UAT: ContainerConfig and ContainerToolExecutor have no memory/CPU resource limit support — container execution is unconstrained #5524

New issue

Open

opened 2026-04-09 07:12:32 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-09 07:12:32 +00:00

Owner

Summary

ContainerConfig and ContainerToolExecutor have no fields or mechanisms for setting container resource limits (memory, CPU quotas, ulimits). The spec's Safety Profile model includes max_cost_per_plan and max_retries_per_step constraints, but there is no mechanism to enforce container-level resource constraints (memory limits, CPU quotas) when tools execute inside containers.

What Was Tested

Code-level analysis of:

src/cleveragents/tool/container_executor.py — ContainerConfig and ContainerToolExecutor
src/cleveragents/domain/models/core/safety_profile.py — SafetyProfile
docs/adr/ADR-039-container-resource-types.md — Container resource type definitions
docs/specification.md — Safety Profile and container execution sections

Expected Behavior (from spec)

Per docs/specification.md §Safety Profile:

A composed sub-model of an Automation Profile that groups all hard safety constraints: require_sandbox, require_checkpoints, allow_unsafe_tools, require_human_approval, allowed_skill_categories, max_cost_per_plan, max_retries_per_step, and max_total_cost.

Per docs/adr/ADR-039-container-resource-types.md §Container Layer:

container-instance properties include resource configuration. The snapshot sandbox strategy for container instances creates a container checkpoint or commit.

Container tool execution should support resource constraints to prevent runaway container processes from consuming excessive host resources.

Actual Behavior

ContainerConfig (lines 58-75 of container_executor.py) only has:

class ContainerConfig(BaseModel):
    workspace_folder: str = Field(default="/workspace", min_length=1)
    container_id: str = ""
    image: str = ""
    timeout_seconds: int = Field(default=_DEFAULT_TIMEOUT_SECONDS, gt=0)
    host_sandbox_path: str = ""

No memory limit, CPU quota, ulimit, or other resource constraint fields. The devcontainer exec command built by _build_exec_command() passes no resource limit flags.

Impact

Container tool execution is unconstrained — a misbehaving tool can consume all available host memory/CPU
No way to enforce per-tool or per-plan resource budgets at the container level
Security isolation is incomplete without resource limits

Suggested Fix

Add optional resource limit fields to ContainerConfig:

memory_limit_mb: int | None = Field(default=None, gt=0)
cpu_quota_percent: int | None = Field(default=None, gt=0, le=100)

Pass these as --memory and --cpus flags to docker exec or equivalent when running container tools.

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: uat-tester

## Summary `ContainerConfig` and `ContainerToolExecutor` have no fields or mechanisms for setting container resource limits (memory, CPU quotas, ulimits). The spec's Safety Profile model includes `max_cost_per_plan` and `max_retries_per_step` constraints, but there is no mechanism to enforce container-level resource constraints (memory limits, CPU quotas) when tools execute inside containers. ## What Was Tested Code-level analysis of: - `src/cleveragents/tool/container_executor.py` — `ContainerConfig` and `ContainerToolExecutor` - `src/cleveragents/domain/models/core/safety_profile.py` — `SafetyProfile` - `docs/adr/ADR-039-container-resource-types.md` — Container resource type definitions - `docs/specification.md` — Safety Profile and container execution sections ## Expected Behavior (from spec) Per `docs/specification.md` §Safety Profile: > A composed sub-model of an Automation Profile that groups all hard safety constraints: `require_sandbox`, `require_checkpoints`, `allow_unsafe_tools`, `require_human_approval`, `allowed_skill_categories`, `max_cost_per_plan`, `max_retries_per_step`, and `max_total_cost`. Per `docs/adr/ADR-039-container-resource-types.md` §Container Layer: > `container-instance` properties include resource configuration. The `snapshot` sandbox strategy for container instances creates a container checkpoint or commit. Container tool execution should support resource constraints to prevent runaway container processes from consuming excessive host resources. ## Actual Behavior `ContainerConfig` (lines 58-75 of `container_executor.py`) only has: ```python class ContainerConfig(BaseModel): workspace_folder: str = Field(default="/workspace", min_length=1) container_id: str = "" image: str = "" timeout_seconds: int = Field(default=_DEFAULT_TIMEOUT_SECONDS, gt=0) host_sandbox_path: str = "" ``` No memory limit, CPU quota, ulimit, or other resource constraint fields. The `devcontainer exec` command built by `_build_exec_command()` passes no resource limit flags. ## Impact - Container tool execution is unconstrained — a misbehaving tool can consume all available host memory/CPU - No way to enforce per-tool or per-plan resource budgets at the container level - Security isolation is incomplete without resource limits ## Suggested Fix Add optional resource limit fields to `ContainerConfig`: ```python memory_limit_mb: int | None = Field(default=None, gt=0) cpu_quota_percent: int | None = Field(default=None, gt=0, le=100) ``` Pass these as `--memory` and `--cpus` flags to `docker exec` or equivalent when running container tools. --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: uat-tester

HAL9000 added the

labels

2026-04-09 07:13:14 +00:00

HAL9000 referenced this issue

2026-04-09 07:20:57 +00:00

[AUTO-ARCH] Architecture Review (Cycle 1) #5368