fix(sandbox): fail closed for unsupported Docker domain policies (#152)

The Docker backend currently turns any non-empty allowed_domains list into
unrestricted bridge networking even though no per-domain enforcement exists.
Keep Docker networking disabled and emit a warning until the backend can
actually honor domain policies.

Constraint: Preserve a small, reviewable fix instead of designing a full Docker egress filter
Rejected: Keep bridge networking with docs-only clarification | leaves silently overbroad behavior in place
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: If Docker domain policies are re-enabled later, add true enforcement before widening network access
Tested: PYTHONPATH=src pytest -q tests/test_sandbox/test_docker_backend.py tests/test_sandbox/test_adapter.py
Tested: PYTHONPATH=src ruff check src tests
Not-tested: Full pytest suite in this environment (collection fails because optional pyperclip dependency is missing)
Related: #150

src/openharness/sandbox/docker_backend.py

@@ -95,11 +95,16 @@ class DockerSandboxSession:
             self._container_name,
         ]
 
-        # Network isolation
-        if sandbox.network.allowed_domains:
-            argv.extend(["--network", "bridge"])
-        else:
-            argv.extend(["--network", "none"])
+        # Docker backend currently supports only fully disabled networking.
+        # Domain-level allow/deny policies exist for the srt backend, but Docker
+        # does not enforce them yet. Fail closed instead of silently widening
+        # egress to unrestricted bridge networking.
+        if sandbox.network.allowed_domains or sandbox.network.denied_domains:
+            logger.warning(
+                "Docker sandbox does not enforce allowed_domains/denied_domains yet; "
+                "keeping network disabled"
+            )
+        argv.extend(["--network", "none"])
 
         # Resource limits
         if docker_cfg.cpu_limit > 0:

tests/test_sandbox/test_docker_backend.py

@@ -134,7 +134,7 @@ def test_network_none_by_default(monkeypatch):
     assert argv[net_idx + 1] == "none"
 
 
-def test_network_bridge_when_domains_allowed(monkeypatch):
+def test_network_none_and_warning_when_domain_policy_is_configured(monkeypatch, caplog):
     monkeypatch.setattr(
         "openharness.sandbox.docker_backend.shutil.which",
         lambda name: "/usr/bin/docker",
@@ -143,7 +143,10 @@ def test_network_bridge_when_domains_allowed(monkeypatch):
         sandbox=SandboxSettings(
             enabled=True,
             backend="docker",
-            network=SandboxNetworkSettings(allowed_domains=["github.com"]),
+            network=SandboxNetworkSettings(
+                allowed_domains=["github.com"],
+                denied_domains=["example.com"],
+            ),
         )
     )
     session = DockerSandboxSession(settings=settings, session_id="abc", cwd=Path("/repo"))
@@ -151,7 +154,8 @@ def test_network_bridge_when_domains_allowed(monkeypatch):
     argv = session._build_run_argv()
 
     net_idx = argv.index("--network")
-    assert argv[net_idx + 1] == "bridge"
+    assert argv[net_idx + 1] == "none"
+    assert "does not enforce allowed_domains/denied_domains yet" in caplog.text
 
 
 def test_resource_limits_applied(monkeypatch):