dsh-code-runtime-container

Configuration

Every default is the restrictive one; a backend whose point is isolation must not be safe only after configuration.

Key	Default	Meaning
dockerPath	docker	Container CLI. Anything argv-compatible with docker run.
image	node:22-alpine	Needs a node on PATH and nothing else.
network	none	Docker network mode. The main reason to use this backend.
memory	512m	Memory ceiling; an overrun is an OOM kill reported as worker-exit.
cpus	1	Kernel-enforced CPU quota.
pidsLimit	128	Process ceiling: a fork bomb hits it, not the host.
user	65534:65534	nobody:nogroup. Empty uses the image default.
readOnlyRootfs	true	Read-only root, with a tmpfs at /tmp.
tmpfsMb	64	Size of that tmpfs.
workspacePath	''	Absolute host path to mount at /workspace. Empty mounts nothing.
workspaceReadOnly	true	Mount the workspace read-only.
extraArgs	[]	Extra docker run flags. An escape hatch that can weaken every default above.
maxWallMs	120000	Wall-clock ceiling for one run, including container start.
maxOutputBytes	4194304	Combined cap on logs plus completion value.

Programs that must read project files need a mount:

- id: code-runtime-container
  config:
    workspacePath: /Users/me/projects/app
    workspaceReadOnly: true
    # …restate the rest; a patch replaces a row's whole config