Agent Sandbox Image

RIGOR maintains one shared sdlx-agent-base image for ASCEND, Composer, and PRISM Agent sessions. The image gives each isolated container the same known shell, source-control, build, and analysis tools without downloading a new toolchain during every task.

This is an RIGOR compatibility baseline, not a copy of an OpenAI internal image and not a list of Codex hard dependencies. Codex can use any executable exposed by its runtime; RIGOR includes the commands that are repeatedly useful for this repository and its scientific workflows.

Why the image exists

• Reproducibility: the base image digest, uv, and scientific Python packages are pinned, so equivalent sessions start from an equivalent toolchain.
• Fast, reliable startup: common tools are already present when network access is slow, restricted, or unavailable.
• Auditable scope: adding a tool is a reviewed image change rather than an unrecorded per-session installation.
• Consistent operation: ASCEND, Composer, and PRISM share command conventions while retaining separate containers, workspaces, policies, and audit records.

The image is built from sandbox/agent-base.Containerfile by scripts/build-agent-sandbox.sh.

What is included and why

Group	Representative tools	Reason
Shell and text	Bash, Zsh, coreutils, find, rg, fd, sed, awk, jq, yq	Inspect and transform repositories and structured configuration using common Agent command patterns.
Source and files	Git, Git LFS, diff/patch, archive tools, file, editors	Review and modify source, compare changes, and handle normal repository artifacts.
Diagnostics	ps, lsof, ss, DNS utilities, tree	Diagnose child processes, ports, DNS, and workspace layout without host access.
Build tools	GCC/G++, Clang, Make, CMake, Ninja, pkg-config, OpenSSL and SQLite headers	Build common native projects and Python packages with native extensions.
Language runtimes	Node.js/npm/Corepack and Python/pip/venv with pinned uv	Cover RIGOR's TypeScript and Python code and respect project lockfiles.
Scientific baseline	pinned NumPy, SciPy, and Matplotlib in /opt/sdlx-science	Give PRISM and other bounded analysis tasks a reproducible numerical and plotting baseline.

fd-find is exposed as fd because that is the common cross-platform command name. apply_patch remains an Agent harness capability; the Linux patch package is included only for conventional source workflows.

Deliberate boundaries

The baseline does not include a Docker socket, sudo, Kubernetes/cloud administration tools, or every language ecosystem. Project-specific Rust, Go, JVM, device SDK, or infrastructure tools should use a reviewed profile or a separate image when a real workload requires them.

Nested bubblewrap is also omitted because RIGOR currently applies isolation at the outer Podman boundary. Runtime code, rather than the image alone, enforces a read-only root filesystem, dropped capabilities, no-new-privileges, bounded tmpfs/cache mounts, resource limits, mount policy, and sandbox cleanup.

The compilers and scientific stack increase image size, but they avoid the more costly and less reproducible alternative of installing them during Agent runs. --no-install-recommends and removal of package indexes limit avoidable growth.

Change rule

Add a baseline tool only when an RIGOR contract, representative repository task, or aggregated missing-command telemetry demonstrates recurring need. Pin tools whose version affects reproducibility, rebuild the image, run the sandbox smoke tests, and review both image-size and permission changes. Keep one-off and high-privilege tools outside the shared baseline.

Build and runtime maintenance procedures are documented in Deployment and Services.