Sandbox Untrusted Code Execution

PROJECT CONTEXT:
My agent executes model-written code and shell commands on the host - one hallucinated command from disaster. The platforms that run agents at scale execute everything inside sandboxes with explicit resource, filesystem, and network policies.

GOAL:
Move agent code/command execution into a sandbox: container-based isolation, scoped workspace mounts, resource and network limits, and a recovery story.

REQUIREMENTS:
- All run_command/code execution inside an isolated environment (container or equivalent)
- Workspace mounting: the project directory available, everything else invisible
- Resource limits: CPU, memory, processes, disk, and execution time
- Network policy: default-deny with an explicit allowlist where needed
- Ergonomics preserved: results, exit codes, and files behave as the agent expects

CONSTRAINTS:
- The sandbox boundary is the host's protection - convenience never punches holes in it silently
- Sandbox escapes and limit hits must be logged as security events

DEFINITION OF DONE:
- A destructive command (rm -rf /) executes harmlessly inside the sandbox
- The sandbox cannot read host files outside the mounted workspace
- A fork bomb or memory hog is killed by limits, and the agent is told why
- Network calls to non-allowlisted destinations fail with a policy error

COMMON FAILURES TO AVOID:
- Running as root with the host filesystem mounted - a sandbox in name only
- No resource limits, so the host dies from a while-true the model wrote
- Unrestricted network, letting exfiltration or cryptomining ride along
- Sandbox friction so high that developers quietly disable it