Session 150 — Daily Summary (February 27, 2026)

Session Focus

Self-hosted Firecracker sandbox infrastructure — replacing E2B Cloud for Computer Use.

Decisions Made

1. Architecture: Firecracker microVMs over Docker containers

• Confidence: 0.92
• Reasoning: User chose Firecracker for hardware-level isolation (separate kernel per VM). Docker shares a kernel — weaker isolation. The SandboxProvider interface (Session 144) makes the backend agnostic to the provider, so swapping is zero-code-change.
• Alternatives: Docker containers, QEMU/KVM full VMs, Kata Containers
• Impact: Requires KVM bare metal ($46/mo Hetzner AX41), more complex ops, but stronger security guarantees for multi-tenant workloads.

2. Implementation: SSH for VM communication

• Confidence: 0.90
• Reasoning: SSH is universally available, requires no custom agent inside VM (just openssh-server in rootfs). Pragmatic v1 — can optimize to Firecracker vsock later.
• Tradeoff: ~50-100ms overhead per command. Acceptable for screenshot loop running at 2-3s.

3. Implementation: Docker-based rootfs building (Dockerfile→ext4)

• Confidence: 0.95
• Reasoning: Reproducible image building via Dockerfile, exported to ext4 for Firecracker. Much better than mount -o loop + chroot approach from original plan (fragile, non-reproducible).

4. Security: API key authentication on orchestrator

• Confidence: 0.95
• Reasoning: Original plan had zero auth. Anyone who found the URL could create VMs. Added X-API-Key header with constant-time comparison, exempt health/metrics endpoints.

Files Created

• 21 NestJS source files (APIs/sandbox-orchestrator/)
• 7 deployment/infra files (deployment/sandbox-orchestrator/)
• 3 server provisioning scripts (tools/scripts/sandbox/)
• 1 modified existing file (self-hosted.provider.ts)

Build Status

• nx build sandbox-orchestrator — PASS
• tsc --noEmit backend-ai-api — PASS

Git

• Branch: session-150 / integrate/149-150
• 32 new files, 1 modified file

16:24:33 - ⚙️ implementation (backend)

Q: How to enhance SelfHostedProvider for production reliability?
A: Three enhancements: (1) API key header on all HTTP requests from SANDBOX_API_KEY env var; (2) Retry ...
Confidence: 91%

16:24:56 - ⚙️ implementation (angular)

Q: Generate undefined module: "undefined"
A: Generate module with current approach
Confidence: 60%

Total decisions today: 2