The Agent Skills Directory

[Subprocess Command Execution]: The skill uses asyncio.create_subprocess_exec to interface with the Docker CLI for container lifecycle management (create, start, stats, rm). While this pattern allows for powerful system operations, it is used here within the context of a container orchestrator. Implementing proper validation for inputs like instance_id, image, and cmd is a standard best practice when adopting this pattern.
[Resource Limit Enforcement]: The skill explicitly defines and applies safety limits such as --pids-limit, --memory, and --cpus. These are positive security measures designed to mitigate resource exhaustion attacks, such as fork bombs or memory leaks, within the managed containers.
[Automated Monitoring and Cleanup]: A watchdog loop is implemented to monitor active containers and terminate those that exceed predefined resource thresholds or lifetime durations. This automated cleanup process helps maintain system stability and prevents orphan processes from accumulating.
[File System Bind Mounts]: The sidecar provisioning logic uses bind mounts to persist data in instance-specific directories. When implementing this pattern, ensuring that base directories are properly scoped and validated helps prevent potential path traversal considerations.

container-orchestration-patterns