feat(desktop):docker sandbox workspaces

.github/workflows/publish-sandbox-image.yml

@@ -0,0 +1,59 @@
+name: Publish sandbox image
+
+# Builds and publishes the default Superset workspace sandbox image to GHCR.
+# host-service defaults non-development workspaces to
+# ghcr.io/superset-sh/sandbox:latest, so this must run before that default is
+# reachable in a release. Multi-arch (amd64 + arm64) so both host CPUs work.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "packages/sandbox-image/**"
+      - ".github/workflows/publish-sandbox-image.yml"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Image tag to publish (default: latest)"
+        required: false
+        type: string
+        default: latest
+
+concurrency:
+  group: publish-sandbox-image
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    env:
+      IMAGE_TAG: ${{ inputs.tag || 'latest' }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: packages/sandbox-image
+          file: packages/sandbox-image/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ghcr.io/superset-sh/sandbox:${{ env.IMAGE_TAG }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+# NOTE: the GHCR package must be made PUBLIC once (Packages → sandbox →
+# Package settings → Change visibility) so hosts can `docker pull` the default
+# ghcr.io/superset-sh/sandbox:latest without a login. Until then, non-dev
+# provisioning fails with "denied"; dev hosts use the local superset-sandbox:dev.

apps/desktop/src/renderer/hooks/host-workspaces/useHostWorkspaces/useHostWorkspaces.utils.ts

@@ -27,6 +27,9 @@ export type HostShapedWorkspace = Omit<
 export interface HostWorkspaceRow extends HostShapedWorkspace {
 	worktreePath: string;
 	worktreeExists: boolean;
+	/** True when the workspace's terminals run inside a sandbox container. */
+	sandboxed?: boolean;
+	sandboxStatus?: "provisioning" | "ready" | "error";
 	/** Non-null = archived tombstone (only served on `includeArchived`). */
 	archivedAt?: number | null;
 	archiveReason?: "merged" | "deleted" | null;
@@ -36,6 +39,9 @@ export interface HostWorkspaceRow extends HostShapedWorkspace {
 export interface HostWorkspaceItem extends HostShapedWorkspace {
 	worktreePath?: string;
 	worktreeExists?: boolean;
+	/** True when the workspace's terminals run inside a sandbox container. */
+	sandboxed?: boolean;
+	sandboxStatus?: "provisioning" | "ready" | "error";
 	/** False when the host didn't answer. */
 	hostReachable: boolean;
 	/** Non-null = archived tombstone (only present on `includeArchived`). */
@@ -232,6 +238,8 @@ export function applyWorkspaceChangedEvent(
 		createdAt: new Date(snapshot.createdAt),
 		updatedAt: new Date(snapshot.updatedAt),
 		worktreePath: snapshot.worktreePath,
+		sandboxed: snapshot.sandboxed,
+		sandboxStatus: snapshot.sandboxStatus,
 		// A host broadcasting created/updated just acted on the worktree;
 		// keep a known value over assuming.
 		worktreeExists: existing?.worktreeExists ?? true,

apps/desktop/src/renderer/routes/_authenticated/_dashboard/components/DashboardSidebar/components/DashboardSidebarWorkspaceItem/components/DashboardSidebarExpandedWorkspaceRow/DashboardSidebarExpandedWorkspaceRow.tsx

@@ -9,6 +9,7 @@ import {
 	useRef,
 } from "react";
 import { HiCheck, HiMiniMinus, HiMiniXMark } from "react-icons/hi2";
+import { LuContainer } from "react-icons/lu";
 import { WorkspaceNameMarquee } from "renderer/components/WorkspaceNameMarquee";
 import type { DiffStats } from "renderer/hooks/host-service/useDiffStats";
 import { useFocusVisible } from "renderer/hooks/useFocusVisible";
@@ -121,7 +122,14 @@ export const DashboardSidebarExpandedWorkspaceRow = forwardRef<
 			}
 		}, [isActive]);
 
-		const creationStatusText = isPending ? "Creating…" : null;
+		// Sandbox provisioning outlives the create mutation (container ensure is
+		// fire-and-forget), so it shows both during and after the pending state.
+		const creationStatusText =
+			workspace.sandboxStatus === "provisioning"
+				? "Initializing sandbox…"
+				: isPending
+					? "Creating…"
+					: null;
 		const isMainWorkspace = workspace.type === "main";
 		// No hover action button on the local main workspace: a stray click on the
 		// minus would remove the project's anchor row. Removal stays available via
@@ -297,19 +305,34 @@ export const DashboardSidebarExpandedWorkspaceRow = forwardRef<
 								)}
 							/>
 						) : (
-							<>
+							<span className="flex min-w-0 items-center gap-1">
 								<WorkspaceNameMarquee
 									name={name || branch}
 									forceActive={isFocused}
 									className={cn(
-										"text-[13px] leading-tight transition-colors",
+										"min-w-0 flex-1 text-[13px] leading-tight transition-colors",
 										isActive || isSelected
 											? "text-foreground"
 											: "text-foreground/80",
 									)}
 								/>
 								{isSelected && <span className="sr-only">, selected</span>}
-							</>
+								{workspace.sandboxed && (
+									<Tooltip delayDuration={300}>
+										<TooltipTrigger asChild>
+											<span className="shrink-0 text-muted-foreground">
+												<LuContainer
+													className="size-3"
+													aria-label="Sandboxed workspace"
+												/>
+											</span>
+										</TooltipTrigger>
+										<TooltipContent side="right" sideOffset={8}>
+											Sandboxed — terminals run in a Docker container
+										</TooltipContent>
+									</Tooltip>
+								)}
+							</span>
 						)}
 
 						<div className="col-start-2 row-start-1 grid h-5 shrink-0 items-center justify-items-end [&>*]:col-start-1 [&>*]:row-start-1">

apps/desktop/src/renderer/routes/_authenticated/_dashboard/components/DashboardSidebar/hooks/useDashboardSidebarData/buildDashboardSidebarProjects.ts

@@ -49,6 +49,9 @@ export interface SidebarWorkspaceInput {
 	tabOrder: number;
 	sectionId: string | null;
 	pinnedAt: number | null;
+	/** True when the workspace's terminals run inside a sandbox container. */
+	sandboxed?: boolean;
+	sandboxStatus?: "provisioning" | "ready" | "error";
 	pendingTransaction: WorkspaceTransactionSnapshot | null;
 }
 
@@ -104,6 +107,8 @@ function decorateSidebarWorkspace(
 		updatedAt: workspace.updatedAt,
 		taskId: workspace.taskId,
 		isPinned: workspace.pinnedAt != null,
+		sandboxed: workspace.sandboxed,
+		sandboxStatus: workspace.sandboxStatus,
 		pendingTransaction: workspace.pendingTransaction,
 	};
 }

apps/desktop/src/renderer/routes/_authenticated/_dashboard/components/DashboardSidebar/hooks/useDashboardSidebarData/useDashboardSidebarData.ts

@@ -301,6 +301,8 @@ export function useDashboardSidebarData() {
 						sectionId: localState.sectionId,
 						isHidden: localState.isHidden,
 						pinnedAt: localState.pinnedAt,
+						sandboxed: workspace.sandboxed,
+						sandboxStatus: workspace.sandboxStatus,
 					},
 				];
 			}),
@@ -346,6 +348,8 @@ export function useDashboardSidebarData() {
 					taskId: workspace.taskId,
 					createdAt: workspace.createdAt,
 					updatedAt: workspace.updatedAt,
+					sandboxed: workspace.sandboxed,
+					sandboxStatus: workspace.sandboxStatus,
 					tabOrder: MAIN_WORKSPACE_TAB_ORDER,
 					sectionId: null as string | null,
 					// Auto-included mains have no local-state row; pinning one

apps/desktop/src/renderer/routes/_authenticated/_dashboard/components/DashboardSidebar/types.ts

@@ -45,6 +45,9 @@ export interface DashboardSidebarWorkspace {
 	updatedAt: Date;
 	taskId: string | null;
 	isPinned: boolean;
+	/** True when the workspace's terminals run inside a sandbox container. */
+	sandboxed?: boolean;
+	sandboxStatus?: "provisioning" | "ready" | "error";
 	pendingTransaction: WorkspaceTransactionSnapshot | null;
 }
 

apps/desktop/src/renderer/routes/_authenticated/settings/components/SettingsSidebar/GeneralSettings.tsx

@@ -22,7 +22,7 @@ import {
 	HiOutlineUser,
 	HiOutlineUserGroup,
 } from "react-icons/hi2";
-import { LuBrain, LuGitBranch, LuKeyboard } from "react-icons/lu";
+import { LuBrain, LuContainer, LuGitBranch, LuKeyboard } from "react-icons/lu";
 import { useIsV2CloudEnabled } from "renderer/hooks/useIsV2CloudEnabled";
 import { electronTrpc } from "renderer/lib/electron-trpc";
 import type { SettingsSection } from "renderer/stores/settings-state";
@@ -44,6 +44,7 @@ type SettingsRoute =
 	| "/settings/behavior"
 	| "/settings/browser"
 	| "/settings/git"
+	| "/settings/sandboxes"
 	| "/settings/agents"
 	| "/settings/terminal"
 	| "/settings/links"
@@ -124,6 +125,12 @@ const SECTION_GROUPS: SectionGroup[] = [
 				label: "Git & Worktrees",
 				icon: <LuGitBranch className="h-4 w-4" />,
 			},
+			{
+				id: "/settings/sandboxes",
+				section: "sandboxes",
+				label: "Sandboxes",
+				icon: <LuContainer className="h-4 w-4" />,
+			},
 			{
 				id: "/settings/agents",
 				section: "agents",