Docker for development and sandboxing

[blob42]

I propose to put together a dockerfile/compose for quickly setting up a dev/build container.

This will also have the benefit of extra security in the scenarios of code executions as mentioned in #1026.

I will make a PR for this.

Update:

This issue will be used to track the progress of PRs related to Docker. Separating development/testing from security/sandboxing will make it easier to manage changes and distribute the work.

Development and testing with docker

The use of docker here is to provide a consistent environment for development and testing. The docker images here are not meant to be used for untrusted code execution by chains/agents.

• #1055

Docker image for untrusted code execution

• #1266

This issue aims to create a Docker image that can be used to run untrusted code for chains/agents, with proper sandboxing and output sanitization. The following options will be considered:

The following options will be consider:

1. Using a virtualised runtime for docker such as gVisor Pros: Offers almost the same level of sandboxing as full virtualization Cons: Potential performance issues
2. Drop all capabilities from the container see
3. For PythonREPL: Use sandboxlib
4. Update the exec family of Tools and allow execution on a remote shell (like ssh) . Users can redirect the shell to a full virtual machine (kvm, xen ... )

Motivation

The various REPLs and shells than can be used by agents come with a significant risk of running untrusted and potentially malicious code. Docker can add an extra layer of sandboxing to mitigate these risks. Additionally, it is important to ensure proper sanitization of the agent's output to prevent information disclosure or other security vulnerabilities. refer to #1026

[hwchase17]

thanks - love this idea

[blob42]

Since docker will be used for both a development as well as a trusted env for chains/agent I am moving all the comments related to docker to this issue in order to split the work over multiple PRs

[jj701]

Any progress on creating a dev container:

.devcontainer

• devcontainer.json
• Dockerfile

[dosubot[bot]]

Hi, @blob42! I'm Dosu, and I'm helping the LangChain team manage their backlog. I wanted to let you know that we are marking this issue as stale.

From what I understand, the issue you raised proposes creating a Dockerfile/compose for setting up a development and build container. There has been positive feedback from users, with one user expressing their support for the idea. You mentioned that you will be moving all comments related to Docker to this issue in order to split the work over multiple PRs. Another user has asked for an update on the progress of creating a dev container.

It seems that progress is being made towards creating a development container, and the issue has been resolved. If this issue is still relevant to the latest version of the LangChain repository, please let the LangChain team know by commenting on the issue. Otherwise, feel free to close the issue yourself, or it will be automatically closed in 7 days.

Thank you for your contribution to the LangChain repository! Let us know if you have any further questions or concerns.