Spike: Docker shell sandbox for tools

[regnull]

Goal

Spike Docker-based sandboxing for tool execution (especially run_shell), as called out on the roadmap / trust model.

Context

Today run_shell runs unsandboxed as the server user. A Docker (or similar) sandbox is the intended path to confine shell/file tools without changing the actor/tool API.

Acceptance criteria

• Design note (short): container lifecycle, workspace mount, network policy, env/secret handling
• Minimal spike: run a command inside a container from the tool layer (or a prototype beside it)
• Document limits vs full sandbox (what is / is not confined)
• Note follow-ups needed for production (image choice, reuse, timeouts, resource limits)

Labels

help-wanted, enhancement