Headlong’s public Docker-broker pull request #47 reports that an agent-authored Compose model could reach host data through a sibling-prefix path, .., a symlink, or fields the gate did not inspect. The awkward moment comes earlier than the container: when a trusted tool turns that configuration into an execution plan.
The project’s broker is the host-side gate for a shell-capable agent that can ask to run Compose. Its authors found that checking a convenient, already-rendered model was too late for some inputs. A path in env_file or label_file can be read and inlined while Compose renders the configuration; afterwards, the validator sees values, not the path that caused the host read.
The path disappears at rendering time
The original public report describes several more familiar escapes too: a sibling path that merely shares a text prefix with the work directory, an absolute path carrying .., and a symlink planted inside the work tree. The broker now resolves the candidate and the allowed root instead of comparing spellings. It also expands the question from “is this a bind mount?” to “does this Compose field name something on the host?”—including volume devices, secrets, configs, additional build contexts, build SSH keys and local caches.
The follow-up implementation and tests put the ordering in code. It first asks Compose for an uninterpolated model, validates the raw environment and label-file paths, and only then permits the ordinary render. An unexpanded variable is rejected rather than optimistically treated as contained; a render error is withheld from the requester because the error itself might quote a file it just tried to read. That is a policy boundary with a time dimension, not a prettier path check.
Ask what the renderer touched
Headlong’s public documentation matters here because shellm executes model-written Bash in Docker when it can. For an operator of any agent that can assemble infrastructure configuration, “it runs in a container” is therefore not the last question. Ask which tool resolves the request, which inputs that tool opens before a policy check, and whether errors can relay the contents back across the boundary.
This is source and test evidence, not proof of a shipped security guarantee. The public pull request and commits do not establish release availability, default settings, or a complete inventory of every Compose feature. But they do make the next signal precise: a sandbox is only as bounded as the first trusted parser that touches the agent’s configuration.