[{"data":1,"prerenderedAt":1389},["ShallowReactive",2],{"navigation_docs":3,"-reference-configuration-sandbox":504,"-reference-configuration-sandbox-surround":1384},[4,28,51,187,214,469],{"title":5,"path":6,"stem":7,"children":8},"Get started","\u002Fget-started","1.get-started",[9,12,16,20,24],{"title":10,"path":6,"stem":11},"Overview","1.get-started\u002Findex",{"title":13,"path":14,"stem":15},"Why Kraft","\u002Fget-started\u002Fwhy-kraft","1.get-started\u002F0.why-kraft",{"title":17,"path":18,"stem":19},"Install","\u002Fget-started\u002Finstall","1.get-started\u002F1.install",{"title":21,"path":22,"stem":23},"Your first work item","\u002Fget-started\u002Ffirst-work-item","1.get-started\u002F2.first-work-item",{"title":25,"path":26,"stem":27},"FAQ","\u002Fget-started\u002Ffaq","1.get-started\u002F3.faq",{"title":29,"path":30,"stem":31,"children":32},"Concepts","\u002Fconcepts","2.concepts",[33,35,39,43,47],{"title":10,"path":30,"stem":34},"2.concepts\u002Findex",{"title":36,"path":37,"stem":38},"How a work item runs","\u002Fconcepts\u002Fhow-a-work-item-runs","2.concepts\u002F1.how-a-work-item-runs",{"title":40,"path":41,"stem":42},"Caps and budgets","\u002Fconcepts\u002Fcaps-and-budgets","2.concepts\u002F2.caps-and-budgets",{"title":44,"path":45,"stem":46},"Why a permission gate","\u002Fconcepts\u002Fpermission-gate","2.concepts\u002F3.permission-gate",{"title":48,"path":49,"stem":50},"Vocabulary","\u002Fconcepts\u002Fvocabulary","2.concepts\u002F4.vocabulary",{"title":52,"path":53,"stem":54,"children":55},"Guides","\u002Fguides","3.guides",[56,58,96,113,134,183],{"title":10,"path":53,"stem":57},"3.guides\u002Findex",{"title":59,"path":60,"stem":61,"children":62,"page":95},"Day to day","\u002Fguides\u002Fday-to-day","3.guides\u002F1.day-to-day",[63,67,71,75,79,83,87,91],{"title":64,"path":65,"stem":66},"The setup wizard on first start","\u002Fguides\u002Fday-to-day\u002Ffirst-run","3.guides\u002F1.day-to-day\u002F2.first-run",{"title":68,"path":69,"stem":70},"File a work item","\u002Fguides\u002Fday-to-day\u002Ffile-a-work-item","3.guides\u002F1.day-to-day\u002F3.file-a-work-item",{"title":72,"path":73,"stem":74},"Use Kraft from your agent","\u002Fguides\u002Fday-to-day\u002Fagent-integration","3.guides\u002F1.day-to-day\u002F4.agent-integration",{"title":76,"path":77,"stem":78},"Reviewing a change","\u002Fguides\u002Fday-to-day\u002Freview-a-change","3.guides\u002F1.day-to-day\u002F5.review-a-change",{"title":80,"path":81,"stem":82},"Raise a cap on a stopped item","\u002Fguides\u002Fday-to-day\u002Fraise-a-cap","3.guides\u002F1.day-to-day\u002F6.raise-a-cap",{"title":84,"path":85,"stem":86},"Kraft for VS Code","\u002Fguides\u002Fday-to-day\u002Fvscode","3.guides\u002F1.day-to-day\u002F7.vscode",{"title":88,"path":89,"stem":90},"Kraft on a phone","\u002Fguides\u002Fday-to-day\u002Fkraft-on-a-phone","3.guides\u002F1.day-to-day\u002F8.kraft-on-a-phone",{"title":92,"path":93,"stem":94},"Get notified when an item needs you","\u002Fguides\u002Fday-to-day\u002Fnotifications","3.guides\u002F1.day-to-day\u002F9.notifications",false,{"title":97,"path":98,"stem":99,"children":100,"page":95},"Customize and automate","\u002Fguides\u002Fcustomize","3.guides\u002F2.customize",[101,105,109],{"title":102,"path":103,"stem":104},"Write your own chain","\u002Fguides\u002Fcustomize\u002Fwrite-your-own-chain","3.guides\u002F2.customize\u002F1.write-your-own-chain",{"title":106,"path":107,"stem":108},"Add a security review or a gate reviewer","\u002Fguides\u002Fcustomize\u002Fadd-review-agents","3.guides\u002F2.customize\u002F2.add-review-agents",{"title":110,"path":111,"stem":112},"Schedule or webhook work","\u002Fguides\u002Fcustomize\u002Fschedule-and-webhook-work","3.guides\u002F2.customize\u002F3.schedule-and-webhook-work",{"title":114,"path":115,"stem":116,"children":117,"page":95},"Agents and harnesses","\u002Fguides\u002Fharnesses","3.guides\u002F3.harnesses",[118,122,126,130],{"title":119,"path":120,"stem":121},"Switch a task to another harness","\u002Fguides\u002Fharnesses\u002Fswitch-harness","3.guides\u002F3.harnesses\u002F1.switch-harness",{"title":123,"path":124,"stem":125},"Add or override a harness","\u002Fguides\u002Fharnesses\u002Fadding-a-harness","3.guides\u002F3.harnesses\u002F2.adding-a-harness",{"title":127,"path":128,"stem":129},"Build a worker Kit","\u002Fguides\u002Fharnesses\u002Fworker-kit","3.guides\u002F3.harnesses\u002F3.worker-kit",{"title":131,"path":132,"stem":133},"Give a worker its login","\u002Fguides\u002Fharnesses\u002Fgive-a-worker-its-login","3.guides\u002F3.harnesses\u002F4.give-a-worker-its-login",{"title":135,"path":136,"stem":137,"children":138,"page":95},"Run the server","\u002Fguides\u002Frun","3.guides\u002F4.run",[139,143,147,151,155,159,163,167,171,175,179],{"title":140,"path":141,"stem":142},"Remote access","\u002Fguides\u002Frun\u002Fremote-access","3.guides\u002F4.run\u002F01.remote-access",{"title":144,"path":145,"stem":146},"Put a proxy in front of Kraft","\u002Fguides\u002Frun\u002Fput-a-proxy-in-front-of-kraft","3.guides\u002F4.run\u002F02.put-a-proxy-in-front-of-kraft",{"title":148,"path":149,"stem":150},"Restart Kraft without ending running agents","\u002Fguides\u002Frun\u002Frestart-kraft","3.guides\u002F4.run\u002F03.restart-kraft",{"title":152,"path":153,"stem":154},"Back up and restore the database","\u002Fguides\u002Frun\u002Fback-up-and-restore","3.guides\u002F4.run\u002F04.back-up-and-restore",{"title":156,"path":157,"stem":158},"Logs and disk space","\u002Fguides\u002Frun\u002Flogs-and-disk-space","3.guides\u002F4.run\u002F05.logs-and-disk-space",{"title":160,"path":161,"stem":162},"Run Kraft as a service","\u002Fguides\u002Frun\u002Frun-as-a-service","3.guides\u002F4.run\u002F06.run-as-a-service",{"title":164,"path":165,"stem":166},"Upgrade Kraft","\u002Fguides\u002Frun\u002Fupgrade-kraft","3.guides\u002F4.run\u002F07.upgrade-kraft",{"title":168,"path":169,"stem":170},"Upgrade your configuration","\u002Fguides\u002Frun\u002Fupgrade-your-configuration","3.guides\u002F4.run\u002F08.upgrade-your-configuration",{"title":172,"path":173,"stem":174},"Upgrade from 1.4","\u002Fguides\u002Frun\u002Fupgrade-from-1-4","3.guides\u002F4.run\u002F09.upgrade-from-1-4",{"title":176,"path":177,"stem":178},"Upgrade from 0.x or a release candidate","\u002Fguides\u002Frun\u002Fupgrade-from-0-x-or-a-release-candidate","3.guides\u002F4.run\u002F10.upgrade-from-0-x-or-a-release-candidate",{"title":180,"path":181,"stem":182},"Roll back to 1.4","\u002Fguides\u002Frun\u002Froll-back","3.guides\u002F4.run\u002F11.roll-back",{"title":184,"path":185,"stem":186},"Kraft Lite","\u002Fguides\u002Fkraft-lite","3.guides\u002F5.kraft-lite",{"title":188,"path":189,"stem":190,"children":191},"Troubleshooting","\u002Ftroubleshooting","4.troubleshooting",[192,194,198,202,206,210],{"title":10,"path":189,"stem":193},"4.troubleshooting\u002Findex",{"title":195,"path":196,"stem":197},"Why did my item stop?","\u002Ftroubleshooting\u002Fwhy-did-my-item-stop","4.troubleshooting\u002F1.why-did-my-item-stop",{"title":199,"path":200,"stem":201},"Stop reasons in detail","\u002Ftroubleshooting\u002Fstop-reasons-in-detail","4.troubleshooting\u002F2.stop-reasons-in-detail",{"title":203,"path":204,"stem":205},"Starting and reaching Kraft","\u002Ftroubleshooting\u002Fstarting-and-reaching-kraft","4.troubleshooting\u002F3.starting-and-reaching-kraft",{"title":207,"path":208,"stem":209},"Doctor failures","\u002Ftroubleshooting\u002Fdoctor-failures","4.troubleshooting\u002F4.doctor-failures",{"title":211,"path":212,"stem":213},"Sandbox and Kit stops","\u002Ftroubleshooting\u002Fsandbox-and-kit-stops","4.troubleshooting\u002F5.sandbox-and-kit-stops",{"title":215,"path":216,"stem":217,"children":218},"Reference","\u002Freference","5.reference",[219,221,259,281,285,375,393,419,423,427,461,465],{"title":10,"path":216,"stem":220},"5.reference\u002Findex",{"title":222,"path":223,"stem":224,"children":225},"Web UI","\u002Freference\u002Fweb-ui","5.reference\u002F00.web-ui\u002Findex",[226,227,231,235,239,243,247,251,255],{"title":10,"path":223,"stem":224},{"title":228,"path":229,"stem":230},"Sidebar, search, and keyboard","\u002Freference\u002Fweb-ui\u002Fsidebar-search-and-keyboard","5.reference\u002F00.web-ui\u002F0.sidebar-search-and-keyboard",{"title":232,"path":233,"stem":234},"The board","\u002Freference\u002Fweb-ui\u002Fboard","5.reference\u002F00.web-ui\u002F1.board",{"title":236,"path":237,"stem":238},"An item's page","\u002Freference\u002Fweb-ui\u002Fitem-page","5.reference\u002F00.web-ui\u002F2.item-page",{"title":240,"path":241,"stem":242},"Fix loops and test scopes","\u002Freference\u002Fweb-ui\u002Ffix-loops-and-test-scopes","5.reference\u002F00.web-ui\u002F3.fix-loops-and-test-scopes",{"title":244,"path":245,"stem":246},"Config before an item starts","\u002Freference\u002Fweb-ui\u002Fconfig-before-start","5.reference\u002F00.web-ui\u002F4.config-before-start",{"title":248,"path":249,"stem":250},"The review page","\u002Freference\u002Fweb-ui\u002Freview-page","5.reference\u002F00.web-ui\u002F5.review-page",{"title":252,"path":253,"stem":254},"Templates and Settings","\u002Freference\u002Fweb-ui\u002Ftemplates-and-settings","5.reference\u002F00.web-ui\u002F6.templates-and-settings",{"title":256,"path":257,"stem":258},"Analytics","\u002Freference\u002Fweb-ui\u002Fanalytics","5.reference\u002F00.web-ui\u002F7.analytics",{"title":260,"path":261,"stem":262,"children":263},"CLI","\u002Freference\u002Fcli","5.reference\u002F01.cli\u002Findex",[264,265,269,273,277],{"title":10,"path":261,"stem":262},{"title":266,"path":267,"stem":268},"Item verbs","\u002Freference\u002Fcli\u002Fitem","5.reference\u002F01.cli\u002F2.item",{"title":270,"path":271,"stem":272},"View verbs","\u002Freference\u002Fcli\u002Fview","5.reference\u002F01.cli\u002F3.view",{"title":274,"path":275,"stem":276},"Repo verbs","\u002Freference\u002Fcli\u002Frepo","5.reference\u002F01.cli\u002F4.repo",{"title":278,"path":279,"stem":280},"Admin verbs","\u002Freference\u002Fcli\u002Fadmin","5.reference\u002F01.cli\u002F5.admin",{"title":282,"path":283,"stem":284},"Work item statuses","\u002Freference\u002Fstatuses","5.reference\u002F02.statuses",{"title":286,"path":287,"stem":288,"children":289},"Configuration","\u002Freference\u002Fconfiguration","5.reference\u002F03.configuration\u002Findex",[290,291,309,313,317,321,325,329,333,337,371],{"title":10,"path":287,"stem":288},{"title":292,"path":293,"stem":294,"children":295},"repos.yaml","\u002Freference\u002Fconfiguration\u002Frepos","5.reference\u002F03.configuration\u002F02.repos\u002Findex",[296,297,301,305],{"title":10,"path":293,"stem":294},{"title":298,"path":299,"stem":300},"How connect proposes commands","\u002Freference\u002Fconfiguration\u002Frepos\u002Fconnect-proposals","5.reference\u002F03.configuration\u002F02.repos\u002F1.connect-proposals",{"title":302,"path":303,"stem":304},"detectors.yaml","\u002Freference\u002Fconfiguration\u002Frepos\u002Fdetectors","5.reference\u002F03.configuration\u002F02.repos\u002F2.detectors",{"title":306,"path":307,"stem":308},"Workspaces","\u002Freference\u002Fconfiguration\u002Frepos\u002Fworkspaces","5.reference\u002F03.configuration\u002F02.repos\u002F3.workspaces",{"title":310,"path":311,"stem":312},"policy.yaml","\u002Freference\u002Fconfiguration\u002Fpolicy","5.reference\u002F03.configuration\u002F03.policy",{"title":314,"path":315,"stem":316},"Library and chains","\u002Freference\u002Fconfiguration\u002Flibrary-and-chains","5.reference\u002F03.configuration\u002F04.library-and-chains",{"title":318,"path":319,"stem":320},"harnesses.yaml","\u002Freference\u002Fconfiguration\u002Fharnesses-file","5.reference\u002F03.configuration\u002F05.harnesses-file",{"title":322,"path":323,"stem":324},"access.yaml","\u002Freference\u002Fconfiguration\u002Faccess","5.reference\u002F03.configuration\u002F06.access",{"title":326,"path":327,"stem":328},"intake.yaml","\u002Freference\u002Fconfiguration\u002Fintake","5.reference\u002F03.configuration\u002F07.intake",{"title":330,"path":331,"stem":332},"notify.yaml","\u002Freference\u002Fconfiguration\u002Fnotify","5.reference\u002F03.configuration\u002F08.notify",{"title":334,"path":335,"stem":336},"theme.yaml","\u002Freference\u002Fconfiguration\u002Ftheme","5.reference\u002F03.configuration\u002F09.theme",{"title":338,"path":339,"stem":340,"children":341},"Sandboxed workers","\u002Freference\u002Fconfiguration\u002Fsandbox","5.reference\u002F03.configuration\u002F10.sandbox\u002Findex",[342,343,347,351,355,359,363,367],{"title":10,"path":339,"stem":340},{"title":344,"path":345,"stem":346},"Resource limits","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fresource-limits","5.reference\u002F03.configuration\u002F10.sandbox\u002F1.resource-limits",{"title":348,"path":349,"stem":350},"Callbacks from a sandbox","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fcallbacks","5.reference\u002F03.configuration\u002F10.sandbox\u002F2.callbacks",{"title":352,"path":353,"stem":354},"Network policy","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fnetwork-policy","5.reference\u002F03.configuration\u002F10.sandbox\u002F3.network-policy",{"title":356,"path":357,"stem":358},"Credentials","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fcredentials","5.reference\u002F03.configuration\u002F10.sandbox\u002F4.credentials",{"title":360,"path":361,"stem":362},"Kits","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fkits","5.reference\u002F03.configuration\u002F10.sandbox\u002F5.kits",{"title":364,"path":365,"stem":366},"sandbox.yaml","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fsandbox-yaml","5.reference\u002F03.configuration\u002F10.sandbox\u002F6.sandbox-yaml",{"title":368,"path":369,"stem":370},"Git in a sandbox","\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fgit-in-a-sandbox","5.reference\u002F03.configuration\u002F10.sandbox\u002F7.git-in-a-sandbox",{"title":372,"path":373,"stem":374},"Environment variables","\u002Freference\u002Fconfiguration\u002Fenvironment-variables","5.reference\u002F03.configuration\u002F11.environment-variables",{"title":376,"path":377,"stem":378,"children":379},"Chain file keys","\u002Freference\u002Fchain-nodes","5.reference\u002F04.chain-nodes\u002Findex",[380,381,385,389],{"title":10,"path":377,"stem":378},{"title":382,"path":383,"stem":384},"Subprocess tasks","\u002Freference\u002Fchain-nodes\u002Fsubprocess-tasks","5.reference\u002F04.chain-nodes\u002F2.subprocess-tasks",{"title":386,"path":387,"stem":388},"Fix loop and judge","\u002Freference\u002Fchain-nodes\u002Ffix-loop","5.reference\u002F04.chain-nodes\u002F3.fix-loop",{"title":390,"path":391,"stem":392},"Result file","\u002Freference\u002Fchain-nodes\u002Fresult-file","5.reference\u002F04.chain-nodes\u002F4.result-file",{"title":394,"path":395,"stem":396,"children":397},"Agent harnesses","\u002Freference\u002Fharnesses","5.reference\u002F05.harnesses\u002Findex",[398,399,403,407,411,415],{"title":10,"path":395,"stem":396},{"title":400,"path":401,"stem":402},"Unattended runs","\u002Freference\u002Fharnesses\u002Funattended-runs","5.reference\u002F05.harnesses\u002F2.unattended-runs",{"title":404,"path":405,"stem":406},"Agent profiles","\u002Freference\u002Fharnesses\u002Fagent-profiles","5.reference\u002F05.harnesses\u002F3.agent-profiles",{"title":408,"path":409,"stem":410},"Harness definition files","\u002Freference\u002Fharnesses\u002Fharness-files","5.reference\u002F05.harnesses\u002F4.harness-files",{"title":412,"path":413,"stem":414},"Fallback and escalation","\u002Freference\u002Fharnesses\u002Ffallback-and-escalation","5.reference\u002F05.harnesses\u002F5.fallback-and-escalation",{"title":416,"path":417,"stem":418},"Cost reporting","\u002Freference\u002Fharnesses\u002Fcost-reporting","5.reference\u002F05.harnesses\u002F6.cost-reporting",{"title":420,"path":421,"stem":422},"Permission gate","\u002Freference\u002Fpermissions","5.reference\u002F06.permissions",{"title":424,"path":425,"stem":426},"Inbound triggers","\u002Freference\u002Ftriggers","5.reference\u002F07.triggers",{"title":428,"path":429,"stem":430,"children":431},"HTTP API","\u002Freference\u002Fhttp-api","5.reference\u002F08.http-api\u002Findex",[432,433,437,441,445,449,453,457],{"title":10,"path":429,"stem":430},{"title":434,"path":435,"stem":436},"Filing, reading and changing work items","\u002Freference\u002Fhttp-api\u002Fwork-items","5.reference\u002F08.http-api\u002F2.work-items",{"title":438,"path":439,"stem":440},"Gates, run control, ending and retry","\u002Freference\u002Fhttp-api\u002Fgates-run-control-and-ending","5.reference\u002F08.http-api\u002F3.gates-run-control-and-ending",{"title":442,"path":443,"stem":444},"The work item object","\u002Freference\u002Fhttp-api\u002Fwork-item-object","5.reference\u002F08.http-api\u002F4.work-item-object",{"title":446,"path":447,"stem":448},"Budget, events, diff and documents","\u002Freference\u002Fhttp-api\u002Fbudget-and-events","5.reference\u002F08.http-api\u002F5.budget-and-events",{"title":450,"path":451,"stem":452},"Repos, chains, harnesses and the server","\u002Freference\u002Fhttp-api\u002Frepos-chains-harnesses-and-server","5.reference\u002F08.http-api\u002F6.repos-chains-harnesses-and-server",{"title":454,"path":455,"stem":456},"Drafts","\u002Freference\u002Fhttp-api\u002Fdrafts","5.reference\u002F08.http-api\u002F7.drafts",{"title":458,"path":459,"stem":460},"Ops for each draft area","\u002Freference\u002Fhttp-api\u002Fdraft-ops","5.reference\u002F08.http-api\u002F8.draft-ops",{"title":462,"path":463,"stem":464},"MCP tools","\u002Freference\u002Fmcp-tools","5.reference\u002F09.mcp-tools",{"title":466,"path":467,"stem":468},"Events","\u002Freference\u002Fevents","5.reference\u002F10.events",{"title":470,"path":471,"stem":472,"children":473},"Security and project","\u002Fproject","6.project",[474,476,480,484,488,492,496,500],{"title":10,"path":471,"stem":475},"6.project\u002Findex",{"title":477,"path":478,"stem":479},"Security","\u002Fproject\u002Fsecurity","6.project\u002F1.security",{"title":481,"path":482,"stem":483},"Data and privacy","\u002Fproject\u002Fdata-and-privacy","6.project\u002F2.data-and-privacy",{"title":485,"path":486,"stem":487},"What's new in 2.0","\u002Fproject\u002Fwhats-new","6.project\u002F3.whats-new",{"title":489,"path":490,"stem":491},"Status and support","\u002Fproject\u002Fstatus-and-support","6.project\u002F4.status-and-support",{"title":493,"path":494,"stem":495},"Architecture","\u002Fproject\u002Farchitecture","6.project\u002F5.architecture",{"title":497,"path":498,"stem":499},"Source map","\u002Fproject\u002Fsource-map","6.project\u002F6.source-map",{"title":501,"path":502,"stem":503},"Contributing","\u002Fproject\u002Fcontributing","6.project\u002F7.contributing",{"id":505,"title":338,"body":506,"description":1377,"extension":1378,"links":1379,"meta":1380,"navigation":1381,"path":339,"seo":1382,"stem":340,"__hash__":1383},"docs\u002F5.reference\u002F03.configuration\u002F10.sandbox\u002Findex.md",{"type":507,"value":508,"toc":1366},"minimark",[509,527,683,691,704,939,953,957,972,977,1116,1119,1169,1172,1175,1195,1198,1229,1232,1259,1265,1271,1288,1291,1295,1321,1325,1362],[510,511,512,513,521,522,526],"p",{},"A repository's ",[514,515,517],"a",{"href":516},"\u002Freference\u002Fconfiguration\u002Frepos#sandbox",[518,519,520],"code",{},"sandbox"," setting runs its ",[514,523,525],{"href":524},"\u002Fconcepts\u002Fvocabulary#worker","workers"," in a container. This page lists the keys of that setting and what reaches the container from the host. The other pages in this section cover each part in turn.",[528,529,535],"pre",{"className":530,"code":531,"filename":532,"language":533,"meta":534,"style":534},"language-yaml shiki shiki-themes github-light-high-contrast github-light-high-contrast github-dark-high-contrast","repos:\n  - path: \u002Fhome\u002Fyou\u002Fcode\u002Fmy-service\n    sandbox:\n      kind: docker\n      image: ghcr.io\u002Facme\u002Fagent@sha256:...\n      resources: {cpu: 2, memory: 4g, pids: 512}\n      network:\n        install: {allow: [registry.npmjs.org]}\n        runtime: {allow: [api.github.com]}\n","config\u002Frepos.yaml","yaml","",[518,536,537,550,566,574,585,596,638,646,666],{"__ignoreMap":534},[538,539,542,546],"span",{"class":540,"line":541},"line",1,[538,543,545],{"class":544},"sb7M8","repos",[538,547,549],{"class":548},"s7iLA",":\n",[538,551,553,556,559,562],{"class":540,"line":552},2,[538,554,555],{"class":548},"  - ",[538,557,558],{"class":544},"path",[538,560,561],{"class":548},": ",[538,563,565],{"class":564},"semJd","\u002Fhome\u002Fyou\u002Fcode\u002Fmy-service\n",[538,567,569,572],{"class":540,"line":568},3,[538,570,571],{"class":544},"    sandbox",[538,573,549],{"class":548},[538,575,577,580,582],{"class":540,"line":576},4,[538,578,579],{"class":544},"      kind",[538,581,561],{"class":548},[538,583,584],{"class":564},"docker\n",[538,586,588,591,593],{"class":540,"line":587},5,[538,589,590],{"class":544},"      image",[538,592,561],{"class":548},[538,594,595],{"class":564},"ghcr.io\u002Facme\u002Fagent@sha256:...\n",[538,597,599,602,605,608,610,614,617,620,622,625,627,630,632,635],{"class":540,"line":598},6,[538,600,601],{"class":544},"      resources",[538,603,604],{"class":548},": {",[538,606,607],{"class":544},"cpu",[538,609,561],{"class":548},[538,611,613],{"class":612},"ssYy9","2",[538,615,616],{"class":548},", ",[538,618,619],{"class":544},"memory",[538,621,561],{"class":548},[538,623,624],{"class":564},"4g",[538,626,616],{"class":548},[538,628,629],{"class":544},"pids",[538,631,561],{"class":548},[538,633,634],{"class":612},"512",[538,636,637],{"class":548},"}\n",[538,639,641,644],{"class":540,"line":640},7,[538,642,643],{"class":544},"      network",[538,645,549],{"class":548},[538,647,649,652,654,657,660,663],{"class":540,"line":648},8,[538,650,651],{"class":544},"        install",[538,653,604],{"class":548},[538,655,656],{"class":544},"allow",[538,658,659],{"class":548},": [",[538,661,662],{"class":564},"registry.npmjs.org",[538,664,665],{"class":548},"]}\n",[538,667,669,672,674,676,678,681],{"class":540,"line":668},9,[538,670,671],{"class":544},"        runtime",[538,673,604],{"class":548},[538,675,656],{"class":544},[538,677,659],{"class":548},[538,679,680],{"class":564},"api.github.com",[538,682,665],{"class":548},[684,685,687,688,690],"h2",{"id":686},"the-sandbox-key","The ",[518,689,520],{}," key",[510,692,693,694,697,698,700,701,703],{},"The keys depend on ",[518,695,696],{},"kind",". A key a ",[518,699,696],{}," refuses stops ",[518,702,292],{}," from loading, naming the entry.",[705,706,707,726],"table",{},[708,709,710],"thead",{},[711,712,713,717,720,723],"tr",{},[714,715,716],"th",{},"Key",[714,718,719],{},"Type",[714,721,722],{},"Applies to",[714,724,725],{},"Meaning",[727,728,729,764,789,809,833,855,879,915],"tbody",{},[711,730,731,736,745,748],{},[732,733,734],"td",{},[518,735,696],{},[732,737,738,741,742],{},[518,739,740],{},"docker"," or ",[518,743,744],{},"kit",[732,746,747],{},"Both, required.",[732,749,750,752,753,756,757,759,760,763],{},[518,751,740],{}," runs ",[518,754,755],{},"image"," under the keys below. ",[518,758,744],{}," runs a ",[514,761,762],{"href":361},"Kit"," as the whole sandbox.",[711,765,766,770,773,781],{},[732,767,768],{},[518,769,755],{},[732,771,772],{},"string",[732,774,775,777,778,780],{},[518,776,740],{},", required. ",[518,779,744],{}," refuses it.",[732,782,783,784,788],{},"The image the worker runs in. See ",[514,785,787],{"href":786},"#the-image","The image",".",[711,790,791,796,800,806],{},[732,792,793],{},[518,794,795],{},"runtime",[732,797,798],{},[518,799,740],{},[732,801,802,777,804,780],{},[518,803,744],{},[518,805,740],{},[732,807,808],{},"The runtime that runs the Kit.",[711,810,811,815,818,824],{},[732,812,813],{},[518,814,744],{},[732,816,817],{},"string, pinned by digest",[732,819,820,777,822,780],{},[518,821,744],{},[518,823,740],{},[732,825,826,827,830,831,788],{},"The Kit image, ",[518,828,829],{},"\u003Cname>[:\u003Ctag>]@sha256:\u003C64 hex>",". See ",[514,832,360],{"href":361},[711,834,835,840,843,850],{},[732,836,837],{},[518,838,839],{},"resources",[732,841,842],{},"mapping",[732,844,845,847,848,780],{},[518,846,740],{},", optional. ",[518,849,744],{},[732,851,852,853,788],{},"CPU, memory and process limits. See ",[514,854,344],{"href":345},[711,856,857,862,864,870],{},[732,858,859],{},[518,860,861],{},"network",[732,863,842],{},[732,865,866,847,868,780],{},[518,867,740],{},[518,869,744],{},[732,871,872,873,876,877,788],{},"The hosts a task may reach. Set it or ",[518,874,875],{},"unrestricted_network",": a launch into a sandbox with neither is refused. See ",[514,878,352],{"href":353},[711,880,881,885,888,903],{},[732,882,883],{},[518,884,875],{},[732,886,887],{},"boolean",[732,889,890,892,893,896,897,899,900,902],{},[518,891,740],{},", optional, default ",[518,894,895],{},"false",". ",[518,898,744],{}," refuses it, and so does ",[518,901,861],{}," beside it.",[732,904,905,908,909,911,912,788],{},[518,906,907],{},"true"," lets a launch run with no ",[518,910,861],{},": the worker's network is not restricted and gates are not enforced. See ",[514,913,352],{"href":914},"\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fnetwork-policy#without-a-network-policy",[711,916,917,922,925,934],{},[732,918,919],{},[518,920,921],{},"credentials",[732,923,924],{},"list of mappings",[732,926,927,929,930,896,932,780],{},[518,928,740],{},", optional, and it needs ",[518,931,861],{},[518,933,744],{},[732,935,936,937,788],{},"Secrets the container never holds. See ",[514,938,356],{"href":357},[510,940,941,942,944,945,948,949,952],{},"Set the key in ",[518,943,292],{}," or in ",[518,946,947],{},"policy.sandbox",", not both. It is part of the repository policy layer: once it is set, no chain, node or task can turn it off or change it, limits and network policy included, and ",[518,950,951],{},"sandbox: false"," on a repo cannot turn off one a layer set.",[684,954,956],{"id":955},"what-reaches-the-container","What reaches the container",[510,958,959,960,963,964,967,968,971],{},"A sandboxed task runs ",[518,961,962],{},"docker run --init"," (or ",[518,965,966],{},"podman run",") with every capability dropped, within its ",[514,969,970],{"href":345},"resource limits",". It runs as a user that leaves what it writes yours, on rootless Docker and Podman too.",[510,973,974,976],{},[514,975,364],{"href":365}," says which CLI runs it, and what happens on an SELinux-enforcing host. Only what is listed here reaches the container:",[705,978,979,989],{},[708,980,981],{},[711,982,983,986],{},[714,984,985],{},"What",[714,987,988],{},"How it reaches the container",[727,990,991,1002,1017,1037,1048,1063,1093,1105],{},[711,992,993,999],{},[732,994,687,995],{},[514,996,998],{"href":997},"\u002Fconcepts\u002Fvocabulary#worktree","worktree",[732,1000,1001],{},"Mounted read-write at its real path.",[711,1003,1004,1007],{},[732,1005,1006],{},"The repository's refs",[732,1008,1009,1010,830,1013,788],{},"A private copy per worktree, under ",[518,1011,1012],{},"$KRAFT_HOME\u002Frun\u002Fsandbox-git\u002F",[514,1014,1016],{"href":1015},"\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fgit-in-a-sandbox#repository-refs","Repository refs",[711,1018,1019,1022],{},[732,1020,1021],{},"Objects and LFS content",[732,1023,1024,1025,1028,1029,1032,1033,1036],{},"Your repository's ",[518,1026,1027],{},"objects\u002F"," and ",[518,1030,1031],{},"lfs\u002F",", read-write: they are data a commit writes. ",[518,1034,1035],{},"objects\u002Finfo"," (where alternates are named) and alternates themselves are read-only.",[711,1038,1039,1042],{},[732,1040,1041],{},"Workspace members",[732,1043,1044,1045,788],{},"Each member's own repository, the same way as the root's: a private copy of its refs, from which Kraft moves the item's branch in that repository, and its objects. See ",[514,1046,1041],{"href":1047},"\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fgit-in-a-sandbox#workspace-members",[711,1049,1050,1056],{},[732,1051,1052,1055],{},[518,1053,1054],{},"HOME",", results, git identity",[732,1057,1058,1059,788],{},"See ",[514,1060,1062],{"href":1061},"#home-results-and-git-identity","Home, results and git identity",[711,1064,1065,1067],{},[732,1066,356],{},[732,1068,1069,616,1072,1075,1076,1028,1079,1082,1083,1085,1086,830,1089,788],{},[518,1070,1071],{},"CLAUDE_CODE_OAUTH_TOKEN",[518,1073,1074],{},"ANTHROPIC_API_KEY",", and every name in ",[518,1077,1078],{},"env_passthrough",[518,1080,1081],{},"env",", forwarded by name, so their values never appear on the ",[518,1084,740],{}," command line or in ",[518,1087,1088],{},"ps",[514,1090,1092],{"href":1091},"#forwarded-credentials","Forwarded credentials",[711,1094,1095,1098],{},[732,1096,1097],{},"Proxy and CA",[732,1099,1100,1101,1104],{},"The server's proxy variables and an extra CA. ",[514,1102,364],{"href":1103},"\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fsandbox-yaml#proxy"," says which, and how.",[711,1106,1107,1110],{},[732,1108,1109],{},"Tool policy",[732,1111,1112,1113,788],{},"Enforced inside the container or refused. See ",[514,1114,1109],{"href":1115},"#tool-policy",[684,1117,1062],{"id":1118},"home-results-and-git-identity",[1120,1121,1122,1135,1150],"ul",{},[1123,1124,1125,1130,1131,1134],"li",{},[1126,1127,1128,788],"strong",{},[518,1129,1054],{}," ",[518,1132,1133],{},"$KRAFT_HOME\u002Frun\u002Fsandbox-home\u002F\u003Cwork item>",", read-write and kept across sessions, so an agent CLI keeps its state and can resume a paused session. A CLI config directory Kraft owns (Cursor's) lives there too, one per item.",[1123,1136,1137,1140,1141,1144,1145,1149],{},[1126,1138,1139],{},"Results."," From ",[518,1142,1143],{},"$KRAFT_HOME\u002Frun\u002Fresults",", only this ",[514,1146,1148],{"href":1147},"\u002Fconcepts\u002Fvocabulary#work-item","work item","'s own files: its sessions' result files, review packages and long instructions, read-only, and the session's own result file, read-write. Nothing of another item's is mounted.",[1123,1151,1152,1130,1155,1028,1158,1161,1162,1028,1165,1168],{},[1126,1153,1154],{},"Git identity.",[518,1156,1157],{},"GIT_AUTHOR_*",[518,1159,1160],{},"GIT_COMMITTER_*"," from the server's environment, else your ",[518,1163,1164],{},"user.name",[518,1166,1167],{},"user.email"," for the repository. Repository hooks never run in the container, as they never run on a worker's commits outside one.",[510,1170,1171],{},"Abandoning or archiving an item removes its ref store and sandbox home.",[684,1173,1092],{"id":1174},"forwarded-credentials",[510,1176,1177,1178,1181,1182,1186,1187,1191,1192,1194],{},"The container's own environment still holds the values, so ",[518,1179,1180],{},"docker inspect"," shows them to anyone who can reach the container runtime. A name listed under ",[514,1183,1184],{"href":357},[518,1185,921],{}," is the exception: the container holds only its ",[514,1188,1190],{"href":1189},"\u002Fconcepts\u002Fvocabulary#sentinel","sentinel",", and ",[518,1193,1180],{}," shows that. Logins kept in your home directory or the OS keychain do not reach a sandbox.",[684,1196,1109],{"id":1197},"tool-policy",[1120,1199,1200,1203,1213],{},[1123,1201,1202],{},"Amp's and OpenCode's rules travel with the launch, and Amp's rules file is mounted read-only.",[1123,1204,1205,1206,1209,1210,788],{},"Which harness's tool policy is accepted or refused, with and without a ",[514,1207,1208],{"href":353},"network policy",", is told in ",[514,1211,348],{"href":1212},"\u002Freference\u002Fconfiguration\u002Fsandbox\u002Fcallbacks#permission-checks-under-network",[1123,1214,1215,1216,1219,1220,1224,1225,1228],{},"Codex runs with ",[518,1217,1218],{},"sandbox_mode=danger-full-access"," unless a task or ",[514,1221,1223],{"href":1222},"\u002Fconcepts\u002Fvocabulary#harness-profile","harness profile"," sets a mode other than ",[518,1226,1227],{},"workspace-write",", because its own sandbox cannot start inside Docker.",[684,1230,787],{"id":1231},"the-image",[510,1233,1234,1235,1239,1240,1243,1244,616,1247,1250,1251,1254,1255,1258],{},"It must hold the agent CLI (and, for a fallback, every ",[514,1236,1238],{"href":1237},"\u002Fconcepts\u002Fvocabulary#harness","harness"," it may fall back to) on its ",[518,1241,1242],{},"PATH",", plus ",[518,1245,1246],{},"git",[518,1248,1249],{},"sh"," and CA certificates, and ",[518,1252,1253],{},"curl"," under a network policy (the ",[518,1256,1257],{},"kraft"," shim uses it).",[510,1260,1261,1262,1264],{},"Before a task's first launch in an image, Kraft asks the image, through its own entrypoint and with the repository's ",[518,1263,1081],{},", whether the command is there. An image that answers no stops the item as a configuration error before anything runs.",[510,1266,1267,1270],{},[518,1268,1269],{},"kraft admin doctor"," checks:",[1120,1272,1273,1276,1282,1285],{},[1123,1274,1275],{},"that the runtime answers",[1123,1277,1278,1279,1281],{},"that SELinux has an answer in ",[518,1280,364],{}," where it enforces",[1123,1283,1284],{},"that an extra CA can be read",[1123,1286,1287],{},"that the image is pulled",[510,1289,1290],{},"Pull it before filing work, or the first launch pulls it inside the task's time cap.",[684,1292,1294],{"id":1293},"limits","Limits",[1120,1296,1297,1307,1310,1318],{},[1123,1298,1299,1300,1303,1304,1306],{},"With ",[518,1301,1302],{},"unrestricted_network: true"," and no ",[514,1305,1208],{"href":353},", the container has the default bridge network: open egress, and on a cloud VM the metadata address is reachable.",[1123,1308,1309],{},"A worker can still delete objects from your repository, which breaks it loudly but cannot put content on another branch.",[1123,1311,1312,1313,1315,1316,788],{},"Without a network policy a worker has no channel to Kraft, and its network is not restricted, so Kraft refuses the launch unless ",[518,1314,1302],{}," is set: see ",[514,1317,348],{"href":349},[1123,1319,1320],{},"Only repositories keeping refs in git's default files storage are supported; a reftable repository stops the item.",[684,1322,1324],{"id":1323},"in-this-section","In this section",[1120,1326,1327,1332,1337,1342,1347,1352,1357],{},[1123,1328,1329,1331],{},[514,1330,344],{"href":345},": the CPU, memory and process limits of a container, and what happens when a memory limit kills a process.",[1123,1333,1334,1336],{},[514,1335,348],{"href":349},": how a sandboxed worker reaches Kraft, and what is refused without a network policy.",[1123,1338,1339,1341],{},[514,1340,352],{"href":353},": which hosts a sandboxed task may reach.",[1123,1343,1344,1346],{},[514,1345,356],{"href":357},": secrets the container never holds.",[1123,1348,1349,1351],{},[514,1350,360],{"href":361},": a sandbox that an image's own descriptor declares.",[1123,1353,1354,1356],{},[514,1355,364],{"href":365},": the host-wide file for the container CLI, SELinux, an extra CA and the proxy.",[1123,1358,1359,1361],{},[514,1360,368],{"href":369},": the copy of the repository's refs, a workspace's members, and what Kraft's own git does in the worktree.",[1363,1364,1365],"style",{},"html pre.shiki code .sb7M8, html code.shiki .sb7M8{--shiki-light:#024C1A;--shiki-default:#024C1A;--shiki-dark:#72F088}html pre.shiki code .s7iLA, html code.shiki .s7iLA{--shiki-light:#0E1116;--shiki-default:#0E1116;--shiki-dark:#F0F3F6}html pre.shiki code .semJd, html code.shiki .semJd{--shiki-light:#032563;--shiki-default:#032563;--shiki-dark:#ADDCFF}html pre.shiki code .ssYy9, html code.shiki .ssYy9{--shiki-light:#023B95;--shiki-default:#023B95;--shiki-dark:#91CBFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":534,"searchDepth":552,"depth":552,"links":1367},[1368,1370,1371,1372,1373,1374,1375,1376],{"id":686,"depth":552,"text":1369},"The sandbox key",{"id":955,"depth":552,"text":956},{"id":1118,"depth":552,"text":1062},{"id":1174,"depth":552,"text":1092},{"id":1197,"depth":552,"text":1109},{"id":1231,"depth":552,"text":787},{"id":1293,"depth":552,"text":1294},{"id":1323,"depth":552,"text":1324},"The sandbox key of repos.yaml, what reaches a sandboxed worker's container, and how its home, credentials, image and tool policy are handled.","md",null,{},{"title":10},{"title":338,"description":1377},"w8wuAhpmpOVg0ZqRA_J7tB63FZ0gSpkJ67Uu-qNbsHM",[1385,1387],{"title":334,"path":335,"stem":336,"description":1386,"children":-1},"Every field in theme.yaml: the interface's colors, density, diff and board settings, and how a legacy palette key is read.",{"title":344,"path":345,"stem":346,"description":1388,"children":-1},"The CPU, memory and process limits a sandbox sets on its container, when a limit cannot be enforced, and what Kraft does when a memory limit kills a process.",1791801262096]