Skip to content

feat: Docker isolation image and runtime controls (--volume/--mount/--env/--privileged)#133

Merged
konard merged 4 commits into
mainfrom
issue-132-81888ef731d7
Jun 9, 2026
Merged

feat: Docker isolation image and runtime controls (--volume/--mount/--env/--privileged)#133
konard merged 4 commits into
mainfrom
issue-132-81888ef731d7

Conversation

@konard

@konard konard commented Jun 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

Closes #132.

Extends the Docker isolation backend so callers can configure the container runtime surface directly, instead of dropping out of start to wrap docker run by hand. Implemented with full parity across the JavaScript/Bun and Rust implementations.

New isolation options (docker only)

Option Description
--volume, -v <host:container[:mode]> Bind mount / volume (repeatable)
--mount <mount-spec> docker run --mount spec (repeatable)
--env, -e <KEY=VALUE> Environment variable for the container (repeatable)
--privileged Run the container in privileged mode (for Docker-in-Docker images)

These are threaded into the internal docker run argv (both detached and attached modes) and recorded in --status / --list metadata. They are forwarded across nested isolation levels (JS) and rejected with a clear error when the isolation stack does not include docker.

Motivating use case

Hive Mind needs konard/hive-mind-dind:latest with mounted tool credentials and a privileged container:

start -i docker --image konard/hive-mind-dind:latest --privileged \
  -v ~/.config/gh:/root/.config/gh -e TOKEN=abc -- solve ...

How to reproduce / verify

start -i docker -d --image alpine:latest \
  -v /host/secret:/data:ro -e MYVAR=hello -- sh -c 'cat /data/cred.txt; echo "ENV=$MYVAR"'
start --status <session> --output-format json   # shows volumes/env/mounts/privileged

Verified end-to-end with real Docker in both implementations: container output reflects the mounted file content and injected env var, and --status metadata lists volumes/env (with mounts/privileged null when unset).

Tests

  • JS: js/test/docker-runtime-options.js — 21 tests covering parsing (repeatable + = form), docker-only validation, buildDockerRuntimeArgs ordering, and the buildDockerRuntimeStatusLines / buildDockerRuntimeMetadata helpers.
  • Rust: new cases in args_parser_cases.rs (parsing/validation), isolation_cases.rs (build_docker_runtime_args ordering), and isolation_metadata_cases.rs (status lines, metadata, options map).

Refactor note

To keep cli.js / main.rs under the 1000-line CI file-size limit, the docker runtime status-line and metadata construction were extracted into reusable helpers (buildDockerRuntimeStatusLines/buildDockerRuntimeMetadata in js/src/lib/isolation.js; docker_runtime_status_lines/docker_runtime_metadata/build_isolation_options_map in the new rust/src/lib/isolation_metadata.rs).

Release

  • js/.changeset/docker-runtime-controls.md (minor)
  • rust/changelog.d/133.md (bump: minor)

Docs

README.md and both usage/help outputs document the four options with examples.

@konard
Initial commit with task details
625b621 
Adding .gitkeep for PR creation (default mode).
This file will be removed when the task is complete.

Issue: #132
@konard konard self-assigned this Jun 9, 2026
@konard
feat: add Docker isolation image and runtime controls
ce3fb92 
Add --volume/-v, --mount, --env/-e, and --privileged options to the
Docker isolation backend in both the JavaScript and Rust implementations.

These flags are threaded into the underlying 'docker run' invocation and
recorded in --status/--list metadata, so callers can mount tool
credentials, inject environment variables, and run Docker-in-Docker
images (e.g. konard/hive-mind-dind:latest) without wrapping 'docker run'
themselves. Options are validated to be docker-only and forwarded across
nested isolation levels.

Closes #132
@konard konard changed the title [WIP] Docker isolation needs image and bind-mount controls feat: Docker isolation image and runtime controls (--volume/--mount/--env/--privileged) Jun 9, 2026
@konard konard marked this pull request as ready for review June 9, 2026 19:48
@konard konard mentioned this pull request Jun 9, 2026
Closed
konard added 2 commits June 9, 2026 20:02
@konard
refactor: extract docker runtime helpers to satisfy file-size limit; …
5ec790c 
…add parity tests

- Move docker runtime status/metadata + isolation options map helpers into
  rust/src/lib/isolation_metadata.rs (keeps isolation.rs and main.rs <1000 lines)
- Extract buildDockerRuntimeStatusLines/buildDockerRuntimeMetadata in JS isolation.js
  and use them from cli.js (keeps cli.js <1000 lines)
- Add Rust + JS unit tests for the new helpers to restore test parity (>=90%)
@konard
chore: remove placeholder .gitkeep now that PR has real changes
bfee3a5
@konard

konard commented Jun 9, 2026

Copy link
Copy Markdown
Member Author

CI status: green ✅

  • Rust CI/CD — passing (commit bfee3a5)
  • JavaScript CI/CD — passing (commit bfee3a5)

Note on a transient Windows/Bun failure

The first JS CI run on bfee3a5 showed 3 failures, all on the Bun on windows-latest matrix leg and all in js/test/isolation.js (a file untouched by this PR):

  • runInDocker > should require image option
  • runInDocker keep-alive messages > should include auto-exit message by default in detached mode
  • runInDocker keep-alive messages > should include keep-alive message when keepAlive is true

These are pre-existing, timing-flaky docker tests on the Windows runner — the same should require image option test already fails on main (run 27077427314), and the keep-alive ones sit right at the 5000 ms per-test limit because canRunLinuxDockerImages() (the skip-guard's docker probe) takes >5 s to respond on the Windows runner (it passed at ~2.2 s on main). They are not related to the runtime-controls changes in this PR. Re-running the failed jobs brought JS CI green.

@konard

konard commented Jun 9, 2026

Copy link
Copy Markdown
Member Author

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost: $16.490728

📊 Context and tokens usage:

Claude Opus 4.8: (4 sub-sessions)

  1. 116.5K / 1M (12%) input tokens, 19.8K / 128K (15%) output tokens
  2. 116.7K / 1M (12%) input tokens, 26.7K / 128K (21%) output tokens
  3. 117.0K / 1M (12%) input tokens, 44.3K / 128K (35%) output tokens
  4. 70.0K / 1M (7%) input tokens, 17.2K / 128K (13%) output tokens

Total: (44.7K new + 462.6K cache writes + 20.3M cache reads) input tokens, 128.6K output tokens, $16.490728 cost

🤖 Models used:

  • Tool: Anthropic Claude Code
  • Requested: opus
  • Model: Claude Opus 4.8 (claude-opus-4-8)

📎 Log file uploaded as Gist (8480KB)

Now working session is ended, feel free to review and add any feedback on the solution draft.

@konard

konard commented Jun 9, 2026

Copy link
Copy Markdown
Member Author

✅ Ready to merge

This pull request is now ready to be merged:

  • All CI checks have passed
  • No merge conflicts
  • No pending changes

Monitored by hive-mind with --auto-restart-until-mergeable flag

@konard konard merged commit ab3ccdd into main Jun 9, 2026
36 of 37 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@konard konard

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Docker isolation needs image and bind-mount controls

1 participant

@konard