Description
Local Docker Code Sandbox runs each execution request in a new container on a user's desktop or local daemon. The adapter launches the Docker CLI with no network, a read-only root filesystem, dropped Linux capabilities, a non-root user, bounded process and CPU settings, and temporary in-memory storage. Language-specific bootstraps frame inputs and recover a structured return value while preserving ordinary stdout and stderr.
The provider checks that the configured image already exists before starting; it never pulls during a denied-network run. It enforces wall-clock timeout by killing the named container, detects out-of-memory termination, clamps captured output, and removes the container after every spawned run. Optional idempotency caching deduplicates repeated keys for the configured window. The adapter deliberately advertises no Dots API, secret injection, persistent filesystem, or streaming support.
Selling Points
- Developers can execute untrusted code locally without sending source or inputs to a hosted sandbox.
- Deny-by-default container flags isolate the run from the network, host filesystem, root privileges, and extra kernel capabilities.
- Preinstalled-image enforcement prevents a supposedly offline run from fetching dependencies during setup.
- Typed timeout, OOM, daemon-unavailable, image-unavailable, and nonzero-exit results make failures understandable to callers.
- Automatic kill and removal keep cancelled or failed executions from accumulating as stray containers.
User Story
A desktop user runs a JavaScript Script Superpower against local inputs. Dots selects the local Docker executor, confirms the runtime image is present, creates a one-shot networkless container, and returns the script's value and output. If the script exceeds its time budget, the container is killed and removed, and the user receives a timeout outcome rather than a hanging desktop process.
Extension Surface
This feature is configurable. packages/code-execution/src/providers/local-docker/local-container-executor.ts accepts language/image mappings, Docker binary, CPU, PID, temporary-storage, output, user, clock, and idempotency settings. It implements the pluggable executor seam, but the Docker adapter itself does not expose nested runtime plugins.
Capabilities & Limits
- It runs supported shell and programming languages in one fresh container per request.
- It enforces no-network, read-only-root, non-root, dropped-capability, timeout, process, output, and cleanup controls.
- It supports idempotency keys and structured values through language bootstraps.
- Limit: it is for trusted local hosts only, depends on a running Docker daemon and preinstalled images, and offers no network, secrets, Dots API, persistence, or streaming.
Implementation Map
packages/code-execution/src/providers/local-docker/local-container-executor.tspackages/code-execution/src/providers/local-docker/docker-args.tspackages/code-execution/src/providers/local-docker/languages.tspackages/code-execution/src/idempotency.tspackages/code-execution/src/providers/local-docker/outcome.ts