[harshitethic]

Problem

The previous local subprocess runner executed model-selected project test scripts with host-user permissions. A command allowlist and shell=False do not prevent malicious project tests from reading host files.

Implementation

• Route both agent tests and /api/execute through a separate Docker runner; no host-execution fallback if Docker or a preloaded image is absent.
• Run an ephemeral unprivileged container with no network, no capabilities, no privilege escalation, read-only root and repository mounts, bounded CPU/memory/PIDs/tmpfs, no Docker socket, no host HOME or inherited API keys.
• Select images only from administrator-controlled profiles; --pull=never prohibits runtime downloads.
• Stream-bounded output, enforce timeouts and force-remove the exact named container on all exit paths.
• Stop LLM repair loops when isolation is unavailable/timed out rather than claiming tests passed.
• Bind the bundled Compose backend port to 127.0.0.1 and document that the Compose backend has no Docker daemon access and therefore refuses tests by default.
• Add nine security unit tests and GitHub Actions live Docker integration testing using a malicious fixture that attempts to read host-only files, access the network, write to the workspace and inspect credentials.

Verified before PR

59 backend regression tests pass in an isolated environment on macOS. Git diff --check and Python compileall pass. The live Docker integration job must pass before merging.

Limitations

This is local, single-user Docker isolation, not a microVM or a production-ready multi-tenant security proof. Authentication, Git/input resource caps, signed image lifecycle and full threat review remain outstanding. Keep security issue #23 and the CodeQL alert open until separately justified.