Lesson 6 · 14 min
Approval decides whether a command can start; the sandbox executor decides where it runs. Docker uses an image, the sandbox template, to create an isolated container. Only the workspace is mounted at /trabalho, with no network or terminal variables (named values, such as keys stored in that session). Exit code 0 means the command finished without errors.
Start the lesson
Objective: Run a read-only command with the sandbox executor and find “[in sandbox, exit code 0]” in the response.
The sandbox is optional and applies to each INTELECTO command.
Click each part to see what it does.
Click each step to see what to do.
Only ~/.intelecto2/area is mounted as the workspace at /trabalho. The vault, ~/.ssh, and other personal folders are not mounted.
The Docker command uses --network none: a task that depends on the internet will not work in this executor. On Ubuntu, install the docker.io package, give your user access, and sign out and back in. On macOS, install Docker Desktop from docker.com. Check with hello-world before the conversation.
The code sets limits for memory, CPU, processes, time, and maximum output. This reduces the damage from an error, but a container is not a virtual machine.
Ollama responds outside the container. The sandbox isolates the command the assistant runs, not the entire conversation process.
Ubuntu: install the docker.io package, sign out and back in, then verify with hello-world. On macOS, install Docker Desktop from docker.com, then run the same hello-world command. The official Docker manual is in the extra links.
sudo apt install -y docker.io sudo usermod -aG docker $USER # Sign out and back in before testing.
https://www.docker.com/products/docker-desktop/
docker run --rm hello-world
docker pull python:3.12-slim
echo oi > ~/.intelecto2/area/teste.txt
cd ~/intelecto-v2 python3 -m intelecto conversar --provedor mock --executor caixa
rode: ls /trabalho rode: pwd
python3 -m intelecto auditoria -n 20
intelecto> Feito. Resultado de rodar_comando: [na caixa, saída 0] /trabalho
Captured with --executor caixa and a mock brain. With a real model, the surrounding text changes; look for [na caixa, saída 0] /trabalho.
The program prints this in Portuguese, exactly as shown.
Follow the steps in order and check each one only after you’ve confirmed the result.
With Docker running, open the conversation with --provedor mock --executor caixa and ask “rode: pwd”. The mock calls rodar_comando. If you use a real model, count it as proof only if it calls the tool.
Done when: The output contains “[na caixa, saída 0] /trabalho” on one line; this proves the command ran inside the box.
Before comparing, run echo oi > ~/.intelecto2/area/teste.txt in the terminal. In the conversation with executor caixa, ask “rode: ls /trabalho”. Also check the audit log. Don’t copy passwords into the work area.
Done when: The ls /trabalho response shows teste.txt, the file created in your work area; the audit log records the command.
Choose before opening the explanation. If you get it wrong, use the link to review.
Question 1 of 3
What part of the operation does the box executor isolate?
Question 2 of 3
Which Docker option disables networking?
Question 3 of 3
What does exit 0 mean on the label?
Choose an option. The explanation appears after your attempt.