Autogen Code Execution

Operator constructs DockerCommandLineCodeExecutor inline in team.run() without calling executor.start() / stop().

DockerCommandLineCodeExecutor requires an explicit start() before first use and stop() at teardown (or use it as an async context manager). Without start(), the first execute_code_blocks() call either lazily starts a container per call (slow + leaky) or errors. Wrap with 'async with' so the contain…

Operator picks LocalCommandLineCodeExecutor because Docker is unavailable in their CI environment, then runs an AssistantAgent that processes untrusted user prompts.

Per docs, LocalCommandLineCodeExecutor is explicitly NOT sandboxed — it runs code directly on the host. Only use it for fully trusted inputs in trusted environments. For any untrusted prompt path, switch to DockerCommandLineCodeExecutor or another sandbox; do not deploy Local executor as a 'tempora…

DockerCommandLineCodeExecutor is configured with work_dir=Path('/'). Operator expects 'the container has access to the workspace'.

work_dir bind-mounts a host directory into the container. Choose a narrowly-scoped directory (e.g. a per-session tempdir) — never the host root. Validate the work_dir is created by the executor, owned by an unprivileged user, and cleaned up at stop().