feat: more executor guards

deployment/docker-compose.yaml

@@ -33,10 +33,14 @@ services:
     ports:
       - "7091:7091"
     networks:
-      # `default` reaches the internet + the sandbox gateway; `data-net` reaches
-      # redis/postgres (which are NOT on the sandbox's networks).
+      # `default` reaches the internet (LLM APIs) + frontend/host; `data-net`
+      # reaches redis/postgres; `sandbox-net` reaches the code-exec runner over an
+      # internal-only net (so the runner needs no shared internet bridge to be
+      # reachable, and the egress overlay can cut its internet without severing
+      # this control path).
       - default
       - data-net
+      - sandbox-net
     volumes:
       - ../application/indexes:/app/indexes
       - ../application/inputs:/app/inputs
@@ -56,8 +60,11 @@ services:
     # deployment/sandbox/README.md).
     command: celery -A application.app.celery worker -l INFO -B -Q docsgpt,parsing
     networks:
+      # See backend: control-plane access to the code-exec runner over sandbox-net
+      # (workflow code nodes run in the worker).
       - default
       - data-net
+      - sandbox-net
     env_file:
       - ../.env
     environment:
@@ -80,12 +87,15 @@ services:
       postgres:
         condition: service_healthy
 
-  # Always-on code-execution runner (Jupyter Kernel Gateway). Sessions are
-  # in-process kernels, never child containers; the Docker socket is NOT
-  # mounted. On an internal-only network — no host port is published, so the
-  # runner is reachable only from backend/worker, not from the host/internet.
-  # Egress/SSRF blocks, the gVisor `runsc` runtime, and seccomp profile come in
-  # the hardening slice.
+  # Opt-in code-execution runner (Jupyter Kernel Gateway). Started ONLY with
+  # `docker compose --profile sandbox up`: the `code_executor` tool is off by
+  # default (removed from DEFAULT_CHAT_TOOLS) and must be enabled per-agent in
+  # the agent tool picker, so a plain `up` does not start this service.
+  # Sessions are in-process kernels, never child containers; the Docker socket
+  # is NOT mounted. On an internal-only network — no host port is published, so
+  # the runner is reachable only from backend/worker, not from the
+  # host/internet. Egress/SSRF blocks, the gVisor `runsc` runtime, and seccomp
+  # profile come in the hardening slice.
   #
   # SINGLE TRUST DOMAIN: all sessions share this one container/uid and are
   # isolated by working directory only (per-session cwd) — not by a kernel/OS
@@ -96,6 +106,7 @@ services:
   # per-session VM via SANDBOX_BACKEND=daytona instead.
   docsgpt-sandbox:
     build: ./sandbox
+    profiles: ["sandbox"]
     mem_limit: ${SANDBOX_MEMORY:-1g}
     cpus: ${SANDBOX_CPUS:-1.0}
     pids_limit: 256
@@ -109,8 +120,12 @@ services:
       # runtime files live on tmpfs; the root FS is read-only everywhere else.
       - /tmp
     networks:
+      # Reachable by backend/worker over the internal sandbox-net; internet
+      # egress (runtime pip install, etc.) via the dedicated sandbox-egress net.
+      # Deliberately NOT on `default`: the egress overlay cuts internet by
+      # flipping sandbox-egress to internal, without severing the control path.
       - sandbox-net
-      - default
+      - sandbox-egress
 
   redis:
     image: redis:6-alpine
@@ -119,7 +134,9 @@ services:
     networks:
       - data-net
     ports:
-      - 6379:6379
+      # Loopback only: the published port must NOT be reachable from the sandbox
+      # via the host/bridge gateway. Host-local dev tools still use localhost.
+      - 127.0.0.1:6379:6379
 
   postgres:
     image: postgres:16-alpine
@@ -131,7 +148,8 @@ services:
       - POSTGRES_PASSWORD=docsgpt
       - POSTGRES_DB=docsgpt
     ports:
-      - "5432:5432"
+      # Loopback only (see redis): not reachable from the sandbox via the gateway.
+      - "127.0.0.1:5432:5432"
     volumes:
       - postgres_data:/var/lib/postgresql/data
     healthcheck:
@@ -141,15 +159,20 @@ services:
       retries: 10
 
 networks:
-  # Internal-only network for the sandbox runner (no external egress route via
-  # this network; the runner still reaches the internet via the default bridge).
+  # Control plane between backend/worker and the code-exec runner. internal:true
+  # => no internet route on this net; the runner egresses via sandbox-egress.
   sandbox-net:
     internal: true
+  # The runner's outbound internet route (runtime pip install, etc.). Kept
+  # internet-facing so the base stack works out of the box;
+  # deployment/optional/docker-compose.optional.sandbox-egress.yaml flips it to
+  # internal:true and forces egress through a deny-private proxy for full SSRF
+  # containment (blocking RFC1918 / link-local / cloud-metadata).
+  sandbox-egress: {}
   # Internal-only data plane. redis (broker/cache) and postgres live here with
   # backend/worker, but the code-exec sandbox is NOT attached, so arbitrary
   # sandboxed code cannot reach the unauthenticated broker (Celery task
-  # injection -> worker RCE) or the database. For full internet-egress
-  # containment additionally apply deployment/optional/docker-compose.optional.sandbox-egress.yaml.
+  # injection -> worker RCE) or the database.
   data-net:
     internal: true