Support restricted shared agent runtimes#2125
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4ea5724d82
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0334d5e42f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 01a16162f2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 335bbe4238
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 172d2c76af
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 774f7cc779
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 018d0c31fe
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 797eb7b. Configure here.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c16de90919
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if routes is None: | ||
| self._proxy.policy = NetworkPolicy( | ||
| ["*"], [], [HOST_ALIAS], allow_non_global=True | ||
| ) | ||
| return |
There was a problem hiding this comment.
When a restricted Docker box is reused after the first rollout, this branch only makes the HTTP proxy permissive; the container routes are still cut because _cut remains true and DockerRuntime.run() can only help commands that honor the injected proxy env. A later task or harness setup that uses raw TCP/SSH or a tool that ignores HTTP_PROXY will fail even though runtime.rollout() has supposedly reopened trusted setup; before this change those restricted Docker runtimes were rejected for reuse. Either restore the routes or keep Docker shared reuse limited to cases where setup is proxy-compatible.
Useful? React with 👍 / 👎.
1 participant
Overview
Enable sequential agents to share a network-restricted runtime while preserving the trusted-setup and restricted-execution boundary.
Details
The base runtime now owns the common policy lifecycle: it grants trusted setup once, records policy activation, and accumulates framework routes used by later rollouts. Docker and Prime reuse that lifecycle while keeping only their backend-specific enforcement code. Docker updates its proxy policy without repeating the one-way network cut, while Prime reapplies its provider policy when a new framework route is introduced.
An exported
shared_runtimecontext manager provisions one box and prepares peer harnesses before restrictions activate. Later sequential agents skip harness installation, retain their own task and trace lifecycle, and refresh the active policy with their current interception and tool routes.Agentic judge uses this abstraction for Docker and Prime solver runtimes and carries the solver task network policy into the generated judge task.
Note
Support restricted shared agent runtimes across rollouts
Runtime.rolloutasync context manager that enables restricted runtimes to be reused across rollouts by killing non-baseline processes, clearing setup caches, and toggling between unrestricted trusted-setup networking and filtered execution-time networking between runs.Runtime._apply_network_policy(routes)as an abstract method; passingNonerestores unrestricted networking, passing routes applies the configured allow/block policy. Implemented in bothDockerRuntimeandPrimeRuntime.AgenticJudgeEnv.runraisesRuntimeErrorif the shared runtime is network-restricted butexecution_preparedis not set, indicating the solver exited before the network policy was activated.network_allowandnetwork_blocksettings viaJudgeTask.from_trace.SandboxErrorif a second rollout is attempted while one is already in progress (exclusive claim required).Macroscope summarized c16de90.
Note
Medium Risk
Changes sandbox isolation (process killing, network policy toggling) and shared-runtime failure modes; mis-timed policy activation now hard-fails instead of silently running unrestricted.
Overview
Restricted runtimes can be shared across sequential agents (e.g. solver then judge in one box) while keeping trusted setup open between runs and applying egress only during each agent phase.
The base
Runtimereplaces single-useprepare_setup()with arollout()context: one restricted rollout at a time, process snapshot/kill on reuse, uv cache reset, and_apply_network_policy(None)to reopen egress before the next trusted setup. Rollouts enter this via a dedicated_runtime_stackinRolloutRun(including abort/teardown).execution_preparedrecords whether the execution cut actually ran; agentic-judge fails fast if the solver exits on a restricted box before that happens, and the judge task inherits the solver’snetwork_allow/network_block.Docker and Prime move enforcement into
_apply_network_policy(trusted mode vs route-aware execution); Docker skips repeating the one-way iptables cut when already applied. The agentic-judge e2e pins the solver to docker +block: ["example.com"]to exercise this path.Reviewed by Cursor Bugbot for commit c16de90. Bugbot is set up for automated code reviews on this repo. Configure here.