mirror of
https://github.com/proffesor-for-testing/agentic-qe.git
synced 2026-09-19 08:45:47 +08:00
Profa
6b69449a4b
BREAKING CHANGE: Network policies are now permissive by default
Previously, all agents had restrictive domain whitelisting enabled by
default (blockUnknownDomains: true), which blocked access to:
- Multi-model router's 8+ LLM providers (only Anthropic was allowed)
- Arbitrary websites needed for QE testing purposes
Changes:
- Default policies now use blockUnknownDomains: false (permissive)
- Rate limiting still applies for protection
- Audit logging enabled by default for visibility
- Added LLM_PROVIDER_DOMAINS constant with 15 provider domains
- Added createRestrictivePolicy() for opt-in security when needed
- Added enableRestrictiveModeGlobally() for secure deployments
For security-sensitive deployments, use:
```typescript
// Option 1: Per-agent restrictive policy
const policy = createRestrictivePolicy('qe-test-generator', ['custom.api.com']);
manager.registerPolicy(policy);
// Option 2: Global restrictive mode
enableRestrictiveModeGlobally();
```
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
158 lines
3.9 KiB
YAML
158 lines
3.9 KiB
YAML
# Docker Compose for Sandbox Development and Testing
|
|
#
|
|
# Provides a development environment for testing sandboxed agents
|
|
# with resource limits and network isolation.
|
|
#
|
|
# Usage:
|
|
# docker-compose -f infrastructure/docker/docker-compose.sandbox.yml up
|
|
#
|
|
# @see Issue #146 - Security Hardening: Docker Sandboxing
|
|
|
|
version: '3.8'
|
|
|
|
services:
|
|
# ===========================================
|
|
# Base Sandbox Agent (Template)
|
|
# ===========================================
|
|
agent-sandbox:
|
|
build:
|
|
context: ../..
|
|
dockerfile: infrastructure/docker/agent.Dockerfile
|
|
# Resource limits (enforced by cgroups)
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '2'
|
|
memory: 2G
|
|
reservations:
|
|
cpus: '0.5'
|
|
memory: 256M
|
|
# Security settings
|
|
read_only: true
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
# Writable tmpfs mounts
|
|
tmpfs:
|
|
- /tmp:size=100M,mode=1777
|
|
- /app/tmp:size=50M,mode=1777
|
|
# Environment
|
|
environment:
|
|
- NODE_ENV=production
|
|
- AGENT_TYPE=default
|
|
# Internal network only
|
|
networks:
|
|
- sandbox-net
|
|
# Logging
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
|
|
# ===========================================
|
|
# Test Generator Agent
|
|
# ===========================================
|
|
test-generator:
|
|
extends:
|
|
service: agent-sandbox
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '2'
|
|
memory: 2G
|
|
environment:
|
|
- AGENT_TYPE=qe-test-generator
|
|
# Allow specific domains for test generation
|
|
dns:
|
|
- 8.8.8.8
|
|
networks:
|
|
sandbox-net:
|
|
aliases:
|
|
- test-generator
|
|
|
|
# ===========================================
|
|
# Coverage Analyzer Agent
|
|
# ===========================================
|
|
coverage-analyzer:
|
|
extends:
|
|
service: agent-sandbox
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '1'
|
|
memory: 1G
|
|
environment:
|
|
- AGENT_TYPE=qe-coverage-analyzer
|
|
networks:
|
|
sandbox-net:
|
|
aliases:
|
|
- coverage-analyzer
|
|
|
|
# ===========================================
|
|
# Security Scanner Agent
|
|
# ===========================================
|
|
security-scanner:
|
|
extends:
|
|
service: agent-sandbox
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '2'
|
|
memory: 4G
|
|
environment:
|
|
- AGENT_TYPE=qe-security-scanner
|
|
networks:
|
|
sandbox-net:
|
|
aliases:
|
|
- security-scanner
|
|
|
|
# ===========================================
|
|
# Performance Tester Agent
|
|
# ===========================================
|
|
performance-tester:
|
|
extends:
|
|
service: agent-sandbox
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '4'
|
|
memory: 4G
|
|
environment:
|
|
- AGENT_TYPE=qe-performance-tester
|
|
networks:
|
|
sandbox-net:
|
|
aliases:
|
|
- performance-tester
|
|
|
|
# ===========================================
|
|
# Networks
|
|
# ===========================================
|
|
networks:
|
|
sandbox-net:
|
|
driver: bridge
|
|
# Internal network - no external access by default
|
|
internal: true
|
|
driver_opts:
|
|
com.docker.network.bridge.enable_ip_masquerade: "false"
|
|
labels:
|
|
agentic-qe.sandbox-network: "true"
|
|
agentic-qe.security-level: "isolated"
|
|
|
|
# Optional: Whitelisted network with controlled egress
|
|
whitelisted-net:
|
|
driver: bridge
|
|
internal: false
|
|
labels:
|
|
agentic-qe.sandbox-network: "true"
|
|
agentic-qe.security-level: "whitelisted"
|
|
|
|
# ===========================================
|
|
# Volumes (for persistent data if needed)
|
|
# ===========================================
|
|
volumes:
|
|
agent-data:
|
|
labels:
|
|
agentic-qe.sandbox-volume: "true"
|