What
Run bash tool commands inside a throwaway Docker container instead of a host subprocess with an allowlist.
Why
On roadmap. The current allowlist is a software-only control. Docker gives OS-level isolation — a compromised or malformed command cannot affect the host.
How
- Spin up
amazon/aws-cli container per command with injected AWS credentials
- Kill container after 30s timeout regardless of exit code
- Drop the subprocess allowlist (Docker boundary replaces it)
Files
What
Run bash tool commands inside a throwaway Docker container instead of a host subprocess with an allowlist.
Why
On roadmap. The current allowlist is a software-only control. Docker gives OS-level isolation — a compromised or malformed command cannot affect the host.
How
amazon/aws-clicontainer per command with injected AWS credentialsFiles
src/tools/bash_tool.py