Introduction

DeepSeek Harness, when running tasks, may invoke file operations, subprocesses, Bash, terminals, and other actions. If these operations execute directly in the host environment, the working directory, path permissions, and credential boundaries depend on the host process.

dsh-tensorlake-sandbox provides an optional execution layer: moving DeepSeek Harness’s file, subprocess, Bash, terminal, and LSP operations into a short-lived Tensorlake micro virtual machine.

What is This

@tensorlakeai/dsh-sandbox is a sandbox execution plugin provided by Tensorlake for DeepSeek Harness, licensed under MIT.

It is provided as an installable dsh bundle, requiring no modification to the Harness installation. Once enabled, the plugin creates a temporary sandbox when the profile starts and terminates the sandbox upon dsh exit.

Core Features

  • Moves DeepSeek Harness’s file, subprocess, Bash, terminal, and LSP operations into a short-lived Tensorlake micro virtual machine.
  • Installed as a dsh bundle, requiring no modification to the Harness installation.
  • Starts a temporary sandbox when the profile starts and terminates the sandbox upon dsh exit.
  • Provides three Loader entry points:
  • @tensorlakeai/dsh-sandbox/runtime
  • @tensorlakeai/dsh-sandbox/filesystem
  • @tensorlakeai/dsh-sandbox/subprocess
  • Validates that the configured cwd is writable and, if necessary, uses passwordless sudo from the managed image to create and hand over protected paths.
  • Does not copy TENSORLAKE_API_KEY, DEEPSEEK_API_KEY, other credential-related environment variables, or DSH_* variables to the sandbox process.
  • Preserves bash-sandbox in danger-full-access mode and lets Harness’s sandbox-aware Bash executor delegate directly to the Tensorlake subprocess provider.

Installation and Enabling

Prerequisites:

  • Node.js ^22.19.0 or >=24.0.0
  • @deepseek-ai/dsh 0.1.0-rc.6 or a compatible version
  • TENSORLAKE_API_KEY set in the host environment
  • DEEPSEEK_API_KEY set in the host environment

Credentials should be stored in environment variables or a secret manager, not committed to the profile or repository.

First, install dsh, then add the plugin to the profile you wish to run:

npm install --global @deepseek-ai/dsh
dsh plugin --profile headless add @tensorlakeai/dsh-sandbox

After installation, you can start a task in headless mode:

TENSORLAKE_API_KEY=... DEEPSEEK_API_KEY=... dsh --profile headless "build and test this repo"

If installing in a local development directory, first build within the plugin directory, then add the local package:

npm install
npm run build
dsh plugin --profile headless add .

Typical Usage

Example of a normal task:

TENSORLAKE_API_KEY=... DEEPSEEK_API_KEY=... dsh --profile headless "build and test this repo"

To explicitly specify a working directory, you can pass DSH_TENSORLAKE_CWD:

DSH_TENSORLAKE_CWD=/workspace/project dsh --profile headless "build and test this repo"

The following example triggers Bash, file creation, file reading, and result reporting:

dsh --profile headless \
  "Use Bash to run pwd and id. Create smoke-test.txt containing hello, read it back, and report the results."

Configuration

Acceptable configuration fields for the runtime include:

  • apiKey
  • cwd
  • timeoutSecs
  • cpus
  • memoryMb
  • diskMb

Where cwd defaults to /home/tl-user/workspace.

To modify the working directory, you can first pass it via environment variables:

DSH_TENSORLAKE_CWD=/workspace/project dsh --profile headless "build and test this repo"

If modifying the configuration directly in the profile’s cordis.patch.yml, note that the patch replaces the entire configuration, so all required non-default fields must be rewritten.

Runtime Requirements

The Tensorlake image must provide:

  • bash
  • Node.js
  • GNU base64
  • cat
  • chmod
  • env
  • find
  • grep
  • ln
  • mkdir
  • mktemp
  • mv
  • ps
  • realpath
  • rm
  • stat
  • tee

The managed Ubuntu image provides these tools. The runtime validates that the configured cwd is writable and, if necessary, uses passwordless sudo from the managed image to create and hand over protected paths.

Applicable Scenarios and Notes

This is suitable for scenarios where the host environment already has a Tensorlake project and requires moving DeepSeek Harness’s file, subprocess, Bash, and terminal operations into an isolated sandbox.

Before use, note:

  • The plugin is loaded via the dsh profile; the host process is still responsible for starting the plugin and providing necessary credentials. The plugin runs with the permission context of the current dsh process; before installation, you should review the source code, license, and dependencies.
  • Credentials such as TENSORLAKE_API_KEY and DEEPSEEK_API_KEY should be stored in environment variables or a secret manager, not committed to the profile or repository.
  • The sandbox image must provide the bash, Node.js, and GNU tools listed earlier.
  • Known limitations: tensorlake@0.5.103 pins undici@8.3.0 and nanoid@3.3.11; npm audit --omit=dev will report high-severity advisories. Before using in production, these upstream advisories should be reviewed.
  • LSP operations are also moved into the sandbox, but this article does not elaborate on their specific capability boundaries; it is recommended to verify based on actual tasks.

References

  • GitHub: https://github.com/tensorlakeai/dsh-tensorlake-sandbox
  • Plugin Directory Page: https://www.skillhub.cn/plugins/tensorlakeai/dsh-tensorlake-sandbox