Execution and isolation

Choose an execution environment based on the boundaries your task needs. A container controls some local resources; it does not decide your business policy.

Choose the environment

Local is the initializer default. Docker Codex execution in alpha.13 requires a prepared image: Docker init prepares it; existing projects use prepare docker. See execution setup before making a model call.

Separate working files from original files

Original project → managed copy → agent edits → actual checks → write-back
      ↑                                                           │
      └──────────────── explicit accepted changes ────────────────┘

The copied workspace keeps edits out of the source until Workspace.writeBack. Write-back checks for intervening source changes and refuses conflicts. It is not an atomic filesystem transaction. Local mode: "direct" edits the original immediately and has no write-back step.

One run owns one workspace. Multiple sessions can share it, with separate conversations. Use separate runs for independent writable copies.

Bound container resources

import { createDockerExecution } from "@laufwerk/execution";

export const execution = createDockerExecution({
  credentials: "codex-subscription",
  resources: {
    cpus: 2,
    memoryBytes: 4 * 1024 ** 3,
    swapBytes: 0,
    pids: 512,
  },
});

This sets a CPU quota, 4 GiB of RAM, no additional swap and a process ceiling per container. It does not reserve that memory across the host or cap model spending. Choose limits based on the commands you need to run.

Keep authority where the gate is

A workspace read-only mount does not limit the network services an agent can call. A host-side tool can reach files outside the container. Scope credentials and validate tool arguments at the integration boundary. Local and Docker adapters do not supply dynamic network-policy enforcement.

For coding work, use the checked session example to see real verification, error preservation and explicit cleanup before returning success. A reviewer's positive opinion is not a substitute for those checks.

Reference: Execution options · Workspace

← Durability, waiting and recovery · Next: Context and memory →