Sandbox

Sandboxed shell

The optional shell sandbox adds Docker or Podman isolation around command execution:

[sandbox]
runtime = "docker"
image = "debian:bookworm-slim"
network = "none"
memory = "512m"
cpus = "1"
read_only = true

The default runtime is none, so no container is started implicitly. When enabled, OpenPhoenix validates the runtime, image, network mode, resource strings, read-only setting, workspace mount, and generated arguments. Network defaults to none.

Use phoenix sandbox status, phoenix sandbox check, and phoenix sandbox args COMMAND to inspect the effective policy before running work.

Sandboxing is additional depth. Workspace confinement, command denial, approvals, output bounds, and secret redaction still apply. See Security and Tools.