den.example.yaml

server:
  host: "0.0.0.0"
  port: 8080
  tls:
    enabled: false
    cert_file: ""
    key_file: ""

runtime:
  backend: "docker"
  # docker_host is INERT: it has NO effect. The Docker endpoint is controlled
  # solely by the DOCKER_HOST environment variable. Kept only for config
  # backward-compatibility; den logs a WARN if it is set.
  docker_host: ""
  network_id: "den-net"

  # default_network_mode is the global default posture for every sandbox.
  #   internal : den-net with Internal:true. No egress, no host port publishing.
  #              NOT a tenant boundary — a sandbox still reaches the bridge
  #              gateway, the embedded DNS resolver (127.0.0.11) and any host
  #              service bound to 0.0.0.0. The bind guard only closes the
  #              unauthenticated-control-plane escape; nothing else is contained.
  #   bridge   : den-net with Internal:false. Egress + 127.0.0.1 port publishing
  #              work. Unfiltered: reaches RFC1918, link-local metadata and any
  #              host service. REFUSES to start unless allow_unsafe_bridge=true.
  #   none     : no network at all. The ONLY tenant/egress boundary in v1.
  # Per-sandbox network_mode may only be "" (inherit) or "none" (more
  # isolation) — it can only INCREASE isolation, never decrease it.
  default_network_mode: "internal"

  # reconcile_network: opt-in operator-initiated, spoof-resistant network
  # reconciliation when default_network_mode changes between restarts. Off by
  # default (a mode change is otherwise a no-op on the existing network).
  reconcile_network: false

  # allow_unsafe_bridge MUST be true to start with default_network_mode=bridge.
  # There is NO egress filter in v1: every bridge sandbox gets NAT'd, unfiltered
  # egress. Leave false unless you accept that.
  allow_unsafe_bridge: false

  # allow_unsafe_bind is the dangerous last-resort opt-in that DISABLES the
  # startup bind guard entirely. The bind guard refuses to start when the
  # unauthenticated HTTP control plane would be reachable from sandboxes on a
  # host that is not machine-detectably safe. Setting this true exposes the den
  # API to sandboxes (host escalation path). den logs an ERROR every start.
  # Prefer auth.enabled=true, or default_network_mode=none, or platform_override.
  allow_unsafe_bind: false

  # platform_override is the co-residency attestation. Accepted values are
  # EXACTLY "" (default) or the single literal "linux-native-docker-co-resident"
  # (any other value is a fatal config error). When set to the literal the
  # operator attests the Docker socket is local AND co-resident with the bridge
  # gateway and this den process. It (a) unlocks the bind guard's loopback
  # branch and (b) is logged at ERROR every start. It is VOID if the local
  # unix:// socket is itself proxied to a remote/VM daemon (socat / ssh -L /
  # docker-context / bind-mounted sibling socket) — in that case the
  # unauthenticated control plane is exposed. Risk-equivalent to bypassing the
  # platform classifier.
  platform_override: ""

sandbox:
  default_image: "den/default:latest"
  default_timeout: "30m"
  max_sandboxes: 50
  default_cpu: 1000000000 # 1 core (in NanoCPUs)
  default_memory: 536870912 # 512MB
  default_pid_limit: 256
  warm_pool_size: 0
  allow_volumes: true
  allow_shared_volumes: true
  allow_s3: true
  allow_s3_fuse: false          # Requires SYS_ADMIN capability
  allow_host_binds: false       # Never enable in production
  max_volumes_per_sandbox: 5
  default_tmpfs:
    - path: "/tmp"
      size: "256m"
    - path: "/home/sandbox"
      size: "512m"
    - path: "/run"
      size: "64m"
    - path: "/var/tmp"
      size: "128m"

store:
  path: "den.db"

auth:
  enabled: false
  api_keys:
    - "your-api-key-here"

log:
  level: "info" # debug, info, warn, error
  format: "text" # text, json

s3:
  endpoint: ""                  # S3-compatible endpoint (e.g. "http://localhost:9000" for MinIO)
  region: "us-east-1"
  access_key: ""
  secret_key: ""
  # allow_internal_endpoint: opt the SINGLE endpoint above back into
  # loopback / RFC1918 / CGNAT reachability so a self-hosted MinIO on
  # localhost or the LAN works. Default false: the SSRF guard blocks every
  # internal range. When true the exemption is PINNED to this endpoint's
  # construction-time resolved IP set (no DNS rebinding) and per-sandbox
  # endpoint overrides are refused. Cloud-metadata, link-local, multicast
  # and unspecified addresses are NEVER reachable regardless of this flag.
  # Env: DEN_S3__ALLOW_INTERNAL_ENDPOINT=true
  allow_internal_endpoint: false