PTC: ContainerRuntime with Docker isolation (Phase 3, future)

[Oaklight]

Parent: #173

Overview

Future phase: implement a CodeRuntime that runs LLM-generated code inside a Docker container for full isolation (network, filesystem, resource limits). Same CodeRuntime.execute(code, tools) interface as InProcessRuntime and SubprocessRuntime.

Difference from SubprocessRuntime

	Subprocess	Container
Isolation	Process-level	Container-level (namespace, cgroup)
IPC channel	stdin/stdout pipe	HTTP / Unix socket
Network	Shared with host	Can be fully restricted
Filesystem	Shared with host	Isolated, ephemeral
Resource limits	OS-level (ulimit)	cgroup (CPU, memory, disk)
Startup cost	~ms	~seconds

Architecture

Same bidirectional tool-call pattern as SubprocessRuntime:

Main Process                            Container
────────────                            ─────────
CodeRuntime.execute(code, tools)
  → start/connect container ───────→  Python interpreter
  → HTTP POST code + tool specs ───→  build stub namespace
                                       exec(code, stubs)
                                       await query_database(sql)
                                       stub: HTTP POST {name, args} →
  ← recv {name, args}
  tool.callable(sql)
  HTTP response {result} ─────────→
                                       stub: return result
                                       ...
                                       HTTP POST stdout ───────────→
  ← recv stdout
  return CodeResult(stdout)

ToolProjection = HTTP stub instead of pipe stub. Everything else follows the same protocol.

Scope (to be refined when this becomes active)

• Container lifecycle management (pool, reuse, expiration)
• Resource limits configuration (CPU, memory, timeout)
• Network policy (deny-all by default, allowlist for specific tool endpoints)
• Environment variable control (explicit passthrough, not inherited)
• Pre-built container image with common Python packages

Dependencies

• PTC: Define CodeRuntime and ToolProjection protocols #175 (CodeRuntime and ToolProjection protocols)
• PTC: Bidirectional IPC for SubprocessRuntime (codecell) #177 (SubprocessRuntime — same pattern, simpler transport)