# LAB 2: Point your agent at the box

Goal: your coding agent writes code, and that code runs inside the sandbox from Lab 1.
Never on your host. Time: about 30 minutes.

Works with Claude Code, Cline, Aider, or any agent that can run shell commands. Your ticket
includes z.ai + Claude Code for the session. Ask a host if you need the session access.

## Steps

1. First see the pattern with no agent at all. Run:
   ```
   python examples/05_agent_in_the_box.py
   ```
   Read what it prints. A canned "agent" step writes code as a string. The harness executes
   that string ONLY inside a throwaway container. That is the whole architecture.
2. Open `examples/05_agent_in_the_box.py` in your editor. Find the line where the code
   string goes into the container. Notice the host never calls `exec()` or `eval()`.
3. Now wire your real agent to the same rule. Tell it in plain words. Paste this into your
   agent's instructions (CLAUDE.md for Claude Code, custom instructions for Cline or Aider):
   ```
   Never run generated code directly on the host.
   To execute any code you write, wrap it exactly like this:
   docker run --rm --network none --memory 256m python:3.11-slim python -c "<the code>"
   ```
4. Give the agent a small task. For example: "write a function that reverses a string and
   run it on the word sandbox". Watch which command it actually runs.
5. Verify the isolation. Ask the agent to run code that tries to read a file that only
   exists on YOUR machine, for example `open('/Users/<you>/.ssh/id_rsa').read()` or
   `open('C:/Users/<you>/Documents').read()`. It fails with FileNotFoundError from inside
   the box. One nuance the first cohort found live: `/etc/passwd` does NOT fail — the
   container has its own `/etc/passwd` and happily returns it. That still proves you are
   reading the box's filesystem, but a host-only path is the sharper "cannot reach my
   machine" probe. Use both if you want the full picture.
6. If your laptop has no Docker, use the e2b path instead: the same instruction, but the
   agent calls `python examples/02_e2b_sandbox.py` style execution with the workshop key.

**CHECKPOINT:** you know it worked when your agent completes the task, the command it ran
starts with `docker run --rm` (or goes through e2b), and the host-file probe in step 5
fails with an error from inside the sandbox, not from your machine.