v0.32.2: sandbox network hardening + API key environ clearing

Sandbox network:
- Default changed from bridge to none (most secure)
- buildSandboxArgs rejects 'host' mode — forces 'none' + stderr warning
- Flag docs, env docs, config examples, serve.go, SANDBOXING.md,
  CLI.md, CHEATSHEET.md all updated

API key handling:
- LoadConfig clears ODEK_API_KEY, DEEPSEEK_API_KEY, OPENAI_API_KEY
  from environ after resolving — prevents exposure via /proc/pid/environ

2 new tests: TestBuildSandboxArgs_RejectsHostNetwork,
TestLoadConfig_ClearsAPIKeyFromEnviron

Author: molty3000

cmd/odek/main.go

@@ -293,7 +293,7 @@ type runFlags struct {
 
 	// Sandbox-specific CLI flags
 	SandboxImage    string // Docker image (e.g. "node:20-alpine")
-	SandboxNetwork  string // Network mode: "bridge" | "none" | "host"
+	SandboxNetwork  string // Network mode: "none" | "bridge" | "host"
 	SandboxMemory   string // Memory limit (e.g. "512m", "2g")
 	SandboxCPUs     string // CPU limit (e.g. "0.5", "2")
 	SandboxUser     string // Container user (e.g. "1000:1000")
@@ -552,7 +552,7 @@ Skill commands:
 Sandbox flags:
   --sandbox            Run in isolated Docker container
   --sandbox-image <img>  Docker image (default: alpine:latest)
-  --sandbox-network <m>  Network mode: bridge (default) | none | host
+  --sandbox-network <m>  Network mode: none (default) | bridge | host
   --sandbox-readonly   Mount working directory read-only
   --sandbox-memory <s> Memory limit (e.g. 512m, 2g)
   --sandbox-cpus <n>   CPU limit (e.g. 0.5, 2, 4)
@@ -575,7 +575,7 @@ Environment variables:
   ODEK_NO_AGENTS       true/false — skip AGENTS.md
   ODEK_SYSTEM          System prompt override
   ODEK_SANDBOX_IMAGE   Docker image for sandbox container
-  ODEK_SANDBOX_NETWORK Network mode (bridge | none | host)
+  ODEK_SANDBOX_NETWORK Network mode (none | bridge | host)
   ODEK_SANDBOX_READONLY true/false — mount read-only
   ODEK_SANDBOX_MEMORY  Memory limit (e.g. 512m, 2g)
   ODEK_SANDBOX_CPUS    CPU limit (e.g. 0.5, 2)
@@ -596,7 +596,7 @@ const defaultConfigTemplate = `{
   "system": "",
   "github_repo_directory": "",
   "sandbox_image": "",
-  "sandbox_network": "bridge",
+  "sandbox_network": "none",
   "sandbox_readonly": false,
   "sandbox_memory": "",
   "sandbox_cpus": "",
@@ -722,7 +722,7 @@ func initConfig(args []string) error {
 	fmt.Println("    system          System prompt override")
 	fmt.Println("    github_repo_directory  Local clone path of the project repo")
 	fmt.Println("    sandbox_image   Docker image (alpine:latest if empty)")
-	fmt.Println("    sandbox_network Network mode (bridge | none | host)")
+	fmt.Println("    sandbox_network Network mode (none | bridge | host)")
 	fmt.Println("    sandbox_readonly Mount working directory read-only")
 	fmt.Println("    sandbox_memory  Memory limit (e.g. 512m, 2g)")
 	fmt.Println("    sandbox_cpus    CPU limit (e.g. 0.5, 2)")
@@ -1130,8 +1130,14 @@ func buildSandboxArgs(cfg sandboxConfig, containerName, workdir, image string) [
 		"--security-opt", "no-new-privileges",
 	}
 
-	// Network mode
-	args = append(args, "--network", cfg.Network)
+	// Network mode — "host" is forbidden (destroys container isolation).
+	// If explicitly set to "host", warn and force "none".
+	network := cfg.Network
+	if network == "host" {
+		fmt.Fprintf(os.Stderr, "odek: WARNING: --sandbox-network host destroys container isolation. Forcing 'none'.\n")
+		network = "none"
+	}
+	args = append(args, "--network", network)
 
 	// Read-only mount?
 	volume := workdir + ":/workspace"

cmd/odek/main_test.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -1888,6 +1889,36 @@ func TestBuildSandboxArgs_ValidVolume(t *testing.T) {
 	}
 }
 
+// TestBuildSandboxArgs_RejectsHostNetwork verifies that --sandbox-network host
+// is rejected and replaced with "none", protecting container isolation.
+func TestBuildSandboxArgs_RejectsHostNetwork(t *testing.T) {
+	origStderr := os.Stderr
+	r, w, _ := os.Pipe()
+	os.Stderr = w
+
+	cfg := sandboxConfig{Network: "host"}
+	args := buildSandboxArgs(cfg, "odek-test", "/workspace", "alpine:latest")
+
+	w.Close()
+	var buf bytes.Buffer
+	io.Copy(&buf, r)
+	os.Stderr = origStderr
+	stderr := buf.String()
+
+	hostFound := false
+	for i, a := range args {
+		if a == "--network" && i+1 < len(args) && args[i+1] == "host" {
+			hostFound = true
+		}
+	}
+	if hostFound {
+		t.Error("--network host was NOT rejected — isolation destroyed")
+	}
+	if !strings.Contains(stderr, "WARNING") || !strings.Contains(stderr, "host") {
+		t.Errorf("expected stderr warning about host network, got: %s", stderr)
+	}
+}
+
 // ── loadMCPTools Tests ────────────────────────────────────────────────
 
 func TestLoadMCPTools_EmptyServers(t *testing.T) {

cmd/odek/serve.go

@@ -150,7 +150,7 @@ Flags:
   --open                   Open browser automatically
   --sandbox                Enable Docker sandbox for agent tool execution
   --sandbox-image image    Docker image (default: alpine:latest or Dockerfile.odek)
-  --sandbox-network net    Docker network mode (default: bridge)
+  --sandbox-network net    Docker network mode (default: none)
   --sandbox-readonly       Mount working directory read-only
   --sandbox-memory limit   Container memory limit (e.g. 512m, 2g)
   --sandbox-cpus limit     Container CPU limit (e.g. 0.5, 2, 4)

docs/CHEATSHEET.md

@@ -27,7 +27,7 @@ odek repl --sandbox --sandbox-image python:3.12
   "max_iterations": 30,
   "sandbox": true,
   "sandbox_image": "alpine:latest",
-  "sandbox_network": "bridge",
+  "sandbox_network": "none",
   "max_concurrency": 3,
 
   "skills": {

docs/CLI.md

@@ -250,7 +250,7 @@ Use `odek skill reset-skips` to clear the skip list and re-enable suppressed sug
 | Flag | Default | Description |
 |------|---------|-------------|
 | `--sandbox-image <img>` | `alpine:latest` | Docker image |
-| `--sandbox-network <mode>` | `bridge` | Network: `bridge`/`none`/`host` |
+| `--sandbox-network <mode>` | `none` | Network: `none`/`bridge`/`host` |
 | `--sandbox-readonly` | false | Mount working directory read-only |
 | `--sandbox-memory <s>` | — | Memory limit (e.g. `512m`, `2g`) |
 | `--sandbox-cpus <n>` | — | CPU limit (e.g. `0.5`, `2`) |

docs/SANDBOXING.md

@@ -5,9 +5,12 @@ odek runs agent shell commands inside an **isolated Docker container** when `--s
 ## Quick start
 
 ```bash
-# Enable sandbox with internet access (default network: bridge)
+# Enable sandbox with no network (default: none)
 odek run --sandbox "npm install && npm test"
 
+# Enable sandbox with internet access
+odek run --sandbox --sandbox-network bridge "npm install && npm test"
+
 # Use a specific base image
 odek run --sandbox --sandbox-image node:20-alpine "echo hello"
 
@@ -28,7 +31,7 @@ All sandbox settings are available in `~/.odek/config.json`, `./kode.json`, `ODE
 {
   "sandbox": true,
   "sandbox_image": "node:20-alpine",
-  "sandbox_network": "bridge",
+  "sandbox_network": "none",
   "sandbox_readonly": false,
   "sandbox_memory": "512m",
   "sandbox_cpus": "2",
@@ -49,7 +52,7 @@ All sandbox settings are available in `~/.odek/config.json`, `./kode.json`, `ODE
 |-------|---------|----------|------|---------|-------------|
 | `sandbox` | `ODEK_SANDBOX` | `--sandbox` | bool | `false` | Enable/disable sandbox isolation |
 | `sandbox_image` | `ODEK_SANDBOX_IMAGE` | `--sandbox-image` | string | `alpine:latest` | Docker image for the sandbox container |
-| `sandbox_network` | `ODEK_SANDBOX_NETWORK` | `--sandbox-network` | string | `bridge` | Docker network mode |
+| `sandbox_network` | `ODEK_SANDBOX_NETWORK` | `--sandbox-network` | string | `none` | Docker network mode |
 | `sandbox_readonly` | `ODEK_SANDBOX_READONLY` | `--sandbox-readonly` | bool | `false` | Mount working directory read-only |
 | `sandbox_memory` | `ODEK_SANDBOX_MEMORY` | `--sandbox-memory` | string | `""` | Memory limit (e.g. `512m`, `2g`) |
 | `sandbox_cpus` | `ODEK_SANDBOX_CPUS` | `--sandbox-cpus` | string | `""` | CPU limit (e.g. `0.5`, `2`) |
@@ -79,7 +82,7 @@ ODEK_SANDBOX_USER=1000:1000 \
 odek run \
   --sandbox \
   --sandbox-image node:20-alpine \
-  --sandbox-network bridge \
+  --sandbox-network none \
   --sandbox-readonly \
   --sandbox-memory 512m \
   --sandbox-cpus 2 \
@@ -221,7 +224,7 @@ odek's sandbox follows the principle of **least privilege with progressive opt-i
 {
   "sandbox": true,
   "sandbox_image": "node:20-alpine",
-  "sandbox_network": "bridge",
+  "sandbox_network": "none",
   "sandbox_readonly": false,
   "sandbox_memory": "2g",
   "sandbox_env": {
@@ -240,7 +243,7 @@ odek's sandbox follows the principle of **least privilege with progressive opt-i
 {
   "sandbox": true,
   "sandbox_image": "golang:1.24-alpine",
-  "sandbox_network": "bridge",
+  "sandbox_network": "none",
   "sandbox_readonly": false,
   "sandbox_memory": "4g",
   "sandbox_cpus": "4",

docs/SECURITY.md

@@ -52,17 +52,19 @@ Without `--sandbox`, the `shell` tool runs commands directly on the host with th
 With `--sandbox`, each session is fully contained in a Docker container:
 
 - **No filesystem access** beyond the working directory (mounted read-only if configured)
-- **No network** when `--sandbox-network none` is set
+- **No network by default** — `sandbox_network` defaults to `none`. `host` mode is rejected (forces `none` with a warning) to prevent bypassing isolation
 - **No capabilities** — even root inside the container has zero kernel capabilities
 - **No privilege escalation** — `setuid` binaries are neutered
 - **No persistence** — container destroyed on exit
 - **No executable temp files** — `/tmp` is mounted `noexec`
 
+Set `sandbox_network: bridge` explicitly if the agent needs outbound internet access (e.g. `npm install`).
+
 See [Sandboxing](SANDBOXING.md) for the full reference.
 
 ## API key handling
 
-API keys are read from environment variables or explicit config. odek never logs, stores, or transmits your key beyond the HTTPS request to the LLM endpoint.
+API keys are read from environment variables (`ODEK_API_KEY`, `DEEPSEEK_API_KEY`, `OPENAI_API_KEY`) or explicit config. After the key is resolved, the environment variables are **cleared** to prevent exposure via `/proc/<pid>/environ` — any process on the same machine can no longer read the key from the process environment. odek never logs, stores, or transmits your key beyond the HTTPS request to the LLM endpoint.
 
 ---
 

internal/config/loader.go

@@ -242,7 +242,7 @@ type ResolvedConfig struct {
 // ── Defaults ───────────────────────────────────────────────────────────
 
 const (
-	DefaultSandboxNetwork = "bridge"
+	DefaultSandboxNetwork = "none"
 )
 
 // ── Paths ──────────────────────────────────────────────────────────────
@@ -561,6 +561,12 @@ func LoadConfig(cli CLIFlags) ResolvedConfig {
 		resolved.APIKey = os.Getenv("OPENAI_API_KEY")
 	}
 
+	// Clear API key env vars to prevent exposure via /proc/pid/environ.
+	// The key is now in the Config struct; the environment shouldn't keep a copy.
+	os.Unsetenv("ODEK_API_KEY")
+	os.Unsetenv("DEEPSEEK_API_KEY")
+	os.Unsetenv("OPENAI_API_KEY")
+
 	return resolved
 }
 

internal/config/loader_test.go

@@ -691,3 +691,29 @@ func TestLoadConfig_MemoryNotSetReturnsDefaults(t *testing.T) {
 		t.Error("Enabled should match default")
 	}
 }
+
+func TestLoadConfig_ClearsAPIKeyFromEnviron(t *testing.T) {
+	os.Setenv("ODEK_API_KEY", "sk-odek-test")
+	os.Setenv("DEEPSEEK_API_KEY", "sk-deepseek-test")
+	os.Setenv("OPENAI_API_KEY", "sk-openai-test")
+
+	dir := t.TempDir()
+	prevHome := os.Getenv("HOME")
+	os.Setenv("HOME", dir)
+	defer os.Setenv("HOME", prevHome)
+
+	cfg := LoadConfig(CLIFlags{})
+
+	if cfg.APIKey != "sk-odek-test" {
+		t.Errorf("APIKey = %q, want 'sk-odek-test'", cfg.APIKey)
+	}
+	if v := os.Getenv("ODEK_API_KEY"); v != "" {
+		t.Errorf("ODEK_API_KEY should be cleared after LoadConfig, got %q", v)
+	}
+	if v := os.Getenv("DEEPSEEK_API_KEY"); v != "" {
+		t.Errorf("DEEPSEEK_API_KEY should be cleared after LoadConfig, got %q", v)
+	}
+	if v := os.Getenv("OPENAI_API_KEY"); v != "" {
+		t.Errorf("OPENAI_API_KEY should be cleared after LoadConfig, got %q", v)
+	}
+}