How mikenuguid/silverstripe-ai-dev-sandbox works
Silverstripe AI Dev Sandbox provides a host-controlled, network-restricted devcontainer for unattended coding agents. The main workflow is to install the sandbox into a project, start it with ccnet, open the network briefly for setup, close it for agent work, and check enforcement before unattended sessions. Separate components configure the container, apply firewall rules, warn about an open airlock, and guard agent network tools. The README describes these relationships; source excerpts were not provided, so the graph omits unverified implementation details.
Main entry points: install.sh Sandbox installer · ccnet Host CLI · init-firewall.sh Firewall initialization · net-open.sh Open airlock
Components 18
Setup and Configuration
- Sandbox installer
install.sh - Container templates
templates - PHP MySQL preset
presets/php-mysql - Sandbox config
templates/sandbox.conf.example - Network allowlist
templates/allowlist.txt.example
Host Airlock Control
- Host CLI
bin/ccnet - Open airlock
core/net-open.sh - Close airlock
core/net-close.sh
Sandbox Runtime
- Firewall initialization
core/init-firewall.sh - Shell setup
core/zshrc - Devcontainer
Agent Safeguards
- Network tool guard
core/net-guard.sh - Airlock warning
core/airlock-warn.sh
Other components
- Host operator
- Project workspace
- Coding agent
- Claude API
- Docker host
Connections 18
- Host operator → Sandbox installer: runs install
README.md - Sandbox installer → Project workspace: writes sandbox
README.md - Sandbox installer → Container templates: generates from
README.md - Sandbox installer → PHP MySQL preset: provisions preset
README.md - Host operator → Host CLI: runs commands
README.md - Host CLI → Devcontainer: starts or stops
README.md - Host operator → Open airlock: opens network
README.md - Host operator → Close airlock: closes network
README.md - Sandbox config → Sandbox installer: configures generation
README.md - Network allowlist → Open airlock: permits destinations
README.md - Devcontainer → Firewall initialization: applies firewall
README.md - Firewall initialization → Claude API: allows API access
README.md - Devcontainer → Coding agent: hosts agent
README.md - Coding agent → Network tool guard: network tools checked
README.md - Airlock warning → Coding agent: warns when open
README.md - Shell setup → Devcontainer: sets shell environment
README.md - Docker host → Devcontainer: runs
README.md - Project workspace → Devcontainer: workspace mounted
README.md