feat(server): docker runtime sandbox_env / sandbox_binds config

[tea-artist]

Summary

Add two DockerConfig fields applied to every sandbox container created by the docker runtime:

• sandbox_env: environment variables merged under the request's env (request keys win)
• sandbox_binds: host bind mounts in Docker -v syntax, prepended to the binds derived from a request's volumes

Motivation

The Kubernetes runtime has a deployment-side pod template (batchsandbox_template_file) where operators can add fleet-wide mounts and environment variables. The docker runtime has no equivalent: sandbox env/mounts come only from each creation request, which the calling application controls.

The concrete case: when the services a sandbox calls back into present certificates from a private/corporate CA, tools inside the sandbox reject TLS (SELF_SIGNED_CERT_IN_CHAIN etc.). On Kubernetes this is solved in the pod template (mount the root CA + set NODE_EXTRA_CA_CERTS); on docker there was no operator-side hook at all. With this change:

[docker]
sandbox_binds = ["/opt/certs/root-ca.crt:/etc/ssl/private-ca/root-ca.crt:ro"]
sandbox_env = { NODE_EXTRA_CA_CERTS = "/etc/ssl/private-ca/root-ca.crt" }

Test plan

• test_create_sandbox_applies_config_sandbox_env_and_binds: config env lands in the container, request env overrides same-named keys, config binds precede request volume binds
• full server test suite passes
• example.config.toml / example.config.zh.toml / configuration.md updated

[Copilot]

Pull request overview

Adds docker-runtime operator-level defaults to apply environment variables and bind mounts to every sandbox container, aligning the Docker runtime with the Kubernetes pod-template capability for fleet-wide configuration (e.g., private CA trust injection).

Changes:

• Introduces docker.sandbox_env and docker.sandbox_binds in DockerConfig, with request env keys overriding config defaults.
• Applies docker.sandbox_binds to all sandbox containers by prepending them ahead of request-derived volume binds.
• Updates tests and documentation/examples to reflect the new config options.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
server/tests/test_docker_service.py	Adds a test for config-level sandbox env/binds application (needs stronger assertion for bind ordering).
server/opensandbox_server/services/docker/docker_service.py	Prepends docker.sandbox_binds ahead of request-derived binds in container host config.
server/opensandbox_server/services/docker/container_ops.py	Merges docker.sandbox_env into sandbox env with request keys taking precedence.
server/opensandbox_server/examples/example.config.zh.toml	Documents the new sandbox_env / sandbox_binds options (Chinese example).
server/opensandbox_server/examples/example.config.toml	Documents the new sandbox_env / sandbox_binds options (English example).
server/opensandbox_server/config.py	Adds sandbox_env / sandbox_binds fields to DockerConfig.
server/configuration.md	Documents the new docker config fields (minor type-format inconsistency).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.