HCAT Sandbox: Hardened SHA-Pinned Dockerfile for Autonomous Turns

[kingdonb]

Summary

Create a hardened, SHA-pinned Dockerfile to serve as the execution environment for autonomous agent turns (HCAT).

Business Value

Crucial for the security of Goal 1. By executing headless turns inside an ephemeral, isolated container, we prevent agents from accidentally modifying the host environment, accessing unauthorized local LAN services, or reading unencrypted SSH/env keys from the host disk.

Requirements

• Create docker/hcat.Dockerfile.
• Base the image on a minimal, secure OS (e.g., Alpine or distroless).
• Strict Pinning: The base image MUST be pinned by its SHA256 digest, not just a tag like :latest or :3.19.
• Install only the necessary dependencies (Python, uv, Git).
• Configure the container to run as a non-root user.
• Ensure the container has no network access to the local LAN (only outbound internet for APIs).

Deliverables

• docker/hcat.Dockerfile implementation.
• A script scripts/build_hcat.sh to build the image locally and verify its digest.

---

Labels: security, autonomous, goal-1, infrastructure