Moltbot Secure Jail

This project provides a secure, sandboxed environment for running moltbot (built from source) and other software using Docker. It isolates the execution from your host system to prevent any accidental damage or unauthorized access.

Prerequisites

• Docker
• Docker Compose

Setup

1. Build and Start the Jail:

   # Ensure wrapper is executable
   chmod +x molt
   
   # Build image (builds moltbot from source) and start background service
   docker compose build
   docker compose up -d

Usage

The ./molt wrapper script is your primary interface. It runs commands inside the secure container.

Running Moltbot

To use the installed moltbot CLI:

# Check version
./molt "moltbot --version"

# Run help
./molt "moltbot --help"

# First Time Setup
If you need to configure the bot interactively:
./molt "moltbot onboard"

# Run any moltbot command
./molt "moltbot <command>"

Interactive Shell

To enter the container shell for interactive session:

./molt
# You are now inside the jail as 'moltuser'
# Type 'exit' to return to host

Working with Files

The workspace/ directory in this project root is mounted into the container at ~/workspace.

• Input: Place scripts or files you want to process in workspace/ on your host.
• Output: Any files written to ~/workspace inside the container will appear in workspace/ on your host.

Example: Running a python script

1. Create a script on your host:

   echo 'print("Hello from inside the jail")' > workspace/hello.py

2. Run it securely:

   ./molt "python3 hello.py"

Networking

The container is configured to allow:

1. Outbound Internet: You can download files, access APIs, etc.
2. Host Access: You can access services running on your host machine (like a local LLM server) using the hostname host.docker.internal.

Example: Connecting to local Ollama/LM Studio If your LLM is running on localhost:11434 on your machine, access it from inside the jail via: http://host.docker.internal:11434

Persistence

Moltbot's internal state (configuration, memory, sessions) is stored in a Docker volume named moltbot_data. This ensures that your bot remembers its configuration even if you restart or rebuild the jail.

Security Architecture

This setup uses a "paranoid" configuration to ensure safety:

• Read-Only Root Filesystem: The container's OS files cannot be modified. Malicious scripts cannot install rootkits or modify system binaries.
• Non-Root User: Processes run as moltuser (UID 1000) with no sudo access.
• Dropped Capabilities: All Linux kernel capabilities (like CAP_NET_ADMIN) are dropped.
• Resource Limits:
  • RAM: Limited to 512MB
  • CPU: Limited to 1 core
  • This prevents runaway processes from crashing your host computer.
• Ephemeral Tmp: /tmp is mounted as a tmpfs (RAM disk). Data written there is lost when the container stops.

Maintenance

• Stop the jail: docker compose stop
• Rebuild (e.g., after Dockerfile changes): docker compose build && docker compose up -d
• View logs: docker compose logs -f