feat(v1): DockerConfig.network_access to block the workload's internet

Adds `network_access: bool = True` to DockerConfig (mirroring prime/modal, so
`--harness.runtime.network-access false` now works uniformly across all three
runtimes). When false, the container's DNS resolver is disabled so every
hostname-based fetch (pip install, git clone, curl <host>) fails — while the
interception model tunnel keeps working, because it egresses from the HOST, not
the container: the container only reaches host.docker.internal / host loopback,
which needs no DNS.

Platform-specific (matching the existing host_url() split):
- Docker Desktop (macOS/Windows): drop --network host for the bridge, add
  --dns 0.0.0.0 and --add-host=host.docker.internal:host-gateway (host route
  pinned in /etc/hosts, resolves without DNS).
- Linux: keep --network host (interception is reachable at 127.0.0.1) and add
  --dns 0.0.0.0. --dns writes a container-private resolv.conf, so the host's own
  DNS is untouched.

A DNS-level block, not an IP-level airgap: a hardcoded raw IP could still egress;
use an iptables egress allowlist if that matters.

Verified end-to-end: a local-docker eval with --harness.runtime.network-access
false solves a task (reward 1.0, 59 model calls over the tunnel) while pip/git to
public hosts fail from inside the container.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: eligotts

tests/v1/test_docker_runtime.py

@@ -0,0 +1,40 @@
+"""DockerRuntime network-arg construction: the `network_access=False` isolation is
+platform-specific, so pin both branches (pure logic, no docker daemon needed)."""
+
+import verifiers.v1.runtimes.docker as docker_mod
+from verifiers.v1.runtimes.docker import DockerConfig, DockerRuntime
+
+
+def _args(network_access: bool, platform: str, monkeypatch) -> list[str]:
+    monkeypatch.setattr(docker_mod.sys, "platform", platform)
+    return DockerRuntime(DockerConfig(network_access=network_access))._network_args()
+
+
+def test_network_access_default_is_on() -> None:
+    assert DockerConfig().network_access is True
+
+
+def test_access_on_uses_host_networking(monkeypatch) -> None:
+    for platform in ("linux", "darwin", "win32"):
+        assert _args(True, platform, monkeypatch) == ["--network", "host"]
+
+
+def test_blocked_linux_keeps_host_net_and_kills_dns(monkeypatch) -> None:
+    # host netns already reaches the interception at 127.0.0.1; only DNS is broken
+    assert _args(False, "linux", monkeypatch) == [
+        "--network",
+        "host",
+        "--dns",
+        "0.0.0.0",
+    ]
+
+
+def test_blocked_docker_desktop_uses_bridge_and_pins_host(monkeypatch) -> None:
+    # Docker Desktop VM: bridge + dead DNS + host.docker.internal pinned (resolves w/o DNS)
+    for platform in ("darwin", "win32"):
+        assert _args(False, platform, monkeypatch) == [
+            "--dns",
+            "0.0.0.0",
+            "--add-host",
+            "host.docker.internal:host-gateway",
+        ]

verifiers/v1/runtimes/docker.py

@@ -38,6 +38,13 @@ class DockerConfig(BaseConfig):
     disk: float | None = None
     """Advisory disk request in GB. Docker has no portable per-container size limit, so
     this is accepted (so a task can declare it without a warning) but not enforced."""
+    network_access: bool = True
+    """Whether the workload can reach the internet. When False, the container's DNS resolver
+    is disabled, so every hostname-based fetch (pip, git clone, curl <host>) fails — while the
+    interception model tunnel keeps working, because it egresses from the HOST, not the
+    container: the container only reaches `host.docker.internal` / host loopback, which needs
+    no DNS. This is a DNS-level block, not an IP-level airgap (a hardcoded raw IP could still
+    egress). Mirrors prime/modal's `network_access`, except those sever the tunnel too."""
 
 
 class DockerRuntimeInfo(DockerConfig, BaseRuntimeInfo):
@@ -98,8 +105,7 @@ async def start(self) -> None:
         run = await docker(
             "run",
             "--detach",
-            "--network",
-            "host",
+            *self._network_args(),
             *limits,
             "--workdir",
             self.config.workdir,
@@ -115,11 +121,27 @@ async def start(self) -> None:
             :12
         ]  # `docker run -d` prints the container id
         logger.info(
-            "docker: started container %s (image=%s)",
+            "docker: started container %s (image=%s%s)",
             self._container,
             self.config.image,
+            "" if self.config.network_access else ", internet blocked",
         )
 
+    def _network_args(self) -> list[str]:
+        """`docker run` networking args. Default: host networking. With network_access=False,
+        block the workload's internet with a dead DNS resolver (hostname fetches fail) while
+        keeping the host route the model tunnel needs — DNS-less, so it survives the block."""
+        if self.config.network_access:
+            return ["--network", "host"]
+        if sys.platform == "linux":
+            # Host netns already reaches the interception at 127.0.0.1; only break DNS. --dns
+            # writes a container-private resolv.conf, so the host's own DNS is untouched.
+            return ["--network", "host", "--dns", "0.0.0.0"]
+        # Docker Desktop VM: --network host can't reach host loopback, so use the bridge and
+        # pin host.docker.internal into /etc/hosts (resolves without DNS); host_url() already
+        # points the tunnel there on non-Linux.
+        return ["--dns", "0.0.0.0", "--add-host", "host.docker.internal:host-gateway"]
+
     def host_url(self, url: str) -> str:
         # Docker Desktop (macOS/Windows) runs containers in a VM, so `--network host`
         # doesn't reach the host's loopback; `host.docker.internal` does.