[eersnington]

• Add a docker sandbox provider to @rivet-dev/sandbox-adapter (@rivet-dev/sandbox-adapter/docker). It drives the docker CLI on the worker, so it uses the current Docker context. Meant for local development.
• Each sandbox is one labelled container with no host mounts, no host environment, no privileged mode, and no host network (network: "host" is rejected). network: "none" leaves only loopback.
• Suspend stops the container and keeps its files; destroy removes it. A kill or timeout ends the command and every process it started.
• ports publishes container ports on a random 127.0.0.1 port; read the address with dockerPortAddress(sandboxId, port). keepImageEntrypoint runs images that start their own server, such as cloudflare/sandbox.
• Docs: Docker section and provider table row in sandboxes.mdx, plus examples/docs/sandboxes/docker.ts.
• Tests run against a real Docker daemon (9 tests: exec, timeout kill, files, network none, suspend/destroy, ports).

[railway-app]

This PR was not deployed automatically as @eersnington does not have access to the Railway project.

In order to get automatic PR deploys, please add @eersnington to your workspace on Railway.

[github-actions]

📟 Pip-Boy · de243d3

📦 Packages · fresh npm install resolve, no lockfile · this PR vs base

No notable install size, dependency, or entrypoint changes across 10 packages.

All 10 packages · linux-x64-gnu

package (linux-x64-gnu)	@latest	base	this PR	Δ vs base	packages
@rivet-dev/pi	429.5 MB	429.5 MB	429.5 MB	+21.7 KB (+0.0%)	216 (0)
@rivet-dev/sandbox-adapter	75.7 MB	75.7 MB	75.7 MB	+21.7 KB (+0.0%)	92 (0)
@sandbox-agent/cli-shared	27.2 KB	27.2 KB	27.2 KB	0	1 (0)
@sandbox-agent/persist-indexeddb	12.4 KB	12.4 KB	12.4 KB	0	1 (0)
@sandbox-agent/persist-postgres	12.3 KB	12.3 KB	12.3 KB	0	1 (0)
@sandbox-agent/persist-rivet	12.2 KB	12.2 KB	12.2 KB	0	1 (0)
@sandbox-agent/persist-sqlite	12.3 KB	12.3 KB	12.3 KB	0	1 (0)
@sandbox-agent/react	41.5 MB	41.8 MB	41.8 MB	0	15 (0)
acp-http-client	6.7 MB	6.7 MB	6.7 MB	0	3 (0)
sandbox-agent	30.9 MB	31.0 MB	31.0 MB	0	8 (0)

🧹 Rust dependencies

Skipped: this PR doesn't change any Rust code or dependencies.

🦀 Binaries

Skipped: this PR doesn't change any Rust code.

⏱ Timing

job	wall time	slowest step
changes	21s	checkout · 17s
zizmor	18s	checkout · 10s
footprint	3m28s	Run pnpm --dir sandbox-agent install --frozen-lockfile · 1m32s
⏭ hygiene	—	skipped
⏭ native · ${{ matrix.platform }}	—	skipped
⏭ self-test	—	skipped
report	46s	setup-node · 27s

🔭 Full CI trace for this commit

One OpenTelemetry trace of CI and Pip-Boy for de243d3: every job and step, with the sizes above attached. Run after CI finishes.

pnpm install --frozen-lockfile --filter 'pipboy...'
pnpm --filter pipboy pipboy trace --sha de243d3c71d5d66be8205fed7226203d7a8cc2b7

Add --otlp <url> to send it to any OTLP/HTTP collector.

Agent instruction: From a rivet-dev/agents checkout, run the commands above, then read the trace file the last command prints. List the slowest jobs and steps and explain where CI time went.