Repository navigation
feat(environments): add group and session Docker isolation - #242
Merged
Merged
Conversation
KaiEureka
force-pushed
the
codex/session-docker-isolation
branch
from
October 24, 2026 03:23
cb78bc2 to
1e71d65
Compare
Include source tag references in workspace bundles and restore them alongside HEAD so container builds retain Git-based version discovery. Preserve both lightweight and annotated tags with their release history. Verify native group and session builds, historical release reads, tag object types, and linked source imports in SHA-1 and SHA-256 repositories.
Copy each source repository's existing shallow boundary into its private Git metadata before fetching the workspace bundle. Resolve the boundary through Git so linked worktrees and initialized submodules retain their own history. Cover shallow SHA-1 and SHA-256 repositories, linked worktrees, submodules, and native group/session review handoffs while preserving source boundaries.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
docker-groupanddocker-sessionproviders to the isolation strategy interface in #241. A group owns one container with independent worktrees; session isolation owns one container per acquired execution environment.The providers copy the actual candidate state into private container Git metadata, preserve release tags used by version-dependent builds and the existing boundaries of shallow histories, retain patches and recovery locations before cleanup, and preserve caller-owned source environments. Public Docker options configure the image, network, CPU, memory, PID limit and read-only mounts. Existing Docker helper defaults remain compatible.
Validation includes real Docker resource inspection, group/session container identity, private workspaces, review-source handoff, interrupted-command recovery and cleanup. Independent review reproduced and repaired source object-format handling and cancellation of snapshot-copy operations. Provider-owned containers use Docker's init process so ordinary command cancellation can reap descendants while preserving the existing recovery behavior for genuinely unquiescent commands. The latest independent Docker review passed 57 focused and native checks, 14 import/cancellation cases and 94 adjacent regressions. Tagged-build controls cover both isolation strategies, annotated and lightweight tags and historical release files. Shallow-import controls cover ordinary repositories, linked worktrees, initialized submodules, Docker sources and SHA-1/SHA-256, preserving the source history without network retrieval. Python 3.10 cancellation assertions use the repository's existing compatibility helper. Ruff, import-linter and deptry pass. All final-head GitHub checks pass, including complete Python 3.10–3.14 suites, package verification and macOS checks. Python 3.10 passed on retry after an unchanged short-timeout fixture failed before its controlled write started. Both fixture variants also passed eight local repetitions.
This is the second part of the runtime feature series, building on #241. Model routing and managed member-authored runs follow in #243 and #244.