container_shell: isolated network by default, plus optional network transport

src/seclab_taskflows/mcp_servers/container_shell.py

@@ -30,6 +30,12 @@
 CONTAINER_TIMEOUT = int(os.environ.get("CONTAINER_TIMEOUT", "30"))
 CONTAINER_PERSIST = os.environ.get("CONTAINER_PERSIST", "").lower() in ("1", "true", "yes")
 CONTAINER_PERSIST_KEY = os.environ.get("CONTAINER_PERSIST_KEY", "")
+# Docker network mode for the container. Defaults to "none" so containers are
+# egress-locked (no network access) unless a caller explicitly opts in by
+# setting CONTAINER_NETWORK to a network name such as "bridge", "host", or a
+# user-defined network. An empty or whitespace-only value falls back to "none"
+# so the isolation default cannot be silently disabled by an unset variable.
+CONTAINER_NETWORK = os.environ.get("CONTAINER_NETWORK", "none").strip() or "none"
 
 _DEFAULT_WORKDIR = "/workspace"
 _DOCKER_TIMEOUT = 30
@@ -106,7 +112,7 @@ def _start_container() -> str:
     else:
         name = f"seclab-shell-{uuid.uuid4().hex[:8]}"
 
-    cmd = ["docker", "run", "-d", "--name", name]
+    cmd = ["docker", "run", "-d", "--name", name, "--network", CONTAINER_NETWORK]
     if not CONTAINER_PERSIST:
         cmd.append("--rm")
     if CONTAINER_WORKSPACE:

src/seclab_taskflows/toolboxes/container_shell_base.yaml

@@ -15,6 +15,7 @@ server_params:
     CONTAINER_TIMEOUT: "{{ env('CONTAINER_TIMEOUT', '30') }}"
     CONTAINER_PERSIST: "{{ env('CONTAINER_PERSIST', required=False) }}"
     CONTAINER_PERSIST_KEY: "{{ env('CONTAINER_PERSIST_KEY', required=False) }}"
+    CONTAINER_NETWORK: "{{ env('CONTAINER_NETWORK', required=False) }}"
     LOG_DIR: "{{ env('LOG_DIR') }}"
 
 confirm:

src/seclab_taskflows/toolboxes/container_shell_malware_analysis.yaml

@@ -15,6 +15,7 @@ server_params:
     CONTAINER_TIMEOUT: "{{ env('CONTAINER_TIMEOUT', '60') }}"
     CONTAINER_PERSIST: "{{ env('CONTAINER_PERSIST', required=False) }}"
     CONTAINER_PERSIST_KEY: "{{ env('CONTAINER_PERSIST_KEY', required=False) }}"
+    CONTAINER_NETWORK: "{{ env('CONTAINER_NETWORK', required=False) }}"
     LOG_DIR: "{{ env('LOG_DIR') }}"
 
 confirm:

src/seclab_taskflows/toolboxes/container_shell_network_analysis.yaml

@@ -15,6 +15,7 @@ server_params:
     CONTAINER_TIMEOUT: "{{ env('CONTAINER_TIMEOUT', '30') }}"
     CONTAINER_PERSIST: "{{ env('CONTAINER_PERSIST', required=False) }}"
     CONTAINER_PERSIST_KEY: "{{ env('CONTAINER_PERSIST_KEY', required=False) }}"
+    CONTAINER_NETWORK: "{{ env('CONTAINER_NETWORK', 'bridge') }}"
     LOG_DIR: "{{ env('LOG_DIR') }}"
 
 confirm:

src/seclab_taskflows/toolboxes/container_shell_sast.yaml

@@ -15,6 +15,7 @@ server_params:
     CONTAINER_TIMEOUT: "{{ env('CONTAINER_TIMEOUT', '60') }}"
     CONTAINER_PERSIST: "{{ env('CONTAINER_PERSIST', required=False) }}"
     CONTAINER_PERSIST_KEY: "{{ env('CONTAINER_PERSIST_KEY', required=False) }}"
+    CONTAINER_NETWORK: "{{ env('CONTAINER_NETWORK', required=False) }}"
     LOG_DIR: "{{ env('LOG_DIR') }}"
 
 confirm:

tests/test_container_shell.py

@@ -2,6 +2,7 @@
 # SPDX-License-Identifier: MIT
 
 import subprocess
+import importlib
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -89,6 +90,47 @@ def test_start_container_rejects_empty_image(self):
             with pytest.raises(RuntimeError, match="CONTAINER_IMAGE is not set"):
                 cs_mod._start_container()
 
+    def test_start_container_default_network_none(self):
+        with (
+            patch.object(cs_mod, "CONTAINER_IMAGE", "test-image:latest"),
+            patch.object(cs_mod, "CONTAINER_WORKSPACE", ""),
+            patch.object(cs_mod, "CONTAINER_NETWORK", "none"),
+            patch("subprocess.run", return_value=_make_proc(returncode=0)) as mock_run,
+        ):
+            cs_mod._start_container()
+            cmd = mock_run.call_args[0][0]
+            assert "--network" in cmd
+            assert cmd[cmd.index("--network") + 1] == "none"
+
+    def test_start_container_opt_in_network(self):
+        with (
+            patch.object(cs_mod, "CONTAINER_IMAGE", "test-image:latest"),
+            patch.object(cs_mod, "CONTAINER_WORKSPACE", ""),
+            patch.object(cs_mod, "CONTAINER_NETWORK", "bridge"),
+            patch("subprocess.run", return_value=_make_proc(returncode=0)) as mock_run,
+        ):
+            cs_mod._start_container()
+            cmd = mock_run.call_args[0][0]
+            assert "--network" in cmd
+            assert cmd[cmd.index("--network") + 1] == "bridge"
+
+    def test_network_defaults_to_none_when_unset(self, monkeypatch):
+        monkeypatch.delenv("CONTAINER_NETWORK", raising=False)
+        reloaded = importlib.reload(cs_mod)
+        try:
+            assert reloaded.CONTAINER_NETWORK == "none"
+        finally:
+            importlib.reload(cs_mod)
+
+    def test_network_falls_back_to_none_when_blank(self, monkeypatch):
+        monkeypatch.setenv("CONTAINER_NETWORK", "   ")
+        reloaded = importlib.reload(cs_mod)
+        try:
+            assert reloaded.CONTAINER_NETWORK == "none"
+        finally:
+            monkeypatch.delenv("CONTAINER_NETWORK", raising=False)
+            importlib.reload(cs_mod)
+
 
 # ---------------------------------------------------------------------------
 # shell_exec tests