Question: what interface would a third-party code executor need to implement?

[incyashraj]

Multi-agent systems generate more untrusted code than single-agent ones, since one agent's output becomes another's input. Trying to understand AG2's execution boundary before building against it.

I can see the local and Docker executor options. What I want to understand is the intended contract: if someone wanted to plug in an alternative code executor, what interface does it need to satisfy, and what guarantees are executors expected to provide?

Context for why I'm asking: I've been building a runtime aimed at exactly this boundary. One file runs natively on Mac, Windows and Linux, with zero access to the host until a capability is explicitly granted, and denials come back structured so the calling agent can reason about the wall rather than just catching an error. It has an MCP server, so it can already be driven by an agent. Repo:

If there's a documented executor interface, point me at it and I'll build the integration and report back on what AG2 would need that isn't there yet.