From 329890fc0a5b5322464d26eff4c57696c2caa629 Mon Sep 17 00:00:00 2001
From: David Fejes <david.fejes@lightware.com>
Date: Mon, 22 Jun 2026 12:44:44 +0200
Subject: [PATCH 1/2] feat: make executor Docker network configurable via env
 var

Add PYTHON_EXECUTOR_DOCKER_NETWORK env var (default: "none") to allow
spawned executor containers to join a specific Docker network. Useful
for deployments where the executed code needs to reach internal services
(e.g. via a shared Compose or Traefik network).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/build-code-interpreter.yml  | 48 +++++++++++++++++++
 code-interpreter/app/app_configs.py           |  4 ++
 .../app/services/executor_docker.py           |  3 +-
 3 files changed, 54 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/build-code-interpreter.yml

diff --git a/.github/workflows/build-code-interpreter.yml b/.github/workflows/build-code-interpreter.yml
new file mode 100644
index 0000000..dda6774
--- /dev/null
+++ b/.github/workflows/build-code-interpreter.yml
@@ -0,0 +1,48 @@
+name: Build and push code-interpreter image
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "code-interpreter/**"
+      - ".github/workflows/build-code-interpreter.yml"
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository_owner }}/code-interpreter
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=sha,prefix=sha-
+
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          context: ./code-interpreter
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
diff --git a/code-interpreter/app/app_configs.py b/code-interpreter/app/app_configs.py
index 7b20615..c6ff5e1 100644
--- a/code-interpreter/app/app_configs.py
+++ b/code-interpreter/app/app_configs.py
@@ -13,6 +13,10 @@
     os.environ.get("PYTHON_EXECUTOR_DOCKER_IMAGE") or "onyxdotapp/python-executor-sci"
 )
 PYTHON_EXECUTOR_DOCKER_RUN_ARGS = os.environ.get("PYTHON_EXECUTOR_DOCKER_RUN_ARGS") or ""
+# Docker network for spawned executor containers. Defaults to "none" (no network access)
+# for maximum isolation. Set to a Docker network name (e.g. "onyx_default", "traefik")
+# to allow executor containers to reach services on that network.
+PYTHON_EXECUTOR_DOCKER_NETWORK = os.environ.get("PYTHON_EXECUTOR_DOCKER_NETWORK") or "none"
 
 # Kubernetes executor configuration
 KUBERNETES_EXECUTOR_NAMESPACE = os.environ.get("KUBERNETES_EXECUTOR_NAMESPACE") or "default"
diff --git a/code-interpreter/app/services/executor_docker.py b/code-interpreter/app/services/executor_docker.py
index cd10f61..f98f439 100644
--- a/code-interpreter/app/services/executor_docker.py
+++ b/code-interpreter/app/services/executor_docker.py
@@ -18,6 +18,7 @@
 from app.app_configs import (
     PYTHON_EXECUTOR_DOCKER_BIN,
     PYTHON_EXECUTOR_DOCKER_IMAGE,
+    PYTHON_EXECUTOR_DOCKER_NETWORK,
     PYTHON_EXECUTOR_DOCKER_RUN_ARGS,
 )
 from app.image_ref import normalize_image_ref
@@ -269,7 +270,7 @@ def _build_run_command(
             "--pull",
             "never",
             "--network",
-            "none",
+            PYTHON_EXECUTOR_DOCKER_NETWORK,
             "--name",
             container_name,
             "--cgroupns",

From 22bb3b7b0f9c9b7d38892ca3c0573c6333bb128e Mon Sep 17 00:00:00 2001
From: Jamison Lahman <jamison@lahman.dev>
Date: Tue, 23 Jun 2026 10:02:39 -0700
Subject: [PATCH 2/2] Delete .github/workflows/build-code-interpreter.yml

---
 .github/workflows/build-code-interpreter.yml | 48 --------------------
 1 file changed, 48 deletions(-)
 delete mode 100644 .github/workflows/build-code-interpreter.yml

diff --git a/.github/workflows/build-code-interpreter.yml b/.github/workflows/build-code-interpreter.yml
deleted file mode 100644
index dda6774..0000000
--- a/.github/workflows/build-code-interpreter.yml
+++ /dev/null
@@ -1,48 +0,0 @@
-name: Build and push code-interpreter image
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - "code-interpreter/**"
-      - ".github/workflows/build-code-interpreter.yml"
-  workflow_dispatch:
-
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository_owner }}/code-interpreter
-
-jobs:
-  build-and-push:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=raw,value=latest,enable={{is_default_branch}}
-            type=sha,prefix=sha-
-
-      - name: Build and push
-        uses: docker/build-push-action@v5
-        with:
-          context: ./code-interpreter
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}