ct111-dev/coder/templates/mcp-sandbox/README.md

mcp-sandbox

Ephemeral, minimalist Python sandbox for MCP-driven code execution (plotting, quick analysis, exfil-style external fetches with curl/wget/httpx).

What's baked in

• Debian slim + uv + Python 3.13 (rebuild image to bump)
• Sci stack: numpy, pandas, matplotlib, plotly, seaborn, scipy, scikit-learn
• HTTP: requests, httpx, curl, wget
• Tools: git, ssh, ipython, sudo
• Non-root user coder (uid 1000) with passwordless sudo

Why "baked in" vs install-at-startup

MCP spawns short-lived workspaces. Installing deps every time burns ~2 min and ~300 MB of network. Bake them, spin in ~3 s.

Build the image (run on CT 111)

cd /opt/stacks/coder/templates/mcp-sandbox
docker build -t coder-mcp-sandbox:latest .
# bump Python: docker build --build-arg PY_VERSION=3.14 -t coder-mcp-sandbox:latest .

Push the template to Coder

coder templates push mcp-sandbox -d /opt/stacks/coder/templates/mcp-sandbox

Ephemerality

$HOME is not persisted. Each workspace start gets fresh state. Plots written to ~/plots/ vanish on stop — copy via coder cp or upload elsewhere from inside the workspace if you need to keep them.

GPU

/dev/dri/renderD128 is mounted. Useful if matplotlib offloads to GPU or if you decide to add torch[cpu] → torch with Arc support later.