[eersnington]

• Add a docker sandbox provider to @rivet-dev/sandbox-adapter (@rivet-dev/sandbox-adapter/docker). It drives the docker CLI on the worker, so it uses the current Docker context. Meant for local development.
• Each sandbox is one labelled container with no host mounts, no host environment, no privileged mode, and no host network (network: "host" is rejected). network: "none" leaves only loopback.
• Suspend stops the container and keeps its files; destroy removes it. A kill or timeout ends the command and its child processes; a process that detaches, such as (command &), runs until the container stops.
• ports publishes container ports on a random 127.0.0.1 port; read the address with dockerPortAddress(sandboxId, port). keepImageEntrypoint runs images that start their own server, such as cloudflare/sandbox.
• Docs: Docker section and provider table row in sandboxes.mdx, plus examples/docs/sandboxes/docker.ts.
• Tests run against a real Docker daemon (9 tests: exec, timeout kill, files, network none, suspend/destroy, ports).

[railway-app]

This PR was not deployed automatically as @eersnington does not have access to the Railway project.

In order to get automatic PR deploys, please add @eersnington to your workspace on Railway.

[github-actions]

📟 Pip-Boy · d412a15

📦 Packages · fresh npm install resolve, no lockfile · this PR vs base

package (linux-x64-gnu)	@latest	base	this PR	Δ vs base	packages
@rivet-dev/pi	429.8 MB	429.8 MB	429.9 MB	+33.5 KB (+0.0%)	218 (0)

`@rivet-dev/pi` details

platform	base	this PR	Δ
linux-x64-gnu	429.8 MB	429.9 MB	+33.5 KB (+0.0%)
linux-arm64-gnu	402.5 MB	402.5 MB	+33.5 KB (+0.0%)
darwin-arm64	303.2 MB	303.2 MB	+33.5 KB (+0.0%)
darwin-x64	316.7 MB	316.8 MB	+33.5 KB (+0.0%)
win32-x64	285.2 MB	285.2 MB	+33.5 KB (+0.0%)

Entrypoints (own code, minified; third-party imports excluded)

entrypoint	base	this PR	Δ	imports	exports
.	30.3 KB	31.6 KB	+1.3 KB (+4.4%)	—	+PiAnswer +PiOnAnswer +PiSubmitResult
./durable	30.3 KB	31.6 KB	+1.3 KB (+4.4%)	—	+PiAnswer +PiOnAnswer +PiSubmitResult

All 10 packages · linux-x64-gnu

package (linux-x64-gnu)	@latest	base	this PR	Δ vs base	packages
@rivet-dev/pi	429.8 MB	429.8 MB	429.9 MB	+33.5 KB (+0.0%)	218 (0)
@rivet-dev/sandbox-adapter	76.0 MB	76.0 MB	76.0 MB	+22.5 KB (+0.0%)	94 (0)
@sandbox-agent/cli-shared	27.2 KB	27.2 KB	27.2 KB	0	1 (0)
@sandbox-agent/persist-indexeddb	12.4 KB	12.4 KB	12.4 KB	0	1 (0)
@sandbox-agent/persist-postgres	12.3 KB	12.3 KB	12.3 KB	0	1 (0)
@sandbox-agent/persist-rivet	12.2 KB	12.2 KB	12.2 KB	0	1 (0)
@sandbox-agent/persist-sqlite	12.3 KB	12.3 KB	12.3 KB	0	1 (0)
@sandbox-agent/react	41.5 MB	41.9 MB	41.9 MB	0	15 (0)
acp-http-client	6.7 MB	6.7 MB	6.7 MB	0	3 (0)
sandbox-agent	30.9 MB	31.0 MB	31.0 MB	0	8 (0)

🧹 Rust dependencies

Skipped: this PR doesn't change any Rust code or dependencies.

🦀 Binaries

Skipped: this PR doesn't change any Rust code.

⏱ Timing

job	wall time	slowest step
zizmor	16s	checkout · 8s
changes	18s	checkout · 13s
footprint	3m30s	Run pnpm --dir sandbox-agent install --frozen-lockfile · 1m32s
⏭ hygiene	—	skipped
⏭ native · ${{ matrix.platform }}	—	skipped
⏭ self-test	—	skipped
report	46s	setup-node · 27s

🔭 Full CI trace for this commit

One OpenTelemetry trace of CI and Pip-Boy for d412a15: every job and step, with the sizes above attached. Run after CI finishes.

pnpm install --frozen-lockfile --filter 'pipboy...'
pnpm --filter pipboy pipboy trace --sha d412a1503647236ceda72ef8856ad0637e873f67

Add --otlp <url> to send it to any OTLP/HTTP collector.

Agent instruction: From a rivet-dev/agents checkout, run the commands above, then read the trace file the last command prints. List the slowest jobs and steps and explain where CI time went.