Skip to content
Dewee.sh Documentation

Sandboxing & Isolation

.md

Sandboxing & Isolation

Section titled “Sandboxing & Isolation”

Untrusted agent code is executed inside an isolated Docker container (Dockerfile.sandbox with WITH_SANDBOX=1).

Security Controls

Section titled “Security Controls”
  • Blocked shell deny patterns (e.g. curl | sh, fork bombs, reverse shells).
  • Timeouts on all subshell processes (default 60s).
  • Isolated virtual filesystem boundaries.