mirror of
https://github.com/docker/docker-agent.git
synced 2026-11-04 10:02:15 +00:00
74 lines
2.8 KiB
YAML
74 lines
2.8 KiB
YAML
# Demonstrates allow_list / deny_list for the filesystem tool.
|
|
#
|
|
# By default the filesystem toolset is unrestricted: relative paths resolve
|
|
# from the working directory, but the tools will happily read or write
|
|
# absolute paths (or `..` traversals) anywhere the agent process can reach.
|
|
# That is fine for local development but a footgun when running an agent on
|
|
# someone else's behalf.
|
|
#
|
|
# Configure `allow_list` to limit operations to a fixed set of roots, and/or
|
|
# `deny_list` to carve specific subtrees out. Tokens are expanded as follows:
|
|
#
|
|
# "." -> the agent's working directory
|
|
# "~" -> the user's home directory
|
|
# "~/foo" -> $HOME/foo
|
|
# "${env.VAR}" -> environment variable (canonical; "$VAR" / "${VAR}" also work)
|
|
# absolute -> used as-is
|
|
# relative -> joined with the working directory
|
|
#
|
|
# Symlinks are resolved before the containment check, so a symlink inside an
|
|
# allowed root cannot be used to escape it.
|
|
#
|
|
# Switch agents with `-a <name>` to try each variant.
|
|
|
|
agents:
|
|
# Strict variant: only the working directory and the user's home are
|
|
# reachable, and the SSH/AWS credential directories are explicitly off-limits
|
|
# even though they live under the home directory.
|
|
root:
|
|
model: anthropic/claude-sonnet-4-5
|
|
description: A filesystem agent restricted to its working directory and home folder.
|
|
instruction: |
|
|
You may read and write files under the current working directory and
|
|
under the user's home directory, except for the credentials folders
|
|
(~/.ssh, ~/.aws). If asked to touch a path outside that scope, refuse
|
|
and explain why.
|
|
toolsets:
|
|
- type: filesystem
|
|
allow_list:
|
|
- "."
|
|
- "~"
|
|
deny_list:
|
|
- "~/.ssh"
|
|
- "~/.aws"
|
|
- "~/.docker"
|
|
|
|
# Workspace-only variant: the agent can only see its own working tree.
|
|
workspace_only:
|
|
model: anthropic/claude-sonnet-4-5
|
|
description: A filesystem agent that cannot leave its working directory.
|
|
instruction: |
|
|
You may only read and write files inside the current working directory.
|
|
Refuse any request that would require touching files elsewhere on the
|
|
filesystem.
|
|
toolsets:
|
|
- type: filesystem
|
|
allow_list:
|
|
- "."
|
|
|
|
# Deny-only variant: keeps the default permissive behaviour but explicitly
|
|
# forbids a few sensitive directories.
|
|
guarded:
|
|
model: anthropic/claude-sonnet-4-5
|
|
description: A filesystem agent with a small set of off-limits directories.
|
|
instruction: |
|
|
You have broad filesystem access, but a few directories are off-limits.
|
|
If a request is rejected, do not retry and explain the situation to the
|
|
user.
|
|
toolsets:
|
|
- type: filesystem
|
|
deny_list:
|
|
- "~/.ssh"
|
|
- "~/.aws"
|
|
- "/etc"
|