@herdctl/core 2.0.1 → 2.1.0

package/dist/config/schema.d.ts

@@ -4,6 +4,7 @@
  * Validates herdctl.yaml fleet configuration
  */
 import { z } from "zod";
+import type { HostConfig } from "dockerode";
 export declare const PermissionModeSchema: z.ZodEnum<["default", "acceptEdits", "bypassPermissions", "plan", "delegate", "dontAsk"]>;
 export declare const BashPermissionsSchema: z.ZodObject<{
     allowed_commands: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -292,27 +293,147 @@ export declare const InstancesSchema: z.ZodObject<{
  */
 export declare const DockerNetworkModeSchema: z.ZodEnum<["none", "bridge", "host"]>;
 /**
- * Docker container configuration schema
+ * Agent-level Docker configuration schema (safe options only)
  *
- * Supports container lifecycle, resource limits, and security options.
- * All options are optional - defaults provide secure, sensible configuration.
+ * These options can be specified in agent config files (herdctl-agent.yml).
+ * Only includes safe options that don't pose security risks if an agent
+ * could modify its own config file.
+ *
+ * For dangerous options (network, volumes, image, user, ports, env),
+ * use FleetDockerSchema at the fleet level.
  *
  * @example
  * ```yaml
  * docker:
  *   enabled: true
  *   ephemeral: false        # Reuse container across jobs
- *   image: anthropic/claude-code:latest
- *   network: bridge         # Full network access
  *   memory: 2g              # Memory limit
  *   cpu_shares: 512         # CPU weight
- *   user: "1000:1000"       # Run as specific UID:GID
- *   max_containers: 5       # Keep last 5 containers per agent
- *   volumes:                # Additional volume mounts
- *     - "/host/data:/container/data:ro"
+ *   pids_limit: 100         # Prevent fork bombs
+ *   tmpfs:
+ *     - "/tmp"
+ * ```
+ */
+export declare const AgentDockerSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
+    /** Enable Docker containerization for this agent (default: false) */
+    enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    /** Use ephemeral containers (fresh per job, auto-removed) vs persistent (reuse across jobs, kept for inspection) */
+    ephemeral: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    /** Memory limit (e.g., "2g", "512m") (default: 2g) */
+    memory: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /** CPU shares (relative weight, 512 is normal) */
+    cpu_shares: z.ZodOptional<z.ZodNumber>;
+    /** Maximum containers to keep per agent before cleanup (default: 5) */
+    max_containers: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Workspace mount mode: rw (read-write, default) or ro (read-only) */
+    workspace_mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["rw", "ro"]>>>;
+    /** Tmpfs mounts in format "path" or "path:options" (e.g., "/tmp", "/tmp:size=100m,mode=1777") */
+    tmpfs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Maximum number of processes (PIDs) allowed in the container (prevents fork bombs) */
+    pids_limit: z.ZodOptional<z.ZodNumber>;
+    /** Container labels for organization and filtering */
+    labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** CPU period in microseconds (default: 100000 = 100ms). Used with cpu_quota for hard CPU limits. */
+    cpu_period: z.ZodOptional<z.ZodNumber>;
+    /** CPU quota in microseconds per cpu_period. E.g., cpu_period=100000 + cpu_quota=50000 = 50% of one CPU. */
+    cpu_quota: z.ZodOptional<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    labels?: Record<string, string> | undefined;
+    cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+}>, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    labels?: Record<string, string> | undefined;
+    cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+}>, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    labels?: Record<string, string> | undefined;
+    cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+}>;
+/**
+ * Fleet-level Docker configuration schema (all options)
+ *
+ * Includes all safe options from AgentDockerSchema plus dangerous options
+ * that should only be specified at the fleet level (in herdctl.yml).
+ *
+ * Also supports a `host_config` passthrough for raw dockerode HostConfig
+ * options not explicitly modeled in our schema.
+ *
+ * @example
+ * ```yaml
+ * defaults:
+ *   docker:
+ *     enabled: true
+ *     image: anthropic/claude-code:latest
+ *     network: bridge
+ *     memory: 2g
+ *     volumes:
+ *       - "/host/data:/container/data:ro"
+ *     host_config:           # Raw dockerode passthrough
+ *       ShmSize: 67108864
  * ```
  */
-export declare const DockerSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
+export declare const FleetDockerSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
     /** Enable Docker containerization for this agent (default: false) */
     enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     /** Use ephemeral containers (fresh per job, auto-removed) vs persistent (reuse across jobs, kept for inspection) */
@@ -335,112 +456,551 @@ export declare const DockerSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodO
     workspace_mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["rw", "ro"]>>>;
     /** Environment variables to pass to the container (supports ${VAR} interpolation) */
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** Port bindings in format "hostPort:containerPort" or "containerPort" (e.g., "8080:80", "3000") */
+    ports: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Tmpfs mounts in format "path" or "path:options" (e.g., "/tmp", "/tmp:size=100m,mode=1777") */
+    tmpfs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Maximum number of processes (PIDs) allowed in the container (prevents fork bombs) */
+    pids_limit: z.ZodOptional<z.ZodNumber>;
+    /** Container labels for organization and filtering */
+    labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** CPU period in microseconds (default: 100000 = 100ms). Used with cpu_quota for hard CPU limits. */
+    cpu_period: z.ZodOptional<z.ZodNumber>;
+    /** CPU quota in microseconds per cpu_period. E.g., cpu_period=100000 + cpu_quota=50000 = 50% of one CPU. */
+    cpu_quota: z.ZodOptional<z.ZodNumber>;
     /** @deprecated Use 'image' instead */
     base_image: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
+    /**
+     * Raw dockerode HostConfig passthrough for advanced options.
+     * Values here override any translated options (e.g., host_config.Memory overrides memory).
+     * See dockerode documentation for available options.
+     */
+    host_config: z.ZodOptional<z.ZodType<HostConfig, z.ZodTypeDef, HostConfig>>;
+}, "strict", z.ZodTypeAny, {
     enabled: boolean;
     ephemeral: boolean;
-    network: "none" | "bridge" | "host";
     memory: string;
     max_containers: number;
     workspace_mode: "rw" | "ro";
-    image?: string | undefined;
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
     cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
     user?: string | undefined;
     volumes?: string[] | undefined;
     env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
     base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
 }, {
+    labels?: Record<string, string> | undefined;
     enabled?: boolean | undefined;
     ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
     image?: string | undefined;
     network?: "none" | "bridge" | "host" | undefined;
-    memory?: string | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}>, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
     cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
     user?: string | undefined;
-    max_containers?: number | undefined;
     volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
     workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    network?: "none" | "bridge" | "host" | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
     env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
     base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
 }>, {
     enabled: boolean;
     ephemeral: boolean;
-    network: "none" | "bridge" | "host";
     memory: string;
     max_containers: number;
     workspace_mode: "rw" | "ro";
-    image?: string | undefined;
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
     cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
     user?: string | undefined;
     volumes?: string[] | undefined;
     env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
     base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
 }, {
+    labels?: Record<string, string> | undefined;
     enabled?: boolean | undefined;
     ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
     image?: string | undefined;
     network?: "none" | "bridge" | "host" | undefined;
-    memory?: string | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}>, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
     cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
     user?: string | undefined;
-    max_containers?: number | undefined;
     volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
     workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    network?: "none" | "bridge" | "host" | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
     env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
     base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
 }>, {
     enabled: boolean;
     ephemeral: boolean;
-    network: "none" | "bridge" | "host";
     memory: string;
     max_containers: number;
     workspace_mode: "rw" | "ro";
-    image?: string | undefined;
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
     cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
     user?: string | undefined;
     volumes?: string[] | undefined;
     env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
     base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
 }, {
+    labels?: Record<string, string> | undefined;
     enabled?: boolean | undefined;
     ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
     image?: string | undefined;
     network?: "none" | "bridge" | "host" | undefined;
-    memory?: string | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}>, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
     cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
     user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
     max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    network?: "none" | "bridge" | "host" | undefined;
+    user?: string | undefined;
     volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}>;
+/** @deprecated Use AgentDockerSchema or FleetDockerSchema instead */
+export declare const DockerSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
+    /** Enable Docker containerization for this agent (default: false) */
+    enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    /** Use ephemeral containers (fresh per job, auto-removed) vs persistent (reuse across jobs, kept for inspection) */
+    ephemeral: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    /** Docker image to use (default: anthropic/claude-code:latest) */
+    image: z.ZodOptional<z.ZodString>;
+    /** Network isolation mode (default: bridge for full network access) */
+    network: z.ZodDefault<z.ZodOptional<z.ZodEnum<["none", "bridge", "host"]>>>;
+    /** Memory limit (e.g., "2g", "512m") (default: 2g) */
+    memory: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /** CPU shares (relative weight, 512 is normal) */
+    cpu_shares: z.ZodOptional<z.ZodNumber>;
+    /** Container user as "UID:GID" string (default: match host user) */
+    user: z.ZodOptional<z.ZodString>;
+    /** Maximum containers to keep per agent before cleanup (default: 5) */
+    max_containers: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Additional volume mounts in Docker format: "host:container:mode" */
+    volumes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Workspace mount mode: rw (read-write, default) or ro (read-only) */
+    workspace_mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["rw", "ro"]>>>;
+    /** Environment variables to pass to the container (supports ${VAR} interpolation) */
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** Port bindings in format "hostPort:containerPort" or "containerPort" (e.g., "8080:80", "3000") */
+    ports: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Tmpfs mounts in format "path" or "path:options" (e.g., "/tmp", "/tmp:size=100m,mode=1777") */
+    tmpfs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Maximum number of processes (PIDs) allowed in the container (prevents fork bombs) */
+    pids_limit: z.ZodOptional<z.ZodNumber>;
+    /** Container labels for organization and filtering */
+    labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** CPU period in microseconds (default: 100000 = 100ms). Used with cpu_quota for hard CPU limits. */
+    cpu_period: z.ZodOptional<z.ZodNumber>;
+    /** CPU quota in microseconds per cpu_period. E.g., cpu_period=100000 + cpu_quota=50000 = 50% of one CPU. */
+    cpu_quota: z.ZodOptional<z.ZodNumber>;
+    /** @deprecated Use 'image' instead */
+    base_image: z.ZodOptional<z.ZodString>;
+    /**
+     * Raw dockerode HostConfig passthrough for advanced options.
+     * Values here override any translated options (e.g., host_config.Memory overrides memory).
+     * See dockerode documentation for available options.
+     */
+    host_config: z.ZodOptional<z.ZodType<HostConfig, z.ZodTypeDef, HostConfig>>;
+}, "strict", z.ZodTypeAny, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
+    cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
     workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    network?: "none" | "bridge" | "host" | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
     env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
     base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
 }>, {
     enabled: boolean;
     ephemeral: boolean;
-    network: "none" | "bridge" | "host";
     memory: string;
     max_containers: number;
     workspace_mode: "rw" | "ro";
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
+    cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
     image?: string | undefined;
+    network?: "none" | "bridge" | "host" | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}>, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
     cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
     user?: string | undefined;
     volumes?: string[] | undefined;
     env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
     base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
 }, {
+    labels?: Record<string, string> | undefined;
     enabled?: boolean | undefined;
     ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
     image?: string | undefined;
     network?: "none" | "bridge" | "host" | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}>, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
+    cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
     memory?: string | undefined;
     cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    network?: "none" | "bridge" | "host" | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}>, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
+    cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
     user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
     max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    network?: "none" | "bridge" | "host" | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}>, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
+    cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    user?: string | undefined;
     volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
     workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    network?: "none" | "bridge" | "host" | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
     env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
     base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
 }>;
 export declare const SessionSchema: z.ZodObject<{
     max_turns: z.ZodOptional<z.ZodNumber>;
@@ -456,7 +1016,7 @@ export declare const SessionSchema: z.ZodObject<{
     model?: string | undefined;
 }>;
 export declare const DefaultsSchema: z.ZodObject<{
-    docker: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
+    docker: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
         /** Enable Docker containerization for this agent (default: false) */
         enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         /** Use ephemeral containers (fresh per job, auto-removed) vs persistent (reuse across jobs, kept for inspection) */
@@ -479,112 +1039,266 @@ export declare const DefaultsSchema: z.ZodObject<{
         workspace_mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["rw", "ro"]>>>;
         /** Environment variables to pass to the container (supports ${VAR} interpolation) */
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /** Port bindings in format "hostPort:containerPort" or "containerPort" (e.g., "8080:80", "3000") */
+        ports: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Tmpfs mounts in format "path" or "path:options" (e.g., "/tmp", "/tmp:size=100m,mode=1777") */
+        tmpfs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Maximum number of processes (PIDs) allowed in the container (prevents fork bombs) */
+        pids_limit: z.ZodOptional<z.ZodNumber>;
+        /** Container labels for organization and filtering */
+        labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /** CPU period in microseconds (default: 100000 = 100ms). Used with cpu_quota for hard CPU limits. */
+        cpu_period: z.ZodOptional<z.ZodNumber>;
+        /** CPU quota in microseconds per cpu_period. E.g., cpu_period=100000 + cpu_quota=50000 = 50% of one CPU. */
+        cpu_quota: z.ZodOptional<z.ZodNumber>;
         /** @deprecated Use 'image' instead */
         base_image: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
+        /**
+         * Raw dockerode HostConfig passthrough for advanced options.
+         * Values here override any translated options (e.g., host_config.Memory overrides memory).
+         * See dockerode documentation for available options.
+         */
+        host_config: z.ZodOptional<z.ZodType<HostConfig, z.ZodTypeDef, HostConfig>>;
+    }, "strict", z.ZodTypeAny, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
         volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }>, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
         volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }>, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
         volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
+        memory?: string | undefined;
+        cpu_shares?: number | undefined;
+        max_containers?: number | undefined;
+        workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
         image?: string | undefined;
         network?: "none" | "bridge" | "host" | undefined;
-        memory?: string | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
+        base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
+    }>, {
+        enabled: boolean;
+        ephemeral: boolean;
+        memory: string;
+        max_containers: number;
+        workspace_mode: "rw" | "ro";
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
-        max_containers?: number | undefined;
         volumes?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
+        base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
+    }, {
+        labels?: Record<string, string> | undefined;
+        enabled?: boolean | undefined;
+        ephemeral?: boolean | undefined;
+        memory?: string | undefined;
+        cpu_shares?: number | undefined;
+        max_containers?: number | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }>, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
         volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
+        memory?: string | undefined;
+        cpu_shares?: number | undefined;
+        max_containers?: number | undefined;
+        workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
         image?: string | undefined;
         network?: "none" | "bridge" | "host" | undefined;
-        memory?: string | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
+        base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
+    }>, {
+        enabled: boolean;
+        ephemeral: boolean;
+        memory: string;
+        max_containers: number;
+        workspace_mode: "rw" | "ro";
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
-        max_containers?: number | undefined;
         volumes?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
+        base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
+    }, {
+        labels?: Record<string, string> | undefined;
+        enabled?: boolean | undefined;
+        ephemeral?: boolean | undefined;
+        memory?: string | undefined;
+        cpu_shares?: number | undefined;
+        max_containers?: number | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }>>;
     permissions: z.ZodOptional<z.ZodObject<{
         mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["default", "acceptEdits", "bypassPermissions", "plan", "delegate", "dontAsk"]>>>;
@@ -748,16 +1462,23 @@ export declare const DefaultsSchema: z.ZodObject<{
     docker?: {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
         volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     } | undefined;
     permissions?: {
         mode: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk";
@@ -808,18 +1529,25 @@ export declare const DefaultsSchema: z.ZodObject<{
     max_turns?: number | undefined;
     model?: string | undefined;
     docker?: {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     } | undefined;
     permissions?: {
         mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
@@ -3080,135 +3808,101 @@ export declare const AgentConfigSchema: z.ZodObject<{
             when?: string | undefined;
         })[] | undefined;
     }>>;
-    docker: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
+    docker: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodObject<{
         /** Enable Docker containerization for this agent (default: false) */
         enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         /** Use ephemeral containers (fresh per job, auto-removed) vs persistent (reuse across jobs, kept for inspection) */
         ephemeral: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-        /** Docker image to use (default: anthropic/claude-code:latest) */
-        image: z.ZodOptional<z.ZodString>;
-        /** Network isolation mode (default: bridge for full network access) */
-        network: z.ZodDefault<z.ZodOptional<z.ZodEnum<["none", "bridge", "host"]>>>;
         /** Memory limit (e.g., "2g", "512m") (default: 2g) */
         memory: z.ZodDefault<z.ZodOptional<z.ZodString>>;
         /** CPU shares (relative weight, 512 is normal) */
         cpu_shares: z.ZodOptional<z.ZodNumber>;
-        /** Container user as "UID:GID" string (default: match host user) */
-        user: z.ZodOptional<z.ZodString>;
         /** Maximum containers to keep per agent before cleanup (default: 5) */
         max_containers: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-        /** Additional volume mounts in Docker format: "host:container:mode" */
-        volumes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         /** Workspace mount mode: rw (read-write, default) or ro (read-only) */
         workspace_mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["rw", "ro"]>>>;
-        /** Environment variables to pass to the container (supports ${VAR} interpolation) */
-        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        /** @deprecated Use 'image' instead */
-        base_image: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        enabled: boolean;
-        ephemeral: boolean;
-        network: "none" | "bridge" | "host";
-        memory: string;
-        max_containers: number;
-        workspace_mode: "rw" | "ro";
-        image?: string | undefined;
-        cpu_shares?: number | undefined;
-        user?: string | undefined;
-        volumes?: string[] | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
-    }, {
-        enabled?: boolean | undefined;
-        ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
-        memory?: string | undefined;
-        cpu_shares?: number | undefined;
-        user?: string | undefined;
-        max_containers?: number | undefined;
-        volumes?: string[] | undefined;
-        workspace_mode?: "rw" | "ro" | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
-    }>, {
+        /** Tmpfs mounts in format "path" or "path:options" (e.g., "/tmp", "/tmp:size=100m,mode=1777") */
+        tmpfs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Maximum number of processes (PIDs) allowed in the container (prevents fork bombs) */
+        pids_limit: z.ZodOptional<z.ZodNumber>;
+        /** Container labels for organization and filtering */
+        labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /** CPU period in microseconds (default: 100000 = 100ms). Used with cpu_quota for hard CPU limits. */
+        cpu_period: z.ZodOptional<z.ZodNumber>;
+        /** CPU quota in microseconds per cpu_period. E.g., cpu_period=100000 + cpu_quota=50000 = 50% of one CPU. */
+        cpu_quota: z.ZodOptional<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
-        volumes?: string[] | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
     }>, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
-        cpu_shares?: number | undefined;
-        user?: string | undefined;
-        volumes?: string[] | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
+        labels?: Record<string, string> | undefined;
+        cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
     }>, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
-        volumes?: string[] | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
     }>>;
     instances: z.ZodOptional<z.ZodObject<{
         max_concurrent: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
@@ -3248,16 +3942,15 @@ export declare const AgentConfigSchema: z.ZodObject<{
     docker?: {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
-        volumes?: string[] | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
     } | undefined;
     permissions?: {
         mode: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk";
@@ -3445,18 +4138,17 @@ export declare const AgentConfigSchema: z.ZodObject<{
     max_turns?: number | undefined;
     model?: string | undefined;
     docker?: {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
     } | undefined;
     permissions?: {
         mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
@@ -3707,7 +4399,7 @@ export declare const FleetConfigSchema: z.ZodObject<{
         description?: string | undefined;
     }>>;
     defaults: z.ZodOptional<z.ZodObject<{
-        docker: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
+        docker: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
             /** Enable Docker containerization for this agent (default: false) */
             enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
             /** Use ephemeral containers (fresh per job, auto-removed) vs persistent (reuse across jobs, kept for inspection) */
@@ -3730,112 +4422,266 @@ export declare const FleetConfigSchema: z.ZodObject<{
             workspace_mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["rw", "ro"]>>>;
             /** Environment variables to pass to the container (supports ${VAR} interpolation) */
             env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            /** Port bindings in format "hostPort:containerPort" or "containerPort" (e.g., "8080:80", "3000") */
+            ports: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** Tmpfs mounts in format "path" or "path:options" (e.g., "/tmp", "/tmp:size=100m,mode=1777") */
+            tmpfs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** Maximum number of processes (PIDs) allowed in the container (prevents fork bombs) */
+            pids_limit: z.ZodOptional<z.ZodNumber>;
+            /** Container labels for organization and filtering */
+            labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            /** CPU period in microseconds (default: 100000 = 100ms). Used with cpu_quota for hard CPU limits. */
+            cpu_period: z.ZodOptional<z.ZodNumber>;
+            /** CPU quota in microseconds per cpu_period. E.g., cpu_period=100000 + cpu_quota=50000 = 50% of one CPU. */
+            cpu_quota: z.ZodOptional<z.ZodNumber>;
             /** @deprecated Use 'image' instead */
             base_image: z.ZodOptional<z.ZodString>;
-        }, "strip", z.ZodTypeAny, {
+            /**
+             * Raw dockerode HostConfig passthrough for advanced options.
+             * Values here override any translated options (e.g., host_config.Memory overrides memory).
+             * See dockerode documentation for available options.
+             */
+            host_config: z.ZodOptional<z.ZodType<HostConfig, z.ZodTypeDef, HostConfig>>;
+        }, "strict", z.ZodTypeAny, {
             enabled: boolean;
             ephemeral: boolean;
-            network: "none" | "bridge" | "host";
             memory: string;
             max_containers: number;
             workspace_mode: "rw" | "ro";
-            image?: string | undefined;
+            network: "none" | "bridge" | "host";
+            labels?: Record<string, string> | undefined;
             cpu_shares?: number | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
             user?: string | undefined;
             volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         }, {
+            labels?: Record<string, string> | undefined;
             enabled?: boolean | undefined;
             ephemeral?: boolean | undefined;
-            image?: string | undefined;
-            network?: "none" | "bridge" | "host" | undefined;
             memory?: string | undefined;
             cpu_shares?: number | undefined;
-            user?: string | undefined;
             max_containers?: number | undefined;
-            volumes?: string[] | undefined;
             workspace_mode?: "rw" | "ro" | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
+            network?: "none" | "bridge" | "host" | undefined;
+            user?: string | undefined;
+            volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         }>, {
             enabled: boolean;
             ephemeral: boolean;
-            network: "none" | "bridge" | "host";
             memory: string;
             max_containers: number;
             workspace_mode: "rw" | "ro";
-            image?: string | undefined;
+            network: "none" | "bridge" | "host";
+            labels?: Record<string, string> | undefined;
             cpu_shares?: number | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
             user?: string | undefined;
             volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         }, {
+            labels?: Record<string, string> | undefined;
             enabled?: boolean | undefined;
             ephemeral?: boolean | undefined;
-            image?: string | undefined;
-            network?: "none" | "bridge" | "host" | undefined;
             memory?: string | undefined;
             cpu_shares?: number | undefined;
-            user?: string | undefined;
             max_containers?: number | undefined;
-            volumes?: string[] | undefined;
             workspace_mode?: "rw" | "ro" | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
+            network?: "none" | "bridge" | "host" | undefined;
+            user?: string | undefined;
+            volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         }>, {
             enabled: boolean;
             ephemeral: boolean;
-            network: "none" | "bridge" | "host";
             memory: string;
             max_containers: number;
             workspace_mode: "rw" | "ro";
-            image?: string | undefined;
+            network: "none" | "bridge" | "host";
+            labels?: Record<string, string> | undefined;
             cpu_shares?: number | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
             user?: string | undefined;
             volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         }, {
+            labels?: Record<string, string> | undefined;
             enabled?: boolean | undefined;
             ephemeral?: boolean | undefined;
+            memory?: string | undefined;
+            cpu_shares?: number | undefined;
+            max_containers?: number | undefined;
+            workspace_mode?: "rw" | "ro" | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
             image?: string | undefined;
             network?: "none" | "bridge" | "host" | undefined;
-            memory?: string | undefined;
+            user?: string | undefined;
+            volumes?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
+            base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
+        }>, {
+            enabled: boolean;
+            ephemeral: boolean;
+            memory: string;
+            max_containers: number;
+            workspace_mode: "rw" | "ro";
+            network: "none" | "bridge" | "host";
+            labels?: Record<string, string> | undefined;
             cpu_shares?: number | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
             user?: string | undefined;
-            max_containers?: number | undefined;
             volumes?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
+            base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
+        }, {
+            labels?: Record<string, string> | undefined;
+            enabled?: boolean | undefined;
+            ephemeral?: boolean | undefined;
+            memory?: string | undefined;
+            cpu_shares?: number | undefined;
+            max_containers?: number | undefined;
             workspace_mode?: "rw" | "ro" | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
+            network?: "none" | "bridge" | "host" | undefined;
+            user?: string | undefined;
+            volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         }>, {
             enabled: boolean;
             ephemeral: boolean;
-            network: "none" | "bridge" | "host";
             memory: string;
             max_containers: number;
             workspace_mode: "rw" | "ro";
-            image?: string | undefined;
+            network: "none" | "bridge" | "host";
+            labels?: Record<string, string> | undefined;
             cpu_shares?: number | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
             user?: string | undefined;
             volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         }, {
+            labels?: Record<string, string> | undefined;
             enabled?: boolean | undefined;
             ephemeral?: boolean | undefined;
+            memory?: string | undefined;
+            cpu_shares?: number | undefined;
+            max_containers?: number | undefined;
+            workspace_mode?: "rw" | "ro" | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
             image?: string | undefined;
             network?: "none" | "bridge" | "host" | undefined;
-            memory?: string | undefined;
+            user?: string | undefined;
+            volumes?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
+            base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
+        }>, {
+            enabled: boolean;
+            ephemeral: boolean;
+            memory: string;
+            max_containers: number;
+            workspace_mode: "rw" | "ro";
+            network: "none" | "bridge" | "host";
+            labels?: Record<string, string> | undefined;
             cpu_shares?: number | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
             user?: string | undefined;
-            max_containers?: number | undefined;
             volumes?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
+            base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
+        }, {
+            labels?: Record<string, string> | undefined;
+            enabled?: boolean | undefined;
+            ephemeral?: boolean | undefined;
+            memory?: string | undefined;
+            cpu_shares?: number | undefined;
+            max_containers?: number | undefined;
             workspace_mode?: "rw" | "ro" | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
+            network?: "none" | "bridge" | "host" | undefined;
+            user?: string | undefined;
+            volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         }>>;
         permissions: z.ZodOptional<z.ZodObject<{
             mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["default", "acceptEdits", "bypassPermissions", "plan", "delegate", "dontAsk"]>>>;
@@ -3999,16 +4845,23 @@ export declare const FleetConfigSchema: z.ZodObject<{
         docker?: {
             enabled: boolean;
             ephemeral: boolean;
-            network: "none" | "bridge" | "host";
             memory: string;
             max_containers: number;
             workspace_mode: "rw" | "ro";
-            image?: string | undefined;
+            network: "none" | "bridge" | "host";
+            labels?: Record<string, string> | undefined;
             cpu_shares?: number | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
             user?: string | undefined;
             volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         } | undefined;
         permissions?: {
             mode: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk";
@@ -4059,18 +4912,25 @@ export declare const FleetConfigSchema: z.ZodObject<{
         max_turns?: number | undefined;
         model?: string | undefined;
         docker?: {
+            labels?: Record<string, string> | undefined;
             enabled?: boolean | undefined;
             ephemeral?: boolean | undefined;
-            image?: string | undefined;
-            network?: "none" | "bridge" | "host" | undefined;
             memory?: string | undefined;
             cpu_shares?: number | undefined;
-            user?: string | undefined;
             max_containers?: number | undefined;
-            volumes?: string[] | undefined;
             workspace_mode?: "rw" | "ro" | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
+            network?: "none" | "bridge" | "host" | undefined;
+            user?: string | undefined;
+            volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         } | undefined;
         permissions?: {
             mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
@@ -4184,7 +5044,7 @@ export declare const FleetConfigSchema: z.ZodObject<{
         port?: number | undefined;
         secret_env?: string | undefined;
     }>>;
-    docker: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
+    docker: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
         /** Enable Docker containerization for this agent (default: false) */
         enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         /** Use ephemeral containers (fresh per job, auto-removed) vs persistent (reuse across jobs, kept for inspection) */
@@ -4207,112 +5067,266 @@ export declare const FleetConfigSchema: z.ZodObject<{
         workspace_mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["rw", "ro"]>>>;
         /** Environment variables to pass to the container (supports ${VAR} interpolation) */
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /** Port bindings in format "hostPort:containerPort" or "containerPort" (e.g., "8080:80", "3000") */
+        ports: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Tmpfs mounts in format "path" or "path:options" (e.g., "/tmp", "/tmp:size=100m,mode=1777") */
+        tmpfs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Maximum number of processes (PIDs) allowed in the container (prevents fork bombs) */
+        pids_limit: z.ZodOptional<z.ZodNumber>;
+        /** Container labels for organization and filtering */
+        labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /** CPU period in microseconds (default: 100000 = 100ms). Used with cpu_quota for hard CPU limits. */
+        cpu_period: z.ZodOptional<z.ZodNumber>;
+        /** CPU quota in microseconds per cpu_period. E.g., cpu_period=100000 + cpu_quota=50000 = 50% of one CPU. */
+        cpu_quota: z.ZodOptional<z.ZodNumber>;
         /** @deprecated Use 'image' instead */
         base_image: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
+        /**
+         * Raw dockerode HostConfig passthrough for advanced options.
+         * Values here override any translated options (e.g., host_config.Memory overrides memory).
+         * See dockerode documentation for available options.
+         */
+        host_config: z.ZodOptional<z.ZodType<HostConfig, z.ZodTypeDef, HostConfig>>;
+    }, "strict", z.ZodTypeAny, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
         volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }>, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
         volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }>, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
         volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
+        memory?: string | undefined;
+        cpu_shares?: number | undefined;
+        max_containers?: number | undefined;
+        workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
         image?: string | undefined;
         network?: "none" | "bridge" | "host" | undefined;
-        memory?: string | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
+        base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
+    }>, {
+        enabled: boolean;
+        ephemeral: boolean;
+        memory: string;
+        max_containers: number;
+        workspace_mode: "rw" | "ro";
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
-        max_containers?: number | undefined;
         volumes?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
+        base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
+    }, {
+        labels?: Record<string, string> | undefined;
+        enabled?: boolean | undefined;
+        ephemeral?: boolean | undefined;
+        memory?: string | undefined;
+        cpu_shares?: number | undefined;
+        max_containers?: number | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }>, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
         volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
+        memory?: string | undefined;
+        cpu_shares?: number | undefined;
+        max_containers?: number | undefined;
+        workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
         image?: string | undefined;
         network?: "none" | "bridge" | "host" | undefined;
-        memory?: string | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
+        base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
+    }>, {
+        enabled: boolean;
+        ephemeral: boolean;
+        memory: string;
+        max_containers: number;
+        workspace_mode: "rw" | "ro";
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
-        max_containers?: number | undefined;
         volumes?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
+        base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
+    }, {
+        labels?: Record<string, string> | undefined;
+        enabled?: boolean | undefined;
+        ephemeral?: boolean | undefined;
+        memory?: string | undefined;
+        cpu_shares?: number | undefined;
+        max_containers?: number | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }>>;
 }, "strict", z.ZodTypeAny, {
     version: number;
@@ -4323,16 +5337,23 @@ export declare const FleetConfigSchema: z.ZodObject<{
     docker?: {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
         volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     } | undefined;
     working_directory?: {
         root: string;
@@ -4356,16 +5377,23 @@ export declare const FleetConfigSchema: z.ZodObject<{
         docker?: {
             enabled: boolean;
             ephemeral: boolean;
-            network: "none" | "bridge" | "host";
             memory: string;
             max_containers: number;
             workspace_mode: "rw" | "ro";
-            image?: string | undefined;
+            network: "none" | "bridge" | "host";
+            labels?: Record<string, string> | undefined;
             cpu_shares?: number | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
             user?: string | undefined;
             volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         } | undefined;
         permissions?: {
             mode: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk";
@@ -4420,18 +5448,25 @@ export declare const FleetConfigSchema: z.ZodObject<{
     } | undefined;
 }, {
     docker?: {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     } | undefined;
     working_directory?: {
         root: string;
@@ -4454,18 +5489,25 @@ export declare const FleetConfigSchema: z.ZodObject<{
         max_turns?: number | undefined;
         model?: string | undefined;
         docker?: {
+            labels?: Record<string, string> | undefined;
             enabled?: boolean | undefined;
             ephemeral?: boolean | undefined;
-            image?: string | undefined;
-            network?: "none" | "bridge" | "host" | undefined;
             memory?: string | undefined;
             cpu_shares?: number | undefined;
-            user?: string | undefined;
             max_containers?: number | undefined;
-            volumes?: string[] | undefined;
             workspace_mode?: "rw" | "ro" | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
+            network?: "none" | "bridge" | "host" | undefined;
+            user?: string | undefined;
+            volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         } | undefined;
         permissions?: {
             mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
@@ -4533,7 +5575,13 @@ export type GitHubWorkSource = z.infer<typeof GitHubWorkSourceSchema>;
 export type BaseWorkSource = z.infer<typeof BaseWorkSourceSchema>;
 export type WorkSource = z.infer<typeof WorkSourceSchema>;
 export type Instances = z.infer<typeof InstancesSchema>;
+export type AgentDockerInput = z.input<typeof AgentDockerSchema>;
+export type AgentDocker = z.infer<typeof AgentDockerSchema>;
+export type FleetDockerInput = z.input<typeof FleetDockerSchema>;
+export type FleetDocker = z.infer<typeof FleetDockerSchema>;
+/** @deprecated Use AgentDockerInput or FleetDockerInput instead */
 export type DockerInput = z.input<typeof DockerSchema>;
+/** @deprecated Use AgentDocker or FleetDocker instead */
 export type Docker = z.infer<typeof DockerSchema>;
 export type Defaults = z.infer<typeof DefaultsSchema>;
 export type WorkingDirectory = z.infer<typeof WorkingDirectorySchema>;