pti/wraptool
Watch
1
0
Fork
You've already forked wraptool
 0
Code Issues 2 Pull requests Projects Releases 14 Packages 5 Wiki Activity Actions

docs: document the Docker Sandboxes runtime on the comparison page #119

Merged
pti merged 1 commit from docs/comparison-sbx-runtime into main 2026-11-02 13:21:50 +01:00
Conversation 0 Commits 1 Files changed 5 +115 -17
pti commented 2026-11-02 13:17:53 +01:00
Owner

The comparison page argued that isolation and mediation compose, then left the composition hypothetical. It now has a section on wraptool up --runtime=sbx: what the runtime takes from Docker Sandboxes and what it declines, and why. Explicit opt-in, the pool harness through the built-in shell agent instead of a vendor agent kind, no kits, Docker's credential proxy kept out of the loop with the MCP gateway and SSH agent forwarding refused and foreign global secrets warned about, an operator-chosen template, one sandbox per worktree, the sbx approval queue as a second independent approval surface, and the host prerequisites. Names SBX_NO_TELEMETRY as ruling 3 of the design note asked. Also names sbx in the three runtime lists that had fallen behind: the cli-reference up synopsis plus --sandbox-template, the getting-started runtime list, and the installation dependency table. Changelog line under Unreleased. No quarto in the devcontainer, so the render is unverified here and the pages CI job will show it. 🤖 Generated with Claude Code

The comparison page argued that isolation and mediation compose, then left the composition hypothetical. It now has a section on wraptool up --runtime=sbx: what the runtime takes from Docker Sandboxes and what it declines, and why. Explicit opt-in, the pool harness through the built-in shell agent instead of a vendor agent kind, no kits, Docker's credential proxy kept out of the loop with the MCP gateway and SSH agent forwarding refused and foreign global secrets warned about, an operator-chosen template, one sandbox per worktree, the sbx approval queue as a second independent approval surface, and the host prerequisites. Names SBX_NO_TELEMETRY as ruling 3 of the design note asked. Also names sbx in the three runtime lists that had fallen behind: the cli-reference up synopsis plus --sandbox-template, the getting-started runtime list, and the installation dependency table. Changelog line under Unreleased. No quarto in the devcontainer, so the render is unverified here and the pages CI job will show it. 🤖 Generated with Claude Code
docs(comparison): document the Docker Sandboxes runtime as the composition made concrete
All checks were successful
Lint / lint (pull_request) Successful in 1m5s
Details
Lint / sonarqube (pull_request) Has been skipped
Details
642bdfa123 
The comparison page argued that isolation and mediation compose, then
left the composition hypothetical. wraptool has shipped it since 0.9.0:
`wraptool up --runtime=sbx` runs the harness inside a Docker Sandbox
while wraptool mediates privileged operations from the host.

Add a section stating what the runtime takes from the product and what
it declines, and why: explicit opt-in, the pool harness through the
built-in shell agent instead of a vendor agent kind, no kits, Docker's
credential proxy kept out of the loop (MCP gateway and SSH agent
forwarding refused, foreign global secrets warned about), an
operator-chosen template, one sandbox per worktree, and the host
prerequisites. Name SBX_NO_TELEMETRY here, as ruling 3 of the design
note asked of the runtime documentation.

Also name `sbx` in the three places that list the runtimes and had
fallen behind: the cli-reference `up` synopsis (plus
`--sandbox-template`), the getting-started runtime list, and the
installation dependency table.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
pti merged commit 42803abca7 into main 2026-11-02 13:21:50 +01:00
pti deleted branch docs/comparison-sbx-runtime 2026-11-02 13:21:50 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
pti/wraptool!119
No description provided.