Sandbox Backends

源码版本v2026.7.20

Responsibility

The agent needs to execute commands and run code, but arbitrary commands can't be allowed to hit the host directly. Hermes's terminal tool supports 6 execution backends, chosen by safety/isolation/cost tradeoffs: Local (direct on host), Docker (container isolation), SSH (remote machine), Singularity (HPC container), Modal (cloud sandbox, direct or managed), Daytona (cloud dev environment). Container hardening + namespace isolation; dangerous commands are also intercepted via approval callbacks.

Key Files

• terminal_tool header doc:1-15 — lists the six backends local / docker / modal / ssh / singularity / daytona
• Docker host access detection:260-290 — _docker_volume_uses_host_path / _docker_has_host_access (detects whether bind mounts expose host paths)
• Singularity / Modal imports:65-90 — _get_scratch_dir (from environments/singularity)
• environments/singularity.py — Singularity scratch directory and SIF cache
• Modal mode resolution:77-137 — coerce_modal_mode / has_direct_modal_credentials / resolve_modal_backend_state (direct vs managed)
• _DEFAULT_BROWSER_PROVIDER:12 — default provider is local
• subagent approval callbacks:75-103 — _subagent_auto_deny / _subagent_auto_approve (dangerous-command control inside sandboxes)
• tools/daemon_pool.py — resident thread pool for subagents (carries sandbox execution)
• tools/ directory — terminal / close_terminal / read_terminal / tool_backend_helpers / environments/

Data Flow

1. The agent decides to execute a command → tool_call terminal → tools/terminal_tool.py.
2. The backend is chosen by job config (local/docker/modal/ssh/singularity/daytona):
   • local: direct host execution (fastest, default)
   • docker: tools/terminal_tool.py:260 detects whether bind mounts expose host paths and decides permissions accordingly
   • modal: tools/tool_backend_helpers.py:102 resolves direct (user's own Modal credentials) vs managed (gateway-hosted)
   • singularity: tools/environments/singularity.py prepares scratch and SIF
   • ssh / daytona: remote/cloud environments
3. Dangerous commands are intercepted by approval callbacks — the main loop uses interactive approval; subagents default to auto-deny (tools/delegate_tool.py:75), and cron/batch can opt into auto-approve.
4. Command output is backfilled to the main loop; long tasks can be daemonized (tools/daemon_pool.py).

Summary

The sandbox layer is "execution isolation + dangerous-command control": 6 backends cover host through HPC to cloud; Docker detects bind mounts to prevent privilege escalation; Modal distinguishes direct/managed credentials; dangerous commands uniformly go through approval callbacks. Subagents and cron take the non-interactive auto-deny/auto-approve path.