Dish Sandbox

Overview

Dish runs each scaffold inside an Inspect sandbox. Docker is the default and provider; the base image is built automatically from a Dockerfile bundled inside the package on first run (expect a one-time build delay on first eval). To override, set docker_image to any pre-built image you’d like to use instead.

Switching Providers

Any Docker-compatible Inspect sandbox provider (e.g. k8s, daytona, modal) also works via the sandbox task option — Dish passes it the same per-sample compose spec, so the bundled Dockerfile and any per-seed docker_image grounding still apply.

Pass a (name, config) tuple or a SandboxEnvironmentSpec to take complete control of the sandbox config; per-seed docker_image metadata is then ignored. For providers that don’t accept Docker-compatible configs, petri_dish.dish_dockerfile() returns the path to the bundled Dockerfile so you can reference it from your own sandbox config.

Pass the provider name as the sandbox task option. Dish reuses the bundled Dockerfile (or your docker_image override) and routes it through that runtime.

inspect eval petri_dish/dish_audit \
   -T sandbox=k8s \
   --model-role auditor=anthropic/claude-sonnet-4-6 \
   --model-role target=anthropic/claude-opus-4-6 \
   --model-role judge=anthropic/claude-opus-4-6

from inspect_ai import eval
from petri_dish import dish_audit

eval(
   dish_audit(sandbox="k8s"),
   model_roles=dict(
      auditor="anthropic/claude-sonnet-4-6",
      target="anthropic/claude-opus-4-6",
      judge="anthropic/claude-opus-4-6",
   ),
)

For providers that need their own config format (or to fully override the compose spec), pass a SandboxEnvironmentSpec directly. Use dish_dockerfile() to reference the bundled Dockerfile from your config:

Default Dockerfile

The bundled Dockerfile is minimal — a Debian base with git plus the small bit of setup the Claude Code scaffold needs:

src/petri_dish/Dockerfile

FROM python:3.12-bookworm

RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*

# /home/user is required by claude-agent-acp for onboarding bypass
RUN mkdir -p /home/user && \
    echo '{"hasCompletedOnboarding":true,"bypassPermissionsModeAccepted":true}' > /home/user/.claude.json

# /home/claude is the working directory for grounding repos
RUN mkdir -p /home/claude && \
    echo '{"hasCompletedOnboarding":true,"bypassPermissionsModeAccepted":true}' > /home/claude/.claude.json

CMD ["tail", "-f", "/dev/null"]

To customize, either extend this Dockerfile in your own image and point docker_image at it, or pass petri_dish.dish_dockerfile() into a sandbox config you build by hand.