lemans 1.4.0 → 1.5.0

data/lib/lemans/agent.rb

@@ -15,6 +15,9 @@ module Lemans
 
     attr_reader :profile, :model
 
+    # Whether #run can go on from the history (raw result) of an interrupted run
+    def self.recoverable? = false
+
     def initialize(profile:, model: nil)
       @profile = profile
 
@@ -28,7 +31,7 @@ module Lemans
     def install(_task, _environment) = nil
 
     # Run the task.
-    def run(task, environment)
+    def run(task, environment, history: nil)
       raise NotImplementedError
     end
 

data/lib/lemans/agents/miniswen.rb

@@ -21,9 +21,13 @@ module Lemans
         cost_limit: :cost_ceiling_reached
       }.freeze
 
-      def run(task, environment)
-        run_result = obtain_result(task, environment)
+      def self.recoverable? = true
+
+      def run(task, environment, history: nil)
+        history &&= ::Miniswen::Agent::Result.from_h(JSON.parse(history))
+        run_result = obtain_result(task, environment, history)
         trajectory = trajectory_for(run_result)
+        raw_result = raw_result_for(run_result)
 
         # A failed model call is still an answer: the trial saves the
         # trajectory as evidence before failing.
@@ -39,16 +43,17 @@ module Lemans
 
       private
 
-      def obtain_result(task, environment)
+      def obtain_result(task, environment, history)
         agent = agent_for(environment)
         begin
-          agent.run(task.instruction)
+          agent.run(task.instruction, history:)
         rescue InfrastructureError, ::Miniswen::InfrastructureError => e
           agent.partial_result(e.message)
         end
       end
 
-      def raw_result = nil
+      # The run as miniswen records it, signatures included: what a recovery continues from
+      def raw_result_for(run_result) = JSON.generate(run_result.to_h)
 
       def agent_for(environment)
         raise ConfigError, "miniswen needs a model to drive" if model.to_s.empty?

data/lib/lemans/agents/miniswen_installed.rb

@@ -13,6 +13,7 @@ module Lemans
     class MiniswenInstalled < Miniswen
       NAME = "miniswen-installed"
       RESULTS_PATH = "/tmp/lemans-miniswen.result.json"
+      HISTORY_PATH = "/tmp/lemans-miniswen.history.json"
       INSTALL_TIMEOUT_SEC = 300
       # The CLI enforces max-time itself, but between steps only: a command
       # started just before the deadline runs to its own exec timeout first,
@@ -31,8 +32,9 @@ module Lemans
 
       # An in-sandbox run self-reports: everything but the verifier's reward
       # comes from a file the sandbox wrote.
-      def obtain_result(task, environment)
-        run = environment.exec(command_for(task), timeout: outer_timeout, env: provider_env(environment))
+      def obtain_result(task, environment, history)
+        upload_history(environment, history) if history
+        run = environment.exec(command_for(task, history:), timeout: outer_timeout, env: provider_env(environment))
 
         begin
           Tempfile.create(%w[miniswen .result.json]) do |file|
@@ -47,7 +49,7 @@ module Lemans
         end
       end
 
-      attr_reader :raw_result
+      def raw_result_for(_run_result) = @raw_result
 
       def outer_timeout = profile.timeout + profile.exec_timeout + EXEC_SLACK_SEC
 
@@ -64,9 +66,18 @@ module Lemans
         policy.mode == "allowlist" ? policy.domains : []
       end
 
-      def command_for(task)
+      def upload_history(environment, history)
+        Tempfile.create(%w[miniswen .history.json]) do |file|
+          file.write(JSON.generate(history.to_h))
+          file.flush
+          environment.upload(file.path, HISTORY_PATH)
+        end
+      end
+
+      def command_for(task, history: nil)
         argv = [ "miniswen", "-q", "--no-refresh-registry", "--jail",
-                "-m", model.to_s, "-p", task.instruction,
+                "-m", model.to_s,
+                *(history ? [ "--continue-from", HISTORY_PATH ] : [ "-p", task.instruction ]),
                 "--results-path", RESULTS_PATH,
                 "--max-steps", profile.step_limit, "--max-time", profile.timeout.to_i,
                 "--exec-timeout", profile.exec_timeout.to_i,

data/lib/lemans/agents/nop.rb

@@ -7,7 +7,7 @@ module Lemans
     class Nop < Agent
       NAME = "nop"
 
-      def run(_task, _environment)
+      def run(_task, _environment, history: nil)
         Response.new(outcome: Result::Outcome.new(:completed), usage: Result::Usage.zero)
       end
     end

data/lib/lemans/agents/oracle.rb

@@ -13,7 +13,7 @@ module Lemans
       ENTRYPOINT = "solve.sh"
       PATCH = "solution.patch"
 
-      def run(task, environment)
+      def run(task, environment, history: nil)
         files = task.solution_files
         if files.empty?
           raise ConfigError, "#{task.name}: no solution/ to run — the oracle has nothing to prove" if

data/lib/lemans/agents.rb

@@ -11,11 +11,13 @@ module Lemans
       "miniswen-installed" => "MiniswenInstalled"
     }.freeze
 
-    def self.build(name, profile:, model: nil)
+    def self.build(name, profile:, model: nil) = lookup(name).new(profile: profile, model: model)
+
+    def self.lookup(name)
       constant = REGISTRY[name] or
         raise ConfigError, "unknown agent #{name.inspect} (known: #{REGISTRY.keys.join(", ")})"
 
-      const_get(constant).new(profile: profile, model: model)
+      const_get(constant)
     end
   end
 end

data/lib/lemans/cli.rb

@@ -78,49 +78,80 @@ module Lemans
         return
       end
 
-      reporter =
-        if interactive?
-          BoardReporter.new(tasks: tasks.map(&:name), models: config.models,
-                            attempts: config.attempts, total: runner.attempts.size)
-        else
-          ProgressReporter.new(shell:, tasks: tasks.map(&:name))
-        end
+      execute(runner, store, tasks)
+    rescue ConfigError => e
+      raise Thor::Error, "lemans: #{e.message}"
+    rescue Interrupt
+      say ""
+      exit 130
+    end
 
-      reporter.start
+    desc "restart RUN...", "Continue failed multistep runs from their last settled step in new runs"
+    long_desc <<~DESC
+      RUN is a run directory or a trial id; every run named restarts under the same options. The new run replays the settled steps' agent patches in a
+      fresh sandbox and starts at the next step; the failed run stays as it is. --recover also replays
+      the failed step's partial patch and lets the agent go on from its history; --reverify replays the
+      graded step's patch and runs its verification again.
+    DESC
+    option :bench, default: ".", desc: "Directory holding bench.yml"
+    option :runs_dir, default: "./runs", desc: "Directory holding the runs; the new runs go there too"
+    option :concurrency, type: :numeric, aliases: "-c", desc: "Restarts in flight at once (default: the bench's)"
+    option :backend, enum: Environments::BACKENDS.keys, desc: "Sandbox backend (default: daytona)"
+    option :max_output_tokens, type: :numeric, banner: "TOKENS",
+                               desc: "Cap the agent's output per model call (default: the provider's)"
+    option :recover, type: :boolean, default: false,
+                     desc: "Continue the failed step's agent session from its saved history"
+    option :reverify, type: :boolean, default: false,
+                      desc: "Grade the last verified step again (with the current tests) and go on from there"
+    option :allow_scored, type: :boolean, default: false, desc: "Restart a scored run (--reverify always may)"
+    def restart(*runs)
+      raise Thor::Error, "lemans: name the run(s) to restart" if runs.empty?
+      raise Thor::Error, "lemans: --recover and --reverify exclude each other" if options[:recover] && options[:reverify]
 
-      summary = runner.run(reporter)
+      Miniswen.refresh_registry!
 
-      say ""
-      say_status :report, "collecting results from #{options[:runs_dir]}", :cyan
-      print_report Report.load(store)
+      store = Stores::FS.new(options[:runs_dir], filterer: SecretsFilter.default)
+      ids = runs.map { File.basename(it) }.uniq
+      found = store.fetch.select { ids.include?(it.id) }.to_h { [ it.id, it ] }
+      missing = ids - found.keys
+      raise Thor::Error, "lemans: no run #{missing.join(", ")} under #{options[:runs_dir]}" if missing.any?
 
-      exit 130 if summary.status == :interrupted
-      exit 1 if summary.status == :invalid
+      sources = found.values_at(*ids)
+
+      # The board lays out every model the runs used, as wide as their highest attempt
+      config = Config.load_file(options[:bench])
+      config.load_options(**options.transform_keys(&:to_sym), model: sources.map(&:model).uniq,
+                                                              attempts: sources.filter_map(&:index).max)
+
+      tasks = filter_tasks(config.tasks, name: sources.map(&:task).uniq)
+
+      mode = (:recover if options[:recover]) || (:reverify if options[:reverify])
+      runner = Runner.new(config, tasks, store:, restarts: sources, restart_mode: mode, allow_scored: options[:allow_scored])
+
+      execute(runner, store, tasks)
     rescue ConfigError => e
       raise Thor::Error, "lemans: #{e.message}"
     rescue Interrupt
       say ""
       exit 130
-    ensure
-      reporter&.stop
     end
 
-    desc "clobber", "Delete run results"
-    option :runs_dir, default: "./runs", desc: "Directory holding run directories"
+    desc "clobber [RUNS_DIR]", "Delete run results"
+    option :runs_dir, default: "./runs", desc: "Directory holding run directories (or pass it as RUNS_DIR)"
     option :task, desc: "Only these tasks' runs", repeatable: true
     option :ttl, desc: "Only runs older than this (10m, 2h, 1d)"
     option :invalid, type: :boolean, default: false, desc: "Only runs that measured nothing (invalid or unreadable)"
     option :force, type: :boolean, default: false, aliases: "-f", desc: "Delete without asking"
-    def clobber
-      store = Stores::FS.new(options[:runs_dir])
+    def clobber(runs_dir = options[:runs_dir])
+      store = Stores::FS.new(runs_dir)
       clobber = Clobber.new(store, tasks: options[:task], ttl: options[:ttl], invalid: options[:invalid])
 
       doomed = clobber.matches
-      return say "lemans: nothing to clobber under #{options[:runs_dir]}" if doomed.empty?
+      return say "lemans: nothing to clobber under #{runs_dir}" if doomed.empty?
 
       unless options[:force]
         doomed.each { say it.id }
-        return say "lemans: nothing deleted" unless yes?("Delete #{doomed.size} run(s) under #{options[:runs_dir]}? [y/N]")
+        return say "lemans: nothing deleted" unless yes?("Delete #{doomed.size} run(s) under #{runs_dir}? [y/N]")
       end
 
       removed = clobber.execute!
@@ -129,15 +160,15 @@ module Lemans
       raise Thor::Error, "lemans: #{e.message}"
     end
 
-    desc "regrade", "Re-grade stored results from their checks.json after a verification_test.rb grading change"
+    desc "regrade [RUNS_DIR]", "Re-grade stored results from their checks.json after a verification_test.rb grading change"
     option :bench, default: ".", desc: "Directory holding bench.yml"
     option :task, desc: "Re-grade these tasks' runs", repeatable: true, required: true
-    option :runs_dir, default: "./runs", desc: "Directory holding run directories"
+    option :runs_dir, default: "./runs", desc: "Directory holding run directories (or pass it as RUNS_DIR)"
     option :mapping, banner: "PATH",
                      desc: "Grade by this checks.json-shaped file (every check `fail` or `fail (allowed)`, plus `grading`) " \
                            "instead of reading verification_test.rb"
-    def regrade
-      store = Stores::FS.new(options[:runs_dir])
+    def regrade(runs_dir = options[:runs_dir])
+      store = Stores::FS.new(runs_dir)
       tasks = filter_tasks(Config.load_file(options[:bench]).tasks, name: options[:task])
       raise Thor::Error, "lemans: --mapping re-grades one task at a time" if options[:mapping] && tasks.size > 1
 
@@ -153,14 +184,14 @@ module Lemans
       end
 
       say ""
-      say_status :report, "collecting results from #{options[:runs_dir]}", :cyan
+      say_status :report, "collecting results from #{runs_dir}", :cyan
       print_report Report.load(store, names: tasks.map(&:name))
     rescue ConfigError => e
       raise Thor::Error, "lemans: #{e.message}"
     end
 
-    desc "report", "Summarize run results as a table or CSV"
-    option :runs_dir, default: "runs", desc: "Directory holding run directories"
+    desc "report [RUNS_DIR]", "Summarize run results as a table or CSV"
+    option :runs_dir, default: "runs", desc: "Directory holding run directories (or pass it as RUNS_DIR)"
     option :tag, desc: "Only runs whose result carries this tag", repeatable: true
     option :task, desc: "Only these tasks' runs", repeatable: true
     option :metadata, banner: "KEY:VALUE", desc: "Only runs whose task metadata has this value (every pair must match)",
@@ -169,8 +200,8 @@ module Lemans
     option :aggregate, aliases: "-A", banner: "COLUMNS", lazy_default: "task-model",
                        desc: "Group results by 1-3 dash-joined columns (task, agent, model)"
     option :sort, aliases: "-S", banner: "COLUMN", desc: "Sort by a column"
-    def report
-      store = Stores::FS.new(options[:runs_dir])
+    def report(runs_dir = options[:runs_dir])
+      store = Stores::FS.new(runs_dir)
       results = Report.load(store, tags: options[:tag], names: options[:task],
                                    metadata: Report.metadata_filter(options[:metadata]))
       raise Thor::Error, "lemans: no matching results found" if results.empty?
@@ -184,6 +215,29 @@ module Lemans
 
     private
 
+    def execute(runner, store, tasks)
+      reporter =
+        if interactive?
+          BoardReporter.new(tasks: tasks.map(&:name), models: runner.config.models,
+                            attempts: runner.config.attempts, total: runner.attempts.size)
+        else
+          ProgressReporter.new(shell:, tasks: tasks.map(&:name))
+        end
+
+      reporter.start
+
+      summary = runner.run(reporter)
+
+      say ""
+      say_status :report, "collecting results from #{options[:runs_dir]}", :cyan
+      print_report Report.load(store)
+
+      exit 130 if summary.status == :interrupted
+      exit 1 if summary.status == :invalid
+    ensure
+      reporter&.stop
+    end
+
     def filter_tasks(tasks, tags: nil, name: nil)
       tasks = tasks.dup
 

data/lib/lemans/environments/docker/proxy/Dockerfile

@@ -0,0 +1,4 @@
+FROM ruby:3.4-alpine
+COPY server.rb /server.rb
+EXPOSE 3128
+ENTRYPOINT ["ruby", "/server.rb"]

data/lib/lemans/environments/docker/proxy/README.md

@@ -0,0 +1,49 @@
+# Allowlist proxy
+
+This is an HTTP proxy that lets clients reach the allowed hosts only. The Docker backend runs it for the `allowlist` network mode.
+
+The proxy supports two request types:
+
+- `CONNECT host:port` tunnels (https).
+- Absolute-form requests (`GET http://host/path`) for plain http.
+
+The proxy refuses a host that is not on the list with `403 Forbidden`. Host names must match exactly. IP ranges are not supported.
+
+## How the Docker backend uses it
+
+1. Lemans puts the task container on an internal network. An internal network has no route out.
+2. Lemans connects the proxy container to the internal network and to `bridge`.
+3. Lemans sets `http_proxy` and `https_proxy` for each command in the task container.
+
+A tool that ignores the proxy variables cannot reach the network.
+
+When the allowed hosts change, lemans replaces the proxy container.
+
+## Run it standalone
+
+Build the image:
+
+```sh
+docker build --tag lemans-proxy lib/lemans/environments/docker/proxy
+```
+
+Start the proxy. Give the allowed hosts as arguments:
+
+```sh
+docker run --rm --publish 3128:3128 lemans-proxy rubygems.org index.rubygems.org
+```
+
+Send requests through it:
+
+```sh
+curl --proxy http://localhost:3128 https://rubygems.org   # allowed
+curl --proxy http://localhost:3128 https://example.com    # 403 Forbidden
+```
+
+To run it without Docker, use Ruby 3.4 or later:
+
+```sh
+ruby lib/lemans/environments/docker/proxy/server.rb rubygems.org
+```
+
+The `PORT` variable changes the listen port. The default port is 3128.

data/lib/lemans/environments/docker/proxy/server.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require "socket"
+require "uri"
+
+# An HTTP proxy that lets clients reach the allowed hosts only:
+# CONNECT tunnels for https, absolute-form requests for plain http.
+class AllowlistProxy
+  HOP_HEADERS = /\A(?:connection|keep-alive|proxy-[\w-]+):/i
+
+  def initialize(hosts, port: 3128)
+    @hosts = hosts.map(&:downcase)
+    @port = port
+  end
+
+  def run
+    server = TCPServer.new("0.0.0.0", @port)
+    $stdout.puts "listening on #{@port}: #{@hosts.join(", ")}"
+    $stdout.flush
+    Thread.report_on_exception = false
+    loop { Thread.new(server.accept) { handle(it) } }
+  end
+
+  private
+
+  def handle(client)
+    head = client.gets("\r\n\r\n") or return
+    request_line, *headers = head.split("\r\n")
+    verb, target, version = request_line.split(" ", 3)
+
+    verb == "CONNECT" ? tunnel(client, target) : forward(client, verb, target, version, headers)
+  rescue SystemCallError, IOError, SocketError, URI::Error
+    client.write("HTTP/1.1 502 Bad Gateway\r\n\r\n") rescue nil # rubocop:disable Style/RescueModifier
+  ensure
+    client.close
+  end
+
+  def tunnel(client, target)
+    host, port = target.split(":", 2)
+    return deny(client) unless allowed?(host)
+
+    upstream = Socket.tcp(host, port.to_i, connect_timeout: 10)
+    client.write("HTTP/1.1 200 Connection Established\r\n\r\n")
+    pump(client, upstream)
+  end
+
+  # One request per connection: the upstream is told to close after the response.
+  def forward(client, verb, target, version, headers)
+    uri = URI(target)
+    return deny(client) unless uri.is_a?(URI::HTTP) && allowed?(uri.host)
+
+    upstream = Socket.tcp(uri.host, uri.port, connect_timeout: 10)
+    headers = headers.grep_v(HOP_HEADERS)
+    upstream.write("#{verb} #{uri.request_uri} #{version}\r\n#{headers.join("\r\n")}\r\nConnection: close\r\n\r\n")
+    pump(client, upstream)
+  end
+
+  def allowed?(host) = @hosts.include?(host.to_s.downcase)
+
+  def deny(client) = client.write("HTTP/1.1 403 Forbidden\r\n\r\n")
+
+  def pump(client, upstream)
+    Thread.new { copy(client, upstream) }
+    copy(upstream, client)
+  ensure
+    upstream.close
+  end
+
+  # readpartial drains what gets already buffered, so a request body is not lost.
+  def copy(from, to)
+    loop { to.write(from.readpartial(65_536)) }
+  rescue EOFError, IOError, SystemCallError
+    nil
+  ensure
+    to.close_write rescue nil # rubocop:disable Style/RescueModifier
+  end
+end
+
+AllowlistProxy.new(ARGV, port: Integer(ENV.fetch("PORT", "3128"))).run if $PROGRAM_NAME == __FILE__

data/lib/lemans/environments/docker.rb

@@ -12,6 +12,7 @@ module Lemans
       HOUSEKEEPING_TIMEOUT = 60
       MAX_OUTPUT_BYTES = 200_000
       EXEC_SLACK = 30
+      PROXY_PORT = 3128
 
       attr_reader :container
 
@@ -24,7 +25,8 @@ module Lemans
       end
 
       def start
-        build_image! if image.built?
+        build_image!(image) if image.built?
+        start_proxy!(network.hosts) if network.allowlist?
         docker!("run", *run_args, timeout: build_timeout)
         @container = @name
         self
@@ -37,9 +39,10 @@ module Lemans
         timeout ||= DEFAULT_TIMEOUT
         started = now
         argv = [ "exec" ]
+        env = proxy_env.merge(env) if network.allowlist?
         env.each { |key, value| argv += [ "--env", "#{key}=#{value}" ] }
         # The in-container timeout is what actually kills the process
-        argv += [ container, "timeout", timeout.to_i.to_s, "sh", "-c", command ]
+        argv += [ container, "timeout", timeout.to_i.to_s, "bash", "-c", command ]
 
         exit_code, output = capture("docker", *argv, timeout: timeout + EXEC_SLACK)
         ExecResult.new(command:, exit_code:, output:, duration: (now - started).round(3))
@@ -59,13 +62,13 @@ module Lemans
       def switch_network_policy!(policy)
         assert_policy_supported!(policy)
 
-        if policy.none?
-          connected_networks.each { docker!("network", "disconnect", it, container) }
-        else
-          networks = connected_networks
-          docker!("network", "disconnect", "none", container) if networks.include?("none")
-          docker!("network", "connect", "bridge", container) unless networks.include?("bridge")
-        end
+        wanted = ("bridge" if policy.public?) || (internal_network if policy.allowlist?)
+        networks = connected_networks
+        (networks - [ wanted ]).each { docker!("network", "disconnect", it, container) }
+
+        remove_proxy
+        start_proxy!(policy.hosts) if policy.allowlist?
+        docker!("network", "connect", wanted, container) if wanted && !networks.include?(wanted)
 
         @network = policy
       end
@@ -81,41 +84,101 @@ module Lemans
         end
       rescue StandardError => e
         warn "lemans: container #{container} may still be running — remove failed: #{e.class}: #{e.message}"
+      ensure
+        remove_proxy
+        remove_internal_network
       end
 
       private
 
       def assert_policy_supported!(policy)
-        return if policy.none? || policy.public?
+        return unless policy.allowlist? && policy.ip_targets.any?
 
-        raise ConfigError, "docker: #{policy.mode} is not supported (public and none only)"
+        raise ConfigError, "docker: an allowlist takes host names only (#{policy.ip_targets.join(", ")})"
       end
 
       # The tag is the content digest, so an existing image is the identical thing
-      def build_image!
-        exists, = capture("docker", "image", "inspect", image.name, timeout: HOUSEKEEPING_TIMEOUT)
+      def build_image!(spec)
+        exists, = capture("docker", "image", "inspect", spec.name, timeout: HOUSEKEEPING_TIMEOUT)
         return if exists.zero?
 
-        docker!("build", "--tag", image.name, image.context_dir.to_s, timeout: build_timeout, on_output: @logger)
+        docker!("build", "--tag", spec.name, spec.context_dir.to_s, timeout: build_timeout, on_output: @logger)
+      end
+
+      # The task container sits on an internal network with no route out; the
+      # proxy is on it and on bridge, so the hosts it allows are the only way out.
+      def start_proxy!(hosts)
+        image = Config::ImageSpec.dockerfile(Pathname(__dir__).join("docker/proxy/Dockerfile"), slug: "proxy")
+        build_image!(image)
+        create_internal_network!
+        docker!("run", "--detach", "--name", proxy_name, "--network", internal_network,
+                *label_args, image.name, *hosts)
+        docker!("network", "connect", "bridge", proxy_name)
+        wait_for_proxy!
+      end
+
+      def wait_for_proxy!(attempts: 50)
+        attempts.times do
+          _, output = capture("docker", "logs", proxy_name, timeout: HOUSEKEEPING_TIMEOUT)
+          return if output.include?("listening on")
+
+          sleep 0.2
+        end
+
+        raise InfrastructureError, "docker: the allowlist proxy did not start"
       end
 
+      def proxy_env
+        url = "http://#{proxy_name}:#{PROXY_PORT}"
+        no_proxy = "localhost,127.0.0.1"
+        { "http_proxy" => url, "https_proxy" => url, "HTTP_PROXY" => url, "HTTPS_PROXY" => url,
+          "no_proxy" => no_proxy, "NO_PROXY" => no_proxy }
+      end
+
+      def create_internal_network!
+        exists, = capture("docker", "network", "inspect", internal_network, timeout: HOUSEKEEPING_TIMEOUT)
+        return if exists.zero?
+
+        docker!("network", "create", "--internal", *label_args, internal_network)
+      end
+
+      def remove_proxy
+        capture("docker", "rm", "--force", proxy_name, timeout: HOUSEKEEPING_TIMEOUT)
+      rescue StandardError
+        nil
+      end
+
+      def remove_internal_network
+        capture("docker", "network", "rm", internal_network, timeout: HOUSEKEEPING_TIMEOUT)
+      rescue StandardError
+        nil
+      end
+
+      def proxy_name = "#{@name}-proxy"
+
+      def internal_network = "#{@name}-net"
+
       def run_args
         args = [ "--detach", "--init", "--name", @name,
                  "--cpus", resources.cpus.to_s, "--memory", "#{resources.memory}m",
                  "--cap-add", "SYS_ADMIN", "--cap-add", "NET_ADMIN", "--security-opt", "apparmor=unconfined",
                  "--entrypoint", "sh" ]
         args += [ "--network", "none" ] if network.none?
+        args += [ "--network", internal_network ] if network.allowlist?
         env.each { |key, value| args += [ "--env", "#{key}=#{value}" ] }
-        labels.each { |key, value| args += [ "--label", "#{key}=#{value}" ] }
-        args + [ image.name, "-c", "tail -f /dev/null" ]
+        args + label_args + [ image.name, "-c", "tail -f /dev/null" ]
       end
 
+      def label_args = labels.flat_map { |key, value| [ "--label", "#{key}=#{value}" ] }
+
       def connected_networks
         docker!("inspect", "--format", "{{range $name, $_ := .NetworkSettings.Networks}}{{$name}} {{end}}", container).split
       end
 
       def remove
         capture("docker", "rm", "--force", "--volumes", @name, timeout: HOUSEKEEPING_TIMEOUT)
+        remove_proxy
+        remove_internal_network
       rescue StandardError
         nil
       end