diff options
Diffstat (limited to 'internal/cli')
| -rw-r--r-- | internal/cli/run.go | 4 | ||||
| -rw-r--r-- | internal/cli/serve.go | 11 |
2 files changed, 14 insertions, 1 deletions
diff --git a/internal/cli/run.go b/internal/cli/run.go index a5a6419..497ba6b 100644 --- a/internal/cli/run.go +++ b/internal/cli/run.go @@ -128,6 +128,10 @@ func runTasks(file string, parallel int, dryRun bool) error { Logger: logger, LogDir: cfg.LogDir, DefaultModel: pc.DefaultModel, + // See internal/cli/serve.go: native cloud providers get + // sandbox.DockerSandbox rather than the weaker HostSandbox. + SandboxKind: "docker", + SandboxImage: cfg.SandboxImage, } } diff --git a/internal/cli/serve.go b/internal/cli/serve.go index d9bf609..8b6cc6a 100644 --- a/internal/cli/serve.go +++ b/internal/cli/serve.go @@ -147,6 +147,10 @@ func serve(addr, basePath string) error { LogDir: cfg.LogDir, DefaultTemperature: cfg.LocalModel.DefaultTemperature, DefaultModel: cfg.LocalModel.Model, + // SandboxKind left at its zero value ("host" / sandbox.HostSandbox). + // Local models are presumed more trusted/lower-stakes than paid + // cloud providers, so they stay on the weaker but zero-overhead + // host sandbox — see NativeRunner.SandboxKind doc comment. } logger.Info("local runner registered", "endpoint", cfg.LocalModel.Endpoint, "model", cfg.LocalModel.Model) } @@ -161,8 +165,13 @@ func serve(addr, basePath string) error { Logger: logger, LogDir: cfg.LogDir, DefaultModel: pc.DefaultModel, + // Native cloud providers get real container isolation + // (sandbox.DockerSandbox) rather than HostSandbox's host-side + // path-prefix confinement. + SandboxKind: "docker", + SandboxImage: cfg.SandboxImage, } - logger.Info("anthropic runner registered", "default_model", pc.DefaultModel) + logger.Info("anthropic runner registered", "default_model", pc.DefaultModel, "sandbox", "docker") } pool := executor.NewPool(cfg.MaxConcurrent, runners, store, logger) |