Open Questions and Risks¶
Open questions¶
- Is the service trusted-local, single-tenant, or exposed to multiple agent tenants?
- Which resource limits are enforced by local mode versus microsandbox?
- Are artifacts immutable and how long are they retained?
- How are orphaned VMs reconciled after service crashes?
- Is command output streaming required for long-running analysis?
- What backup/restore guarantees apply to SQLite and workspace data?
Risks and next steps¶
| Risk | Action |
|---|---|
| Optional auth/default wildcard CORS | Require production auth and strict origins |
| Host execution in local mode | Gate it behind explicit development configuration |
| Archive bombs/oversized files | Add byte/file/count limits and scanning |
| Stateful single-node storage | Define shared-store or placement strategy |
| Orphan runtimes | Reconcile runtime inventory with SQLite records |
| Secret/environment leakage | Filter env and redact logs |
Verification checklist¶
- Run traversal and symlink tests against tar and zip uploads.
- Exercise timeout and output truncation in both runtimes.
- Kill the service during create/stop/snapshot and inspect reconciliation.
- Test snapshot restore with and without workspace bundles.
- Validate auth/CORS behavior from an external origin.