[Security] Upgrade execution sandbox to container-based isolation

[Atharv777]

Summary

Replace the current subprocess-based execution model with a container-based sandbox (e.g., Docker) to ensure stronger isolation and security.

Why this matters

The current execution model is not fully secure. It may allow:

• resource abuse
• filesystem leakage
• unexpected system access

Container-based isolation is required for production-grade security.

Scope

• Execute user code inside isolated containers
• Create ephemeral containers per execution/session
• Restrict filesystem access to container scope
• Disable outbound network access
• Enforce CPU and memory limits at container level
• Automatically clean up containers after execution

Acceptance Criteria

• Each execution runs inside an isolated container
• No access to host filesystem outside allowed scope
• Network access is disabled or tightly controlled
• Containers are automatically destroyed after execution
• System remains stable under repeated executions

Files Involved

• server/start.py
• server/agent.py
• server/utils/*
• docker/* (new or existing configs)
• docker-compose.yml

Difficulty

Hard

Labels: security backend devops critical