From c8305102fdcf66698263c0e428a17a3f7559b7ad Mon Sep 17 00:00:00 2001
From: panyehong <2655992392@qq.com>
Date: Wed, 26 Aug 2026 12:34:44 +0800
Subject: [PATCH 1/2] =?UTF-8?q?=E2=9C=A8=20Feature:=20System-level=20sandb?=
 =?UTF-8?q?oxing=20is=20enabled=20by=20default.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 deploy/env/.env.example | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/env/.env.example b/deploy/env/.env.example
index 6ce269eb2..b3b377987 100644
--- a/deploy/env/.env.example
+++ b/deploy/env/.env.example
@@ -257,7 +257,7 @@ IND_AIDP_IMAGE_SIGNING_KEY=
 
 # Default sandbox isolation level: local / docker / wasm.
 # 'local' preserves backward-compatibility for existing deployments.
-NEXENT_SANDBOX_DEFAULT_LEVEL=local
+NEXENT_SANDBOX_DEFAULT_LEVEL=docker
 
 # Default sandbox container lifecycle scope: session / system.
 # session = one container per agent_run, destroyed on run end (strictest isolation).

From 1909191a467a1f2a0555e7a35ef07d2e8887ab84 Mon Sep 17 00:00:00 2001
From: panyehong <2655992392@qq.com>
Date: Wed, 26 Aug 2026 14:17:19 +0800
Subject: [PATCH 2/2] =?UTF-8?q?=E2=9C=A8=20Feature:=20Configure=20the=20de?=
 =?UTF-8?q?ployment=20pipeline=20to=20include=20sandbox=20and=20MCP=20imag?=
 =?UTF-8?q?e=20builds.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/docker-deploy.yml | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docker-deploy.yml b/.github/workflows/docker-deploy.yml
index 31f85735b..a15f6f73f 100644
--- a/.github/workflows/docker-deploy.yml
+++ b/.github/workflows/docker-deploy.yml
@@ -73,9 +73,25 @@ jobs:
       - name: Build docs image
         run: docker build --progress=plain -t nexent/nexent-docs:${{ github.event.inputs.app_version }} -t nexent/nexent-docs -f deploy/images/dockerfiles/docs/Dockerfile .
 
+  build-sandbox:
+    runs-on: ${{ fromJson(inputs.runner_label_json) }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Build sandbox image
+        run: docker build --build-arg MIRROR=https://pypi.tuna.tsinghua.edu.cn/simple --build-arg APT_MIRROR=tsinghua -t nexent/nexent-sandbox:${{ github.event.inputs.app_version }} -t nexent/nexent-sandbox -f deploy/images/dockerfiles/sandbox/Dockerfile .
+
+  build-mcp:
+    runs-on: ${{ fromJson(inputs.runner_label_json) }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Build MCP image
+        run: docker build --build-arg MIRROR=https://pypi.tuna.tsinghua.edu.cn/simple --build-arg APT_MIRROR=tsinghua -t nexent/nexent-mcp:${{ github.event.inputs.app_version }} -t nexent/nexent-mcp -f deploy/images/dockerfiles/mcp/Dockerfile .
+
   deploy:
     runs-on: ${{ fromJson(inputs.runner_label_json) }}
-    needs: [ build-main, build-data-process, build-web, build-docs ]
+    needs: [ build-main, build-data-process, build-web, build-docs, build-sandbox, build-mcp ]
     steps:
       - name: Checkout code
         uses: actions/checkout@v4