Sandboxing

from harnest.extensions.docker import docker
from harnest.sandbox import SandboxNetworkPolicy


calculations = docker.sandbox(
    image="python:3.12-slim@sha256:<approved-digest>",
    network_policy=SandboxNetworkPolicy.none(),
    timeout_seconds=120,
    max_output_bytes=1_048_576,
)

from harnest.agent import Agent
from harnest.model import LiteLLMModel

root_agent = Agent(
    name="support",
    model=LiteLLMModel.from_openai_environment(),
    sandboxes=["calculations"],
)

import json

from harnest import context
from harnest.sandbox import SandboxStatus
from harnest.agent import tool


@tool
async def total_values(values: list[int]) -> dict:
    """Add up to 1,000 whole numbers and return their total."""
    if len(values) > 1_000 or any(type(value) is not int for value in values):
        return {"error": "Provide at most 1,000 whole numbers."}

    # Serialize data as a Python string literal, never as executable code.
    payload = json.dumps(values)
    code = f"import json\nvalues = json.loads({payload!r})\nprint(sum(values))"
    result = await context.sandboxes["calculations"].aexecute(code)
    if result.status != SandboxStatus.SUCCEEDED:
        return {"error": "The calculation failed. Try a smaller input."}
    return {"total": int(result.stdout.strip())}

from harnest.extensions.docker import docker, DockerScope
from harnest.sandbox import SandboxBudget, SandboxNetworkPolicy

calculations = docker.sandbox(
    image="python:3.12-slim@sha256:<approved-digest>",
    scope=DockerScope.EXECUTION,
    budget=SandboxBudget(
        cpu=1.0,
        memory_bytes=512 * 1024 * 1024,
        pids=64,
        scratch_bytes=64 * 1024 * 1024,
    ),
    network_policy=SandboxNetworkPolicy.none(),
    timeout_seconds=300,
    max_output_bytes=1_048_576,
)

from harnest.sandbox import Sandbox
from company_sandbox import CompanyBackend

research = Sandbox.provider(
    lambda: CompanyBackend(pool="agents"),
    name="company-sandbox",
    timeout_seconds=120,
    metadata={"region": "eu-west", "labels": {"workload": "research"}},
)

from harnest.sandbox import (
    Sandbox,
    SandboxNetworkMode,
    SandboxNetworkPolicy,
    SandboxProviderCapabilities,
)
from company_sandbox import CompanyBackend


class PolicyBackend(CompanyBackend):
    sandbox_capabilities = SandboxProviderCapabilities(
        network_modes=frozenset({
            SandboxNetworkMode.NONE,
            SandboxNetworkMode.ALLOWLIST,
        }),
        host_allowlist=True,
        port_allowlist=True,
        private_network_blocking=True,
    )


research = Sandbox.provider(
    PolicyBackend,
    name="company-sandbox",
    network_policy=SandboxNetworkPolicy.allowlist(
        "api.example.com",
        ports=(443,),
        block_private_networks=True,
    ),
)