Documentation Index

Fetch the complete documentation index at: https://docs.crewship.ai/llms.txt

Use this file to discover all available pages before exploring further.

​

Container Isolation

​

Isolation Layers

+-----------------------------------------------------------+
| Layer 5: Keeper (AI-powered credential gating)            |
+-----------------------------------------------------------+
| Layer 4: Network Policy (free/restricted domain filtering)|
+-----------------------------------------------------------+
| Layer 3: Sidecar Proxy (credential injection, scrubbing)  |
+-----------------------------------------------------------+
| Layer 2: UID Boundary (agent=1001, sidecar=1002)          |
+-----------------------------------------------------------+
| Layer 1: Container Runtime (Docker, gVisor, Kata, Sysbox) |
+-----------------------------------------------------------+

​

UID Security Boundary

​

What Agents Cannot Do

• Agents cannot read the sidecar’s in-memory credential store
• Agents cannot access the IPC token (used for crewshipd authentication)
• Agents cannot modify network policy configuration
• Agents cannot tamper with outbound request headers (the sidecar handles this)
• Agents cannot set their own container ID in Keeper execute requests

​

Container Runtime Security

container:
  default_runtime: "runsc"  # or "runc", "kata-runtime", "sysbox-runc"

​

Container Creation Security

• Cap-drop ALL: All Linux capabilities are dropped
• Cap-add NET_RAW: Re-added after dropping ALL (allows ICMP/ping for network diagnostics)
• SecurityOpt no-new-privileges: Blocks execution of setuid binaries inside the container
• Non-root execution: Agent processes run as UID 1001
• Read-only filesystem: System directories are read-only (ReadonlyRootfs: true)
• tmpfs /tmp (500M): Writable temp directory, not persistent across restarts
• PID limit: 200: Prevents fork bomb attacks (PidsLimit: 200)
• Memory limits: Configurable per-crew (default_memory_mb, default 512 MB)
• CPU limits: Configurable per-crew (default_cpus, default 1.0)
• Network isolation: Containers connect to a dedicated Docker bridge network
• ExtraHosts: host.docker.internal:host-gateway enables container-to-host communication
• Named volumes: crewship-home-{slug} and crewship-tools-{slug} for persistent home and tools directories

​

Network Policy

# No explicit network policy = free mode

{
  "mode": "restricted",
  "allowed_domains": ["github.com", "registry.npmjs.org"]
}

​

Domain Allowlist Implementation

• Domains are stored lowercase for case-insensitive matching
• Port numbers are stripped before comparison
• IPv6 bracket notation is handled correctly
• Domains can be added at runtime via allowlist.Add(domain)

​

Proxy Security

​

Request Body Limits

const maxRequestBodyBytes = 10 * 1024 * 1024 // 10 MB

​

Hop-by-Hop Header Stripping

​

HTTPS CONNECT Tunnels

1. Checks the domain allowlist (in restricted mode)
2. Establishes a TCP tunnel
3. Does not inject credentials (the tunnel is opaque)

• Plain HTTP proxy requests (agent sets HTTP_PROXY)
• Reverse proxy mode (ANTHROPIC_BASE_URL=http://127.0.0.1:9119)

​

Provider Detection

func providerForHost(host string) ProviderType {
    switch host {
    case "api.anthropic.com":    return ProviderAnthropic
    case "api.openai.com":       return ProviderOpenAI
    case "generativelanguage.googleapis.com": return ProviderGoogle
    default:                     return ""  // no injection
    }
}

​

Credential Injection by Provider

​

Keeper Execute Security

1. Sidecar validation:
   • Intent and command length limits (4096 chars)
   • Null byte rejection
   • Shell metacharacter blocking (;, |, `, >, &&, ||, $()
   • Content inside single quotes is exempt
   • Container ID always from IPC config (agent cannot override)
2. crewshipd validation:
   • Same shell metacharacter checks (defense in depth)
   • Keeper LLM evaluates the command
3. Execution:
   • Credential injected as environment variable for the command only
   • Output scrubbed of credential values before returning to agent

​

Output Scrubbing

• Credentials appearing in chat messages
• Credentials being logged to the progress stream
• Credentials in Keeper execute output being returned to the agent

​

Container Auto-Detection