microsoftgbb/Agent Sandbox
Network-isolated sandbox for AI agents in GitHub Actions. Runs the agent inside a Docker container with all traffic routed through a Squid proxy enforcing a configurable domain allowlist. Inspired by GitHub Next Agentic Workflows (gh-aw) Agent Workflow Firewall.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| command | The command to run inside the sandbox (e.g., copilot -p "..." --agent my-agent) | yes | — |
| allowed-domains | Newline-separated list of allowed domains. Supports Squid dstdomain syntax (e.g., .example.com matches all subdomains). | yes | — |
| output-path | Path inside the container where the agent writes its output (copied to workspace after execution) | no | agent-output.json |
| workspace-mount | Host path to mount as /workspace in the container (defaults to GITHUB_WORKSPACE) | no | "" |
| extra-mounts | Additional volume mounts, one per line in docker -v format (e.g., /host/path:/container/path:ro) | no | "" |
| env-vars | Environment variables to pass to the agent container, one per line (e.g., GITHUB_TOKEN=${{ secrets.TOKEN }}) | no | "" |
| image | Docker image for the agent container. Override to use a custom image with additional tools. | no | ghcr.io/microsoftgbb/agent-sandbox:latest |
Outputs
| name | description |
|---|---|
| output-path | Path to the agent output file on the host |
| proxy-log | Squid proxy access log (audit trail of all domains the agent contacted) |
| exit-code | Exit code of the agent command |