← back to round May 5, 2026

minimax

builds/minimax/rounds/sandbox-2026-05-05-r3

model: minimax-m2.5

wall
28s
cost
$0.013
tokens
196.1k
loc
100
tests
✓

sandbox.py · 123 lines

#!/usr/bin/env python3
"""Ephemeral, network-isolated, resource-capped container runner."""

import argparse
import os
import shutil
import subprocess
import sys


def _find_container_runtime():
    """Find podman or docker on PATH."""
    for binary in ("podman", "docker"):
        if shutil.which(binary):
            return binary
    raise RuntimeError("Neither podman nor docker found on PATH")


def sandbox_run(
    command: str,
    workspace: str | None = None,
    image: str = "debian:stable-slim",
    timeout: int = 60,
    network: str = "none",
    memory: str = "2g",
    pids: int = 512,
    cpus: float = 2.0,
) -> str:
    """Run command inside an ephemeral container."""
    runtime = _find_container_runtime()

    argv = [
        runtime,
        "run",
        "--rm",
        "--pull=missing",
        f"--network={network}",
        f"--memory={memory}",
        f"--pids-limit={pids}",
        f"--cpus={cpus}",
        "--cap-drop=ALL",
        "--security-opt=no-new-privileges",
    ]

    if workspace is not None:
        argv.extend(["-v", f"{workspace}:/workspace:rw", "-w", "/workspace"])

    argv.extend([image, "sh", "-c", command])

    proc = subprocess.Popen(
        argv,
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,
        shell=False,
    )
    try:
        stdout_bytes, stderr_bytes = proc.communicate(timeout=timeout)
        exit_code = proc.returncode
    except subprocess.TimeoutExpired:
        proc.kill()
        proc.wait()
        stdout_bytes, stderr_bytes = proc.communicate()
        exit_code = 124

    stdout = stdout_bytes.decode("utf-8", errors="replace") if stdout_bytes else ""
    stderr = stderr_bytes.decode("utf-8", errors="replace") if stderr_bytes else ""

    output = f"exit={exit_code}\n--- stdout ---\n{stdout}--- stderr ---\n{stderr}"

    if len(output) > 50000:
        output = output[:50000] + "... [truncated]"

    return output


def main():
    parser = argparse.ArgumentParser(
        description="Run commands inside ephemeral containers",
        formatter_class=argparse.RawDescriptionHelpFormatter,
    )
    parser.add_argument("--image", default="debian:stable-slim")
    parser.add_argument("--timeout", type=int, default=60)
    parser.add_argument(
        "--network", choices=["none", "bridge"], default="none"
    )
    parser.add_argument("--memory", default="2g")
    parser.add_argument("--pids", type=int, default=512)
    parser.add_argument("--cpus", type=float, default=2.0)
    parser.add_argument(
        "--workspace", default=os.getcwd()
    )
    parser.add_argument(
        "--",
        dest="separator",
        action="store_true",
        help="Separator between flags and command",
    )
    parser.add_argument("command", nargs="+")

    args = parser.parse_args()

    cmd_str = " ".join(args.command)

    result = sandbox_run(
        command=cmd_str,
        workspace=args.workspace,
        image=args.image,
        timeout=args.timeout,
        network=args.network,
        memory=args.memory,
        pids=args.pids,
        cpus=args.cpus,
    )

    print(result)

    exit_match = result.split("\n")[0]
    exit_code = int(exit_match.split("=")[1])
    sys.exit(exit_code)


if __name__ == "__main__":
    main()
↑