Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/xerrors/yuxi/sandbox-architecturegit clone --depth 1 https://github.com/xerrors/YuxiWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.02684 |
| Opus 5 | $0.00000 | $0.01342 |
| Sonnet 5 | $0.00000 | $0.00537 |
| Haiku 4.5 | $0.00000 | $0.00268 |
Grade C, and why
sandbox-architecture scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
KUBECONFIG_PATH: /root/.kube/config Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl --fail http://localhost:8002/health How it starts
The opening of the file, as written. The whole thing — 179 lines — stays where its author put it; the contents beside it link to each section on GitHub.
配置沙盒与 provisioner
Yuxi 通过 sandbox-provisioner 为 Agent 提供文件和命令执行环境。本页面向部署和运维人员，说明如何选择 Docker 或 Kubernetes、配置连接参数以及排查沙盒问题。
沙盒的身份、文件 Owner、虚拟路径和恢复语义见沙盒与文件系统机制。
先明确两层配置
应用层负责“API/worker 怎样找到 provisioner”；provisioner 层负责“用什么方式创建实际沙盒”。两层变量名称不同：
| 配置目标 | Compose/.env 入口 | provisioner 容器变量 |
|---|---|---|
| 应用连接 provisioner | SANDBOX_PROVIDER、SANDBOX_PROVISIONER_URL、SANDBOX_PROVISIONER_TOKEN |
同名变量 |
| 选择承载后端 | SANDBOX_PROVISIONER_BACKEND |
PROVISIONER_BACKEND |
| provisioner 对外代理地址 | SANDBOX_PROVISIONER_URL |
PROVISIONER_PUBLIC_URL |
| Docker/Kubernetes 参数 | SANDBOX_* 或对应宿主变量 |
DOCKER_*、K8S_*、NODE_HOST、PVC 变量 |
Compose 会把宿主变量映射为右侧的 provisioner 变量。直接运行 provisioner 时，设置右侧变量即可。
选择承载后端
应用层当前固定使用：
SANDBOX_PROVIDER=provisioner
provisioner 支持：
PROVISIONER_BACKEND |
用途 | 隔离能力 |
|---|---|---|
docker |
开发和单机部署的默认后端 | 为每个运行时创建独立容器和网络 |
kubernetes |
将沙盒 Pod 交给目标集群承载 | 取决于集群、Pod 和网络安全策略 |
memory |
unit 测试和占位测试 | 不创建真实隔离环境 |
生产环境不要使用 memory。切换后端只改变动态沙盒的承载位置，API 和 worker 仍通过同一个认证的 provisioner 代理访问。
应用层配置
API 和 worker 至少需要：
SANDBOX_PROVIDER=provisioner
SANDBOX_PROVISIONER_URL=http://sandbox-provisioner:8002
SANDBOX_PROVISIONER_TOKEN=<random-value-at-least-32-characters>
SANDBOX_VIRTUAL_PATH_PREFIX=/home/gem/user-data
SANDBOX_EXEC_TIMEOUT_SECONDS=180
SANDBOX_MAX_OUTPUT_BYTES=262144
SANDBOX_PROVISIONER_TOKEN 必须至少 32 个字符，并且只提供给 API、worker 和 provisioner。它不能进入 sandbox.env、用户 Agent 环境、Skill 或模型上下文。
SANDBOX_VIRTUAL_PATH_PREFIX 是 Agent 使用的虚拟用户数据根。API/worker 不直接取得动态容器地址，只使用 provisioner 返回的认证代理 URL。
provisioner 通用配置
Compose 中的 sandbox-provisioner 使用以下变量：
| 变量 | 作用 | Compose 默认值 |
|---|---|---|
PROVISIONER_BACKEND |
docker、kubernetes 或测试用 memory |
docker |
PROVISIONER_PUBLIC_URL |
返回给 API/worker 的代理基地址 | http://sandbox-provisioner:8002 |
SANDBOX_IMAGE |
动态沙盒镜像 | Compose 文件中的镜像 |
SANDBOX_CONTAINER_PORT |
沙盒内部 HTTP 端口 | 8080 |
SANDBOX_HEALTH_TIMEOUT_SECONDS |
创建后的健康检查上限 | 300 |
SANDBOX_IDLE_TIMEOUT_SECONDS |
空闲实例回收时间 | 120 |
SANDBOX_IDLE_CHECK_INTERVAL_SECONDS |
idle reaper 扫描间隔 | 10 |
SANDBOX_EXEC_TIMEOUT_SECONDS |
命令超时，也用于计算安全回收下限 | 180 |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 179 lines · 0 tokens per session scan C 27c7cdbf75bc
sandbox-architecture is an agent published in the GitHub repository xerrors/Yuxi (6,606 stars, last pushed 2d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,684 tokens. A static security scan graded it C with 2 findings (reaches for credential files, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
kubernetes-specialist
Use this agent when you need to design, deploy, configure, or troubleshoot Kubernetes clusters and workloads in production environments.
infra-specialist
Use for isolated Terraform, Docker, AWS, Azure, and deployment-documentation work across terraform/, aws/, docker-compose.yml, DEPLOYMENT.md, and agenticai/deployments/.
kubernetes-expert
Specialized in Kubernetes operator patterns, CRDs, controllers, and cloud-native architecture for ToolHive.
sre
站点可靠性工程师，负责系统可用性保障、事故响应、容量规划、SLO/SLI定义和自动化运维.
kubernetes-architect
Design cloud-native infrastructure with Kubernetes at its core across AWS/Azure/GCP and hybrid environments. Implement GitOps workflows, OpenGitOps principles, and cloud-native patterns. Masters EKS, AKS, GKE, and self-managed clusters. Handles service mesh, observability, and progressive delivery. Use PROACTIVELY for…
devops-engineer
Use this agent when building or optimizing infrastructure automation, CI/CD pipelines, containerization strategies, and deployment workflows to accelerate software delivery while maintaining reliability and security.