Module sandbox 

Sandbox command construction for isolated tool execution.

Builds the argv needed to run a shell command inside a container or a fresh set of Linux namespaces (unshare(1)), plus container-engine detection. This module is pure argv assembly + PATH probing - it never spawns a process itself. The caller (the daemon’s SandboxManager) owns the actual tokio::process::Command spawn and container lifecycle, so everything here is deterministic and unit-testable without any runtime installed.

The container engine is just a binary name ("docker", "podman", "nerdctl", "finch", …): Leviath isn’t prescriptive about which one you run, only that it speaks the common run/exec/rm verbs. Auto-detection (detect_container_engine) prefers Docker then Podman, but a blueprint can name any binary.

Keeping the sole namespace-vs-container / Linux-vs-not knowledge here (behind namespace_supported and a cfg!) means callers stay platform-agnostic, consistent with the rest of this crate.

Structs

ContainerRunSpec

Parameters for creating a long-lived, exec-able container.

Constants

KNOWN_ENGINES

The container engines auto-detection probes for, in preference order. A blueprint may name any other Docker-CLI-compatible binary explicitly.

Functions

binary_on_path

Whether bin resolves to a regular file on any PATH entry.

container_exec_argv

argv to run one shell command inside a running container.

container_rm_argv

argv to force-remove a container (best-effort teardown).

container_run_argv

argv to start a detached, auto-removed container that idles (sleep infinity) so shell calls can exec into it repeatedly (warm container).

detect_container_engine

Detect an available container engine on PATH, returning its binary name. Prefers Docker, then Podman (see KNOWN_ENGINES).

detect_container_engine_with

Testable core of detect_container_engine: exists reports whether a binary name is available. First match in KNOWN_ENGINES wins.

mount_allowed

Whether path is safe to bind-mount into an agent container.

namespace_argv

argv to run one shell command under fresh Linux namespaces via unshare(1).

namespace_supported

Whether Linux-namespace sandboxing (unshare) is possible on this host. Only Linux ships the namespaces + unshare(1) this relies on.