Create Docker Sandbox for Autonomous Agents

Hi, just saw this issue about sandboxing for autonomous agents. I wonder if it could work in more of a per-action way.

I've been working on a lightweight runtime that runs untrusted code in WebAssembly sandboxes. Might be a good fit here.

For example, in your agent workflow:

import { run } from '@capsule-run/sdk/runner';

const result = await run({
    file: './sandbox.ts',
    args: [downloadedCode]
});

And in sandbox.ts:

import { task } from "@capsule-run/sdk";

export const executeCode = task({
  name: "execute_code",
  compute: "MEDIUM",
  timeout: "30s"
}, (code: string) => {
  // Your code runs safely in a Wasm sandbox
  return eval(code);
});
export const main = task({
  name: "main", 
  compute: "HIGH"
}, async (code: string) => {
  return executeCode(code);
});

Each task runs in its own Wasm sandbox with configurable CPU and memory limits, timeouts, and filesystem access only if explicitly granted.

I think it could help for the parts where agents execute downloaded code, as a complementary approach to Docker maybe.

There's more info in the repo if you're curious: https://github.com/mavdol/capsule

Would love to hear your thoughts on whether this fits Neo's architecture!