Enable private Docker
Set docker_access to true in the sandbox configuration when the space needs ordinary Docker, Compose, or Testcontainers workflows. The selected runner needs a rootful Linux container engine with privileged-container support.
Resource controls
Clor delegates every exposed cgroup v2 controller before private Docker starts, allowing nested containers to enforce CPU, memory, process, and I/O limits beneath the aggregate outer space cap. When the runtime cannot provide writable delegation, private Docker starts in degraded mode after complete rollback. Lifecycle history and the Docker log warn that per-container limits and OOM accounting are unavailable while the outer space cap still applies.
Storage and cleanup
Each enabled space receives one labeled private Docker volume. The volume survives stop, resume, and outer-container recreation. Semantic space deletion removes the outer container first, then removes the volume after verifying every ownership label. A once-per-minute orphan pass retries verified managed volumes and never performs broad volume pruning.
Failure containment
Readiness, tunnels, and routes are retired before outer-container cleanup begins. Cleanup runs asynchronously so one broken or legacy container cannot stall Plane polling or unrelated spaces. Failed cleanup remains unavailable and retries with bounded backoff. Replacement execution starts only after old-container removal succeeds.
Shutdown timing
Ordinary outer shutdown allows 75 seconds. Archive shutdown allows seven minutes. Tabs and services stop first, archive work completes when requested, private Docker stops, its empty cgroup hierarchy is removed, the original space cgroup state is restored, and final lifecycle events are then delivered. Incomplete restoration is fatal.
Trust boundary
Private Docker separates Docker state between trusted spaces. A Docker-enabled space uses a privileged outer container and is not a security boundary for hostile workloads. Nested port publication reaches browser ingress only when the port is also declared in the space configuration.