github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-07 22:01:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(sandbox): centralize dangerous docker override key handling

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-25 02:12:10 +00:00
parent 885452f5c1
commit 91ae82ae19
2 changed files with 43 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
src/agents/sandbox/config.ts
View File

@@ -24,6 +24,26 @@ import type {
SandboxScope,
} from "./types.js";
export const DANGEROUS_SANDBOX_DOCKER_BOOLEAN_KEYS = [
"dangerouslyAllowReservedContainerTargets",
"dangerouslyAllowExternalBindSources",
"dangerouslyAllowContainerNamespaceJoin",
] as const;
type DangerousSandboxDockerBooleanKey = (typeof DANGEROUS_SANDBOX_DOCKER_BOOLEAN_KEYS)[number];
type DangerousSandboxDockerBooleans = Pick<SandboxDockerConfig, DangerousSandboxDockerBooleanKey>;
function resolveDangerousSandboxDockerBooleans(
agentDocker?: Partial<SandboxDockerConfig>,
globalDocker?: Partial<SandboxDockerConfig>,
): DangerousSandboxDockerBooleans {
const resolved = {} as DangerousSandboxDockerBooleans;
for (const key of DANGEROUS_SANDBOX_DOCKER_BOOLEAN_KEYS) {
resolved[key] = agentDocker?.[key] ?? globalDocker?.[key];
}
return resolved;
}
export function resolveSandboxBrowserDockerCreateConfig(params: {
docker: SandboxDockerConfig;
browser: SandboxBrowserConfig;
@@ -95,15 +115,7 @@ export function resolveSandboxDockerConfig(params: {
dns: agentDocker?.dns ?? globalDocker?.dns,
extraHosts: agentDocker?.extraHosts ?? globalDocker?.extraHosts,
binds: binds.length ? binds : undefined,
dangerouslyAllowReservedContainerTargets:
agentDocker?.dangerouslyAllowReservedContainerTargets ??
globalDocker?.dangerouslyAllowReservedContainerTargets,
dangerouslyAllowExternalBindSources:
agentDocker?.dangerouslyAllowExternalBindSources ??
globalDocker?.dangerouslyAllowExternalBindSources,
dangerouslyAllowContainerNamespaceJoin:
agentDocker?.dangerouslyAllowContainerNamespaceJoin ??
globalDocker?.dangerouslyAllowContainerNamespaceJoin,
...resolveDangerousSandboxDockerBooleans(agentDocker, globalDocker),
};
}