dsh-rerun-env-container

Environment provider that runs each attempt inside a container.

This is the provider to measure with, for two reasons the local one cannot match. Its PATH is a declared constant and its image is pinned by digest, so "what binaries could the agent reach" is a complete recorded statement rather than a property of whoever launched the run. And --network none. Denying the network makes "the environment was frozen" a property the machine enforces rather than a claim the operator makes.

Workspaces are still materialized on the host and bind-mounted in, so the diff is still computed with the host's git and the harvest still reads local files — only the LAUNCH moves, through the seam's wrap hook.

The environment is handed over with --env-file, never -e: a container runtime's command line is world-readable in ps, and passEnv routinely carries the model API key.

- id: rerun-env-container
  name: 'dsh-rerun-env-container'
  config:
    image: ghcr.io/example/dsh-rerun@sha256:...   # pin by digest, not tag
    network: none
    mounts:
      - { host: /opt/dsh-baseline, container: /opt/dsh-baseline }
    extraArgs: ['--cpus=2', '--memory=4g']

Substituted for the design's E2B provider: the isolation goal is the same and the seam is identical, while containers are what CI already has. E2B remains addable as a third provider behind the same interface.

Model Experience

None. This package never contributes to a model request: it runs in the orchestrator process, and the model calls it cares about happen inside a separate attempt subprocess running a different build of DSH entirely.

KV Cache effect

None; it neither assembles nor sends a provider request.

Known Limitations and Deferred Work

• A variant's bin must be a path valid INSIDE the container. Getting the harness there is the mounts config's job, and a mismatch fails at launch rather than at configuration time.
• An image tag is not an identity. The provider records the image DIGEST in its fingerprint precisely because node:22 today and next month are different environments — but a run configured with a tag still starts from whatever that tag resolved to.
• Untested against a live container runtime in this repository's CI. The argument construction is covered; the daemon interaction is not.