菜单
Hardware-probe + sandboxed execution of vaulted tools. Network-isolated, read-only, resource-capped; never runs untrusted code on the host (#6, Phase 4).
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | container-runner |
| description | Hardware-probe + sandboxed execution of vaulted tools. Network-isolated, read-only, resource-capped; never runs untrusted code on the host (#6, Phase 4). |
| version | 1.0.0 |
| platforms | ["linux","macos"] |
| metadata | {"hermes":{"tags":["sandbox","container","docker","apple-container","isolation","security","execution","mcp"],"related_skills":["security","vetted-vault","skill-ingest","devops"]}} |
The execution guard of the dynamic skill/tool pipeline (Backlog #6, Phase 4). Untrusted (Tier 2/3) code is never run on the host — it runs inside a network-isolated, read-only, resource-capped, timed sandbox, and only from its immutable vault copy (lock-in execution).
probe)container on PATH → apple-container (Apple Silicon native).docker on PATH → docker.local-restricted (no sandbox available; refuses Tier 2/3 — only Tier 1 may run).This host (Intel Mac, Docker present) selects docker.
Probe:
terminal(command="python3 ~/.hermes-coder/scripts/container_runner.py probe --json", workdir="~/.hermes-coder", timeout=15)
Run a vaulted tool sandboxed (lock-in execution):
terminal(command="python3 ~/.hermes-coder/scripts/container_runner.py run --from-vault '<tool>' --cmd '<cmd>' --tier <n> --json", workdir="~/.hermes-coder", timeout=300)
Dry-run (print the sandbox command, execute nothing):
terminal(command="python3 ~/.hermes-coder/scripts/container_runner.py run --from-vault '<tool>' --cmd '<cmd>' --tier <n> --dry-run --json", workdir="~/.hermes-coder", timeout=30)
Flags: --from-vault <name> (lock-in; resolves the approved vault path) or --source <path>
(Tier 1, or Tier 2/3 only with --allow-unvaulted for trusted local testing), --cmd (required),
--image (default nikolaik/python-nodejs:python3.11-nodejs20), --tier (default 3), --timeout
(default 120), --dry-run, --json.
docker run --rm --network none --cpus 1 --memory 512m -v <path>:/work:ro -w /work <image> sh -lc '<cmd>' — no network, read-only mount, CPU/memory caps, timeout.--from-vault), not an arbitrary --source path.local-restricted (no runtime), Tier 2/3 returns blocked — never fall back to host
execution.--json)RunResult: runner, image, cmd, status (success|failed|timeout|blocked|dry-run),
returncode, duration_s, output_tail, error, sandbox_command.
| Code | Meaning |
|---|---|
| 0 | Success / dry-run |
| 1 | Run failed, or blocked (no sandbox for this tier) |
| 2 | Invalid arguments / no runner / vault name not found |
Branch, commit, push, and open PRs with humanized messages, then monitor GitHub Actions CI. Per-project autonomy gating; blocks direct pushes to the default branch and pushes with a dirty tree. Never auto-merges.
Dispatch patterns for Claude Code as the coding engine. Default harness. Implementation dispatches go through dispatch_coder.py (writes the dispatch receipt the commit gate requires).
Testing strategy, TDD enforcement, spec compliance, and regression checks.
Write implementation plans: bite-sized tasks for coding engine dispatch.
Automated fix loop for failed Quality/Reviewer checks. Parses failures, builds escalating prompts, dispatches through the active harness up to 3 times.
Run independent, file-disjoint plan tasks concurrently, each isolated in its own git worktree + branch. Collects per-task results; never auto-merges.