand
-          : (agentSandbox?.docker?.setupCommand ?? agent?.docker?.setupCommand),
-      pidsLimit: agent?.docker?.pidsLimit,
-      memory: agent?.docker?.memory,
-      memorySwap: agent?.docker?.memorySwap,
-      cpus: agent?.docker?.cpus,
-      ulimits: agent?.docker?.ulimits,
-      seccompProfile: agent?.docker?.seccompProfile,
-      apparmorProfile: agent?.docker?.apparmorProfile,
-      dns: agent?.docker?.dns,
-      extraHosts: agent?.docker?.extraHosts,
+        agentDocker?.containerPrefix ??
+        globalDocker?.containerPrefix ??
+        DEFAULT_SANDBOX_CONTAINER_PREFIX,
+      workdir:
+        agentDocker?.workdir ??
+        globalDocker?.workdir ??
+        DEFAULT_SANDBOX_WORKDIR,
+      readOnlyRoot:
+        agentDocker?.readOnlyRoot ?? globalDocker?.readOnlyRoot ?? true,
+      tmpfs: agentDocker?.tmpfs ??
+        globalDocker?.tmpfs ?? ["/tmp", "/var/tmp", "/run"],
+      network: agentDocker?.network ?? globalDocker?.network ?? "none",
+      user: agentDocker?.user ?? globalDocker?.user,
+      capDrop: agentDocker?.capDrop ?? globalDocker?.capDrop ?? ["ALL"],
+      env: agentDocker?.env
+        ? { ...(globalDocker?.env ?? { LANG: "C.UTF-8" }), ...agentDocker.env }
+        : (globalDocker?.env ?? { LANG: "C.UTF-8" }),
+      setupCommand: agentDocker?.setupCommand ?? globalDocker?.setupCommand,
+      pidsLimit: agentDocker?.pidsLimit ?? globalDocker?.pidsLimit,
+      memory: agentDocker?.memory ?? globalDocker?.memory,
+      memorySwap: agentDocker?.memorySwap ?? globalDocker?.memorySwap,
+      cpus: agentDocker?.cpus ?? globalDocker?.cpus,
+      ulimits: agentDocker?.ulimits
+        ? { ...globalDocker?.ulimits, ...agentDocker.ulimits }
+        : globalDocker?.ulimits,
+      seccompProfile:
+        agentDocker?.seccompProfile ?? globalDocker?.seccompProfile,
+      apparmorProfile:
+        agentDocker?.apparmorProfile ?? globalDocker?.apparmorProfile,
+      dns: agentDocker?.dns ?? globalDocker?.dns,
+      extraHosts: agentDocker?.extraHosts ?? globalDocker?.extraHosts,
     },
     browser: {
       enabled: agent?.browser?.enabled ?? false,