agent-sandbox — pluggable execution sandbox for tool calls.
Provides a provider abstraction so the same agent runtime can run under
Docker, Kata, or Cube sandboxes. The Docker provider talks to
the Docker Engine API through bollard — no docker CLI is required
inside the container; it connects to the daemon over the mounted host socket
(or whatever DOCKER_HOST points at). The Kata and Cube providers
remain thin CLI runners that shell out to the platform binary
(docker --runtime=kata, cube, …). The [Sandbox] trait is the stable
seam the rest of the platform depends on
(see docs/adr/0003-sandbox-providers.md).
The deep codex integration (ADR-0005 §Decision) — running tool commands
through codex's real SandboxManager — lives in the aria-agent-cloud
runtime crate (publish = false) as codex_sandbox::CodexSandbox. Keeping
it out of this published crate avoids dragging codex's unpublished git
dependencies into the crates.io manifest (crates.io requires every
dependency to resolve from the registry). SandboxProvider::Codex remains a
valid selector so config stays forward-compatible; from_provider returns
[SandboxError::NotConfigured] for it and the cloud runtime injects the real
backend via agent_core::Agent::with_sandbox.