@herdctl/core 2.0.1 → 3.0.0

package/dist/config/schema.d.ts

@@ -4,48 +4,8 @@
  * Validates herdctl.yaml fleet configuration
  */
 import { z } from "zod";
+import type { HostConfig } from "dockerode";
 export declare const PermissionModeSchema: z.ZodEnum<["default", "acceptEdits", "bypassPermissions", "plan", "delegate", "dontAsk"]>;
-export declare const BashPermissionsSchema: z.ZodObject<{
-    allowed_commands: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    denied_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-}, "strip", z.ZodTypeAny, {
-    allowed_commands?: string[] | undefined;
-    denied_patterns?: string[] | undefined;
-}, {
-    allowed_commands?: string[] | undefined;
-    denied_patterns?: string[] | undefined;
-}>;
-export declare const PermissionsSchema: z.ZodObject<{
-    mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["default", "acceptEdits", "bypassPermissions", "plan", "delegate", "dontAsk"]>>>;
-    allowed_tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    denied_tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    bash: z.ZodOptional<z.ZodObject<{
-        allowed_commands: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        denied_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    }, "strip", z.ZodTypeAny, {
-        allowed_commands?: string[] | undefined;
-        denied_patterns?: string[] | undefined;
-    }, {
-        allowed_commands?: string[] | undefined;
-        denied_patterns?: string[] | undefined;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    mode: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk";
-    allowed_tools?: string[] | undefined;
-    denied_tools?: string[] | undefined;
-    bash?: {
-        allowed_commands?: string[] | undefined;
-        denied_patterns?: string[] | undefined;
-    } | undefined;
-}, {
-    mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
-    allowed_tools?: string[] | undefined;
-    denied_tools?: string[] | undefined;
-    bash?: {
-        allowed_commands?: string[] | undefined;
-        denied_patterns?: string[] | undefined;
-    } | undefined;
-}>;
 export declare const WorkSourceTypeSchema: z.ZodEnum<["github"]>;
 export declare const WorkSourceLabelsSchema: z.ZodObject<{
     ready: z.ZodOptional<z.ZodString>;
@@ -292,27 +252,147 @@ export declare const InstancesSchema: z.ZodObject<{
  */
 export declare const DockerNetworkModeSchema: z.ZodEnum<["none", "bridge", "host"]>;
 /**
- * Docker container configuration schema
+ * Agent-level Docker configuration schema (safe options only)
  *
- * Supports container lifecycle, resource limits, and security options.
- * All options are optional - defaults provide secure, sensible configuration.
+ * These options can be specified in agent config files (herdctl-agent.yml).
+ * Only includes safe options that don't pose security risks if an agent
+ * could modify its own config file.
+ *
+ * For dangerous options (network, volumes, image, user, ports, env),
+ * use FleetDockerSchema at the fleet level.
  *
  * @example
  * ```yaml
  * docker:
  *   enabled: true
  *   ephemeral: false        # Reuse container across jobs
- *   image: anthropic/claude-code:latest
- *   network: bridge         # Full network access
  *   memory: 2g              # Memory limit
  *   cpu_shares: 512         # CPU weight
- *   user: "1000:1000"       # Run as specific UID:GID
- *   max_containers: 5       # Keep last 5 containers per agent
- *   volumes:                # Additional volume mounts
- *     - "/host/data:/container/data:ro"
+ *   pids_limit: 100         # Prevent fork bombs
+ *   tmpfs:
+ *     - "/tmp"
  * ```
  */
-export declare const DockerSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
+export declare const AgentDockerSchema: z.ZodEffects<z.ZodEffects<z.ZodObject<{
+    /** Enable Docker containerization for this agent (default: false) */
+    enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    /** Use ephemeral containers (fresh per job, auto-removed) vs persistent (reuse across jobs, kept for inspection) */
+    ephemeral: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    /** Memory limit (e.g., "2g", "512m") (default: 2g) */
+    memory: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /** CPU shares (relative weight, 512 is normal) */
+    cpu_shares: z.ZodOptional<z.ZodNumber>;
+    /** Maximum containers to keep per agent before cleanup (default: 5) */
+    max_containers: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Workspace mount mode: rw (read-write, default) or ro (read-only) */
+    workspace_mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["rw", "ro"]>>>;
+    /** Tmpfs mounts in format "path" or "path:options" (e.g., "/tmp", "/tmp:size=100m,mode=1777") */
+    tmpfs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Maximum number of processes (PIDs) allowed in the container (prevents fork bombs) */
+    pids_limit: z.ZodOptional<z.ZodNumber>;
+    /** Container labels for organization and filtering */
+    labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** CPU period in microseconds (default: 100000 = 100ms). Used with cpu_quota for hard CPU limits. */
+    cpu_period: z.ZodOptional<z.ZodNumber>;
+    /** CPU quota in microseconds per cpu_period. E.g., cpu_period=100000 + cpu_quota=50000 = 50% of one CPU. */
+    cpu_quota: z.ZodOptional<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    labels?: Record<string, string> | undefined;
+    cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+}>, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    labels?: Record<string, string> | undefined;
+    cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+}>, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    labels?: Record<string, string> | undefined;
+    cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+}>;
+/**
+ * Fleet-level Docker configuration schema (all options)
+ *
+ * Includes all safe options from AgentDockerSchema plus dangerous options
+ * that should only be specified at the fleet level (in herdctl.yml).
+ *
+ * Also supports a `host_config` passthrough for raw dockerode HostConfig
+ * options not explicitly modeled in our schema.
+ *
+ * @example
+ * ```yaml
+ * defaults:
+ *   docker:
+ *     enabled: true
+ *     image: anthropic/claude-code:latest
+ *     network: bridge
+ *     memory: 2g
+ *     volumes:
+ *       - "/host/data:/container/data:ro"
+ *     host_config:           # Raw dockerode passthrough
+ *       ShmSize: 67108864
+ * ```
+ */
+export declare const FleetDockerSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
     /** Enable Docker containerization for this agent (default: false) */
     enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     /** Use ephemeral containers (fresh per job, auto-removed) vs persistent (reuse across jobs, kept for inspection) */
@@ -335,112 +415,551 @@ export declare const DockerSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodO
     workspace_mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["rw", "ro"]>>>;
     /** Environment variables to pass to the container (supports ${VAR} interpolation) */
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** Port bindings in format "hostPort:containerPort" or "containerPort" (e.g., "8080:80", "3000") */
+    ports: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Tmpfs mounts in format "path" or "path:options" (e.g., "/tmp", "/tmp:size=100m,mode=1777") */
+    tmpfs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Maximum number of processes (PIDs) allowed in the container (prevents fork bombs) */
+    pids_limit: z.ZodOptional<z.ZodNumber>;
+    /** Container labels for organization and filtering */
+    labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** CPU period in microseconds (default: 100000 = 100ms). Used with cpu_quota for hard CPU limits. */
+    cpu_period: z.ZodOptional<z.ZodNumber>;
+    /** CPU quota in microseconds per cpu_period. E.g., cpu_period=100000 + cpu_quota=50000 = 50% of one CPU. */
+    cpu_quota: z.ZodOptional<z.ZodNumber>;
     /** @deprecated Use 'image' instead */
     base_image: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
+    /**
+     * Raw dockerode HostConfig passthrough for advanced options.
+     * Values here override any translated options (e.g., host_config.Memory overrides memory).
+     * See dockerode documentation for available options.
+     */
+    host_config: z.ZodOptional<z.ZodType<HostConfig, z.ZodTypeDef, HostConfig>>;
+}, "strict", z.ZodTypeAny, {
     enabled: boolean;
     ephemeral: boolean;
-    network: "none" | "bridge" | "host";
     memory: string;
     max_containers: number;
     workspace_mode: "rw" | "ro";
-    image?: string | undefined;
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
     cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
     user?: string | undefined;
     volumes?: string[] | undefined;
     env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
     base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
 }, {
+    labels?: Record<string, string> | undefined;
     enabled?: boolean | undefined;
     ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
     image?: string | undefined;
     network?: "none" | "bridge" | "host" | undefined;
-    memory?: string | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}>, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
     cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
     user?: string | undefined;
-    max_containers?: number | undefined;
     volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
     workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    network?: "none" | "bridge" | "host" | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
     env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
     base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
 }>, {
     enabled: boolean;
     ephemeral: boolean;
-    network: "none" | "bridge" | "host";
     memory: string;
     max_containers: number;
     workspace_mode: "rw" | "ro";
-    image?: string | undefined;
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
     cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
     user?: string | undefined;
     volumes?: string[] | undefined;
     env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
     base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
 }, {
+    labels?: Record<string, string> | undefined;
     enabled?: boolean | undefined;
     ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
     image?: string | undefined;
     network?: "none" | "bridge" | "host" | undefined;
-    memory?: string | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}>, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
     cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
     user?: string | undefined;
-    max_containers?: number | undefined;
     volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
     workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    network?: "none" | "bridge" | "host" | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
     env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
     base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
 }>, {
     enabled: boolean;
     ephemeral: boolean;
-    network: "none" | "bridge" | "host";
     memory: string;
     max_containers: number;
     workspace_mode: "rw" | "ro";
-    image?: string | undefined;
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
     cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
     user?: string | undefined;
     volumes?: string[] | undefined;
     env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
     base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
 }, {
+    labels?: Record<string, string> | undefined;
     enabled?: boolean | undefined;
     ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
     image?: string | undefined;
     network?: "none" | "bridge" | "host" | undefined;
-    memory?: string | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}>, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
     cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
     user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
     max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    network?: "none" | "bridge" | "host" | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}>;
+/** @deprecated Use AgentDockerSchema or FleetDockerSchema instead */
+export declare const DockerSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
+    /** Enable Docker containerization for this agent (default: false) */
+    enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    /** Use ephemeral containers (fresh per job, auto-removed) vs persistent (reuse across jobs, kept for inspection) */
+    ephemeral: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    /** Docker image to use (default: anthropic/claude-code:latest) */
+    image: z.ZodOptional<z.ZodString>;
+    /** Network isolation mode (default: bridge for full network access) */
+    network: z.ZodDefault<z.ZodOptional<z.ZodEnum<["none", "bridge", "host"]>>>;
+    /** Memory limit (e.g., "2g", "512m") (default: 2g) */
+    memory: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    /** CPU shares (relative weight, 512 is normal) */
+    cpu_shares: z.ZodOptional<z.ZodNumber>;
+    /** Container user as "UID:GID" string (default: match host user) */
+    user: z.ZodOptional<z.ZodString>;
+    /** Maximum containers to keep per agent before cleanup (default: 5) */
+    max_containers: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    /** Additional volume mounts in Docker format: "host:container:mode" */
+    volumes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Workspace mount mode: rw (read-write, default) or ro (read-only) */
+    workspace_mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["rw", "ro"]>>>;
+    /** Environment variables to pass to the container (supports ${VAR} interpolation) */
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** Port bindings in format "hostPort:containerPort" or "containerPort" (e.g., "8080:80", "3000") */
+    ports: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Tmpfs mounts in format "path" or "path:options" (e.g., "/tmp", "/tmp:size=100m,mode=1777") */
+    tmpfs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Maximum number of processes (PIDs) allowed in the container (prevents fork bombs) */
+    pids_limit: z.ZodOptional<z.ZodNumber>;
+    /** Container labels for organization and filtering */
+    labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** CPU period in microseconds (default: 100000 = 100ms). Used with cpu_quota for hard CPU limits. */
+    cpu_period: z.ZodOptional<z.ZodNumber>;
+    /** CPU quota in microseconds per cpu_period. E.g., cpu_period=100000 + cpu_quota=50000 = 50% of one CPU. */
+    cpu_quota: z.ZodOptional<z.ZodNumber>;
+    /** @deprecated Use 'image' instead */
+    base_image: z.ZodOptional<z.ZodString>;
+    /**
+     * Raw dockerode HostConfig passthrough for advanced options.
+     * Values here override any translated options (e.g., host_config.Memory overrides memory).
+     * See dockerode documentation for available options.
+     */
+    host_config: z.ZodOptional<z.ZodType<HostConfig, z.ZodTypeDef, HostConfig>>;
+}, "strict", z.ZodTypeAny, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
+    cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    user?: string | undefined;
     volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
     workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    network?: "none" | "bridge" | "host" | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
     env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
     base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
 }>, {
     enabled: boolean;
     ephemeral: boolean;
-    network: "none" | "bridge" | "host";
     memory: string;
     max_containers: number;
     workspace_mode: "rw" | "ro";
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
+    cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
     image?: string | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
     cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    network?: "none" | "bridge" | "host" | undefined;
     user?: string | undefined;
     volumes?: string[] | undefined;
     env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
     base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}>, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
+    cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
 }, {
+    labels?: Record<string, string> | undefined;
     enabled?: boolean | undefined;
     ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
     image?: string | undefined;
     network?: "none" | "bridge" | "host" | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}>, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
+    cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
     memory?: string | undefined;
     cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    network?: "none" | "bridge" | "host" | undefined;
     user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}>, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
+    cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
     max_containers?: number | undefined;
+    workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    network?: "none" | "bridge" | "host" | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}>, {
+    enabled: boolean;
+    ephemeral: boolean;
+    memory: string;
+    max_containers: number;
+    workspace_mode: "rw" | "ro";
+    network: "none" | "bridge" | "host";
+    labels?: Record<string, string> | undefined;
+    cpu_shares?: number | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    user?: string | undefined;
     volumes?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
+    base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
+}, {
+    labels?: Record<string, string> | undefined;
+    enabled?: boolean | undefined;
+    ephemeral?: boolean | undefined;
+    memory?: string | undefined;
+    cpu_shares?: number | undefined;
+    max_containers?: number | undefined;
     workspace_mode?: "rw" | "ro" | undefined;
+    tmpfs?: string[] | undefined;
+    pids_limit?: number | undefined;
+    cpu_period?: number | undefined;
+    cpu_quota?: number | undefined;
+    image?: string | undefined;
+    network?: "none" | "bridge" | "host" | undefined;
+    user?: string | undefined;
+    volumes?: string[] | undefined;
     env?: Record<string, string> | undefined;
+    ports?: string[] | undefined;
     base_image?: string | undefined;
+    host_config?: HostConfig | undefined;
 }>;
 export declare const SessionSchema: z.ZodObject<{
     max_turns: z.ZodOptional<z.ZodNumber>;
@@ -456,7 +975,7 @@ export declare const SessionSchema: z.ZodObject<{
     model?: string | undefined;
 }>;
 export declare const DefaultsSchema: z.ZodObject<{
-    docker: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
+    docker: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
         /** Enable Docker containerization for this agent (default: false) */
         enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         /** Use ephemeral containers (fresh per job, auto-removed) vs persistent (reuse across jobs, kept for inspection) */
@@ -479,143 +998,266 @@ export declare const DefaultsSchema: z.ZodObject<{
         workspace_mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["rw", "ro"]>>>;
         /** Environment variables to pass to the container (supports ${VAR} interpolation) */
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /** Port bindings in format "hostPort:containerPort" or "containerPort" (e.g., "8080:80", "3000") */
+        ports: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Tmpfs mounts in format "path" or "path:options" (e.g., "/tmp", "/tmp:size=100m,mode=1777") */
+        tmpfs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Maximum number of processes (PIDs) allowed in the container (prevents fork bombs) */
+        pids_limit: z.ZodOptional<z.ZodNumber>;
+        /** Container labels for organization and filtering */
+        labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /** CPU period in microseconds (default: 100000 = 100ms). Used with cpu_quota for hard CPU limits. */
+        cpu_period: z.ZodOptional<z.ZodNumber>;
+        /** CPU quota in microseconds per cpu_period. E.g., cpu_period=100000 + cpu_quota=50000 = 50% of one CPU. */
+        cpu_quota: z.ZodOptional<z.ZodNumber>;
         /** @deprecated Use 'image' instead */
         base_image: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
+        /**
+         * Raw dockerode HostConfig passthrough for advanced options.
+         * Values here override any translated options (e.g., host_config.Memory overrides memory).
+         * See dockerode documentation for available options.
+         */
+        host_config: z.ZodOptional<z.ZodType<HostConfig, z.ZodTypeDef, HostConfig>>;
+    }, "strict", z.ZodTypeAny, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
         volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }>, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
         volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }>, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
         volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
+        memory?: string | undefined;
+        cpu_shares?: number | undefined;
+        max_containers?: number | undefined;
+        workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
         image?: string | undefined;
         network?: "none" | "bridge" | "host" | undefined;
-        memory?: string | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
+        base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
+    }>, {
+        enabled: boolean;
+        ephemeral: boolean;
+        memory: string;
+        max_containers: number;
+        workspace_mode: "rw" | "ro";
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
-        max_containers?: number | undefined;
         volumes?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
+        base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
+    }, {
+        labels?: Record<string, string> | undefined;
+        enabled?: boolean | undefined;
+        ephemeral?: boolean | undefined;
+        memory?: string | undefined;
+        cpu_shares?: number | undefined;
+        max_containers?: number | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }>, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
         volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
+        memory?: string | undefined;
+        cpu_shares?: number | undefined;
+        max_containers?: number | undefined;
+        workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
         image?: string | undefined;
         network?: "none" | "bridge" | "host" | undefined;
-        memory?: string | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
+        base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
+    }>, {
+        enabled: boolean;
+        ephemeral: boolean;
+        memory: string;
+        max_containers: number;
+        workspace_mode: "rw" | "ro";
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
-        max_containers?: number | undefined;
         volumes?: string[] | undefined;
-        workspace_mode?: "rw" | "ro" | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
-    }>>;
-    permissions: z.ZodOptional<z.ZodObject<{
-        mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["default", "acceptEdits", "bypassPermissions", "plan", "delegate", "dontAsk"]>>>;
-        allowed_tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        denied_tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        bash: z.ZodOptional<z.ZodObject<{
-            allowed_commands: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-            denied_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        }, "strip", z.ZodTypeAny, {
-            allowed_commands?: string[] | undefined;
-            denied_patterns?: string[] | undefined;
-        }, {
-            allowed_commands?: string[] | undefined;
-            denied_patterns?: string[] | undefined;
-        }>>;
-    }, "strip", z.ZodTypeAny, {
-        mode: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk";
-        allowed_tools?: string[] | undefined;
-        denied_tools?: string[] | undefined;
-        bash?: {
-            allowed_commands?: string[] | undefined;
-            denied_patterns?: string[] | undefined;
-        } | undefined;
+        host_config?: HostConfig | undefined;
     }, {
-        mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
-        allowed_tools?: string[] | undefined;
-        denied_tools?: string[] | undefined;
-        bash?: {
-            allowed_commands?: string[] | undefined;
-            denied_patterns?: string[] | undefined;
-        } | undefined;
+        labels?: Record<string, string> | undefined;
+        enabled?: boolean | undefined;
+        ephemeral?: boolean | undefined;
+        memory?: string | undefined;
+        cpu_shares?: number | undefined;
+        max_containers?: number | undefined;
+        workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
+        base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }>>;
     work_source: z.ZodOptional<z.ZodUnion<[z.ZodObject<{
         type: z.ZodLiteral<"github">;
@@ -742,31 +1384,31 @@ export declare const DefaultsSchema: z.ZodObject<{
     model: z.ZodOptional<z.ZodString>;
     max_turns: z.ZodOptional<z.ZodNumber>;
     permission_mode: z.ZodOptional<z.ZodEnum<["default", "acceptEdits", "bypassPermissions", "plan", "delegate", "dontAsk"]>>;
+    allowed_tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    denied_tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
     max_turns?: number | undefined;
     model?: string | undefined;
     docker?: {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
-        volumes?: string[] | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
-    } | undefined;
-    permissions?: {
-        mode: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk";
-        allowed_tools?: string[] | undefined;
-        denied_tools?: string[] | undefined;
-        bash?: {
-            allowed_commands?: string[] | undefined;
-            denied_patterns?: string[] | undefined;
-        } | undefined;
+        volumes?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
+        base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     } | undefined;
     work_source?: {
         type: "github";
@@ -804,31 +1446,31 @@ export declare const DefaultsSchema: z.ZodObject<{
         model?: string | undefined;
     } | undefined;
     permission_mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
+    allowed_tools?: string[] | undefined;
+    denied_tools?: string[] | undefined;
 }, {
     max_turns?: number | undefined;
     model?: string | undefined;
     docker?: {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
-    } | undefined;
-    permissions?: {
-        mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
-        allowed_tools?: string[] | undefined;
-        denied_tools?: string[] | undefined;
-        bash?: {
-            allowed_commands?: string[] | undefined;
-            denied_patterns?: string[] | undefined;
-        } | undefined;
+        host_config?: HostConfig | undefined;
     } | undefined;
     work_source?: {
         type: "github";
@@ -866,6 +1508,8 @@ export declare const DefaultsSchema: z.ZodObject<{
         model?: string | undefined;
     } | undefined;
     permission_mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
+    allowed_tools?: string[] | undefined;
+    denied_tools?: string[] | undefined;
 }>;
 export declare const WorkingDirectorySchema: z.ZodObject<{
     root: z.ZodString;
@@ -1122,13 +1766,13 @@ export declare const DiscordDMSchema: z.ZodObject<{
     allowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     blocklist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
-    mode: "mention" | "auto";
     enabled: boolean;
+    mode: "mention" | "auto";
     allowlist?: string[] | undefined;
     blocklist?: string[] | undefined;
 }, {
-    mode?: "mention" | "auto" | undefined;
     enabled?: boolean | undefined;
+    mode?: "mention" | "auto" | undefined;
     allowlist?: string[] | undefined;
     blocklist?: string[] | undefined;
 }>;
@@ -1156,8 +1800,8 @@ export declare const DiscordChannelSchema: z.ZodObject<{
     name?: string | undefined;
 }, {
     id: string;
-    mode?: "mention" | "auto" | undefined;
     name?: string | undefined;
+    mode?: "mention" | "auto" | undefined;
     context_messages?: number | undefined;
 }>;
 /**
@@ -1190,8 +1834,8 @@ export declare const DiscordGuildSchema: z.ZodObject<{
         name?: string | undefined;
     }, {
         id: string;
-        mode?: "mention" | "auto" | undefined;
         name?: string | undefined;
+        mode?: "mention" | "auto" | undefined;
         context_messages?: number | undefined;
     }>, "many">>;
     dm: z.ZodOptional<z.ZodObject<{
@@ -1200,13 +1844,13 @@ export declare const DiscordGuildSchema: z.ZodObject<{
         allowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         blocklist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
-        mode: "mention" | "auto";
         enabled: boolean;
+        mode: "mention" | "auto";
         allowlist?: string[] | undefined;
         blocklist?: string[] | undefined;
     }, {
-        mode?: "mention" | "auto" | undefined;
         enabled?: boolean | undefined;
+        mode?: "mention" | "auto" | undefined;
         allowlist?: string[] | undefined;
         blocklist?: string[] | undefined;
     }>>;
@@ -1219,8 +1863,8 @@ export declare const DiscordGuildSchema: z.ZodObject<{
         name?: string | undefined;
     }[] | undefined;
     dm?: {
-        mode: "mention" | "auto";
         enabled: boolean;
+        mode: "mention" | "auto";
         allowlist?: string[] | undefined;
         blocklist?: string[] | undefined;
     } | undefined;
@@ -1228,13 +1872,13 @@ export declare const DiscordGuildSchema: z.ZodObject<{
     id: string;
     channels?: {
         id: string;
-        mode?: "mention" | "auto" | undefined;
         name?: string | undefined;
+        mode?: "mention" | "auto" | undefined;
         context_messages?: number | undefined;
     }[] | undefined;
     dm?: {
-        mode?: "mention" | "auto" | undefined;
         enabled?: boolean | undefined;
+        mode?: "mention" | "auto" | undefined;
         allowlist?: string[] | undefined;
         blocklist?: string[] | undefined;
     } | undefined;
@@ -1296,8 +1940,8 @@ export declare const AgentChatDiscordSchema: z.ZodObject<{
             name?: string | undefined;
         }, {
             id: string;
-            mode?: "mention" | "auto" | undefined;
             name?: string | undefined;
+            mode?: "mention" | "auto" | undefined;
             context_messages?: number | undefined;
         }>, "many">>;
         dm: z.ZodOptional<z.ZodObject<{
@@ -1306,13 +1950,13 @@ export declare const AgentChatDiscordSchema: z.ZodObject<{
             allowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             blocklist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         }, "strip", z.ZodTypeAny, {
-            mode: "mention" | "auto";
             enabled: boolean;
+            mode: "mention" | "auto";
             allowlist?: string[] | undefined;
             blocklist?: string[] | undefined;
         }, {
-            mode?: "mention" | "auto" | undefined;
             enabled?: boolean | undefined;
+            mode?: "mention" | "auto" | undefined;
             allowlist?: string[] | undefined;
             blocklist?: string[] | undefined;
         }>>;
@@ -1325,8 +1969,8 @@ export declare const AgentChatDiscordSchema: z.ZodObject<{
             name?: string | undefined;
         }[] | undefined;
         dm?: {
-            mode: "mention" | "auto";
             enabled: boolean;
+            mode: "mention" | "auto";
             allowlist?: string[] | undefined;
             blocklist?: string[] | undefined;
         } | undefined;
@@ -1334,13 +1978,13 @@ export declare const AgentChatDiscordSchema: z.ZodObject<{
         id: string;
         channels?: {
             id: string;
-            mode?: "mention" | "auto" | undefined;
             name?: string | undefined;
+            mode?: "mention" | "auto" | undefined;
             context_messages?: number | undefined;
         }[] | undefined;
         dm?: {
-            mode?: "mention" | "auto" | undefined;
             enabled?: boolean | undefined;
+            mode?: "mention" | "auto" | undefined;
             allowlist?: string[] | undefined;
             blocklist?: string[] | undefined;
         } | undefined;
@@ -1352,13 +1996,13 @@ export declare const AgentChatDiscordSchema: z.ZodObject<{
         allowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         blocklist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
-        mode: "mention" | "auto";
         enabled: boolean;
+        mode: "mention" | "auto";
         allowlist?: string[] | undefined;
         blocklist?: string[] | undefined;
     }, {
-        mode?: "mention" | "auto" | undefined;
         enabled?: boolean | undefined;
+        mode?: "mention" | "auto" | undefined;
         allowlist?: string[] | undefined;
         blocklist?: string[] | undefined;
     }>>;
@@ -1375,15 +2019,15 @@ export declare const AgentChatDiscordSchema: z.ZodObject<{
             name?: string | undefined;
         }[] | undefined;
         dm?: {
-            mode: "mention" | "auto";
             enabled: boolean;
+            mode: "mention" | "auto";
             allowlist?: string[] | undefined;
             blocklist?: string[] | undefined;
         } | undefined;
     }[];
     dm?: {
-        mode: "mention" | "auto";
         enabled: boolean;
+        mode: "mention" | "auto";
         allowlist?: string[] | undefined;
         blocklist?: string[] | undefined;
     } | undefined;
@@ -1397,20 +2041,20 @@ export declare const AgentChatDiscordSchema: z.ZodObject<{
         id: string;
         channels?: {
             id: string;
-            mode?: "mention" | "auto" | undefined;
             name?: string | undefined;
+            mode?: "mention" | "auto" | undefined;
             context_messages?: number | undefined;
         }[] | undefined;
         dm?: {
-            mode?: "mention" | "auto" | undefined;
             enabled?: boolean | undefined;
+            mode?: "mention" | "auto" | undefined;
             allowlist?: string[] | undefined;
             blocklist?: string[] | undefined;
         } | undefined;
     }[];
     dm?: {
-        mode?: "mention" | "auto" | undefined;
         enabled?: boolean | undefined;
+        mode?: "mention" | "auto" | undefined;
         allowlist?: string[] | undefined;
         blocklist?: string[] | undefined;
     } | undefined;
@@ -1455,8 +2099,8 @@ export declare const AgentChatSchema: z.ZodObject<{
                 name?: string | undefined;
             }, {
                 id: string;
-                mode?: "mention" | "auto" | undefined;
                 name?: string | undefined;
+                mode?: "mention" | "auto" | undefined;
                 context_messages?: number | undefined;
             }>, "many">>;
             dm: z.ZodOptional<z.ZodObject<{
@@ -1465,13 +2109,13 @@ export declare const AgentChatSchema: z.ZodObject<{
                 allowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
                 blocklist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             }, "strip", z.ZodTypeAny, {
-                mode: "mention" | "auto";
                 enabled: boolean;
+                mode: "mention" | "auto";
                 allowlist?: string[] | undefined;
                 blocklist?: string[] | undefined;
             }, {
-                mode?: "mention" | "auto" | undefined;
                 enabled?: boolean | undefined;
+                mode?: "mention" | "auto" | undefined;
                 allowlist?: string[] | undefined;
                 blocklist?: string[] | undefined;
             }>>;
@@ -1484,8 +2128,8 @@ export declare const AgentChatSchema: z.ZodObject<{
                 name?: string | undefined;
             }[] | undefined;
             dm?: {
-                mode: "mention" | "auto";
                 enabled: boolean;
+                mode: "mention" | "auto";
                 allowlist?: string[] | undefined;
                 blocklist?: string[] | undefined;
             } | undefined;
@@ -1493,13 +2137,13 @@ export declare const AgentChatSchema: z.ZodObject<{
             id: string;
             channels?: {
                 id: string;
-                mode?: "mention" | "auto" | undefined;
                 name?: string | undefined;
+                mode?: "mention" | "auto" | undefined;
                 context_messages?: number | undefined;
             }[] | undefined;
             dm?: {
-                mode?: "mention" | "auto" | undefined;
                 enabled?: boolean | undefined;
+                mode?: "mention" | "auto" | undefined;
                 allowlist?: string[] | undefined;
                 blocklist?: string[] | undefined;
             } | undefined;
@@ -1511,13 +2155,13 @@ export declare const AgentChatSchema: z.ZodObject<{
             allowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             blocklist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         }, "strip", z.ZodTypeAny, {
-            mode: "mention" | "auto";
             enabled: boolean;
+            mode: "mention" | "auto";
             allowlist?: string[] | undefined;
             blocklist?: string[] | undefined;
         }, {
-            mode?: "mention" | "auto" | undefined;
             enabled?: boolean | undefined;
+            mode?: "mention" | "auto" | undefined;
             allowlist?: string[] | undefined;
             blocklist?: string[] | undefined;
         }>>;
@@ -1534,15 +2178,15 @@ export declare const AgentChatSchema: z.ZodObject<{
                 name?: string | undefined;
             }[] | undefined;
             dm?: {
-                mode: "mention" | "auto";
                 enabled: boolean;
+                mode: "mention" | "auto";
                 allowlist?: string[] | undefined;
                 blocklist?: string[] | undefined;
             } | undefined;
         }[];
         dm?: {
-            mode: "mention" | "auto";
             enabled: boolean;
+            mode: "mention" | "auto";
             allowlist?: string[] | undefined;
             blocklist?: string[] | undefined;
         } | undefined;
@@ -1556,20 +2200,20 @@ export declare const AgentChatSchema: z.ZodObject<{
             id: string;
             channels?: {
                 id: string;
-                mode?: "mention" | "auto" | undefined;
                 name?: string | undefined;
+                mode?: "mention" | "auto" | undefined;
                 context_messages?: number | undefined;
             }[] | undefined;
             dm?: {
-                mode?: "mention" | "auto" | undefined;
                 enabled?: boolean | undefined;
+                mode?: "mention" | "auto" | undefined;
                 allowlist?: string[] | undefined;
                 blocklist?: string[] | undefined;
             } | undefined;
         }[];
         dm?: {
-            mode?: "mention" | "auto" | undefined;
             enabled?: boolean | undefined;
+            mode?: "mention" | "auto" | undefined;
             allowlist?: string[] | undefined;
             blocklist?: string[] | undefined;
         } | undefined;
@@ -1594,15 +2238,15 @@ export declare const AgentChatSchema: z.ZodObject<{
                 name?: string | undefined;
             }[] | undefined;
             dm?: {
-                mode: "mention" | "auto";
                 enabled: boolean;
+                mode: "mention" | "auto";
                 allowlist?: string[] | undefined;
                 blocklist?: string[] | undefined;
             } | undefined;
         }[];
         dm?: {
-            mode: "mention" | "auto";
             enabled: boolean;
+            mode: "mention" | "auto";
             allowlist?: string[] | undefined;
             blocklist?: string[] | undefined;
         } | undefined;
@@ -1618,20 +2262,20 @@ export declare const AgentChatSchema: z.ZodObject<{
             id: string;
             channels?: {
                 id: string;
-                mode?: "mention" | "auto" | undefined;
                 name?: string | undefined;
+                mode?: "mention" | "auto" | undefined;
                 context_messages?: number | undefined;
             }[] | undefined;
             dm?: {
-                mode?: "mention" | "auto" | undefined;
                 enabled?: boolean | undefined;
+                mode?: "mention" | "auto" | undefined;
                 allowlist?: string[] | undefined;
                 blocklist?: string[] | undefined;
             } | undefined;
         }[];
         dm?: {
-            mode?: "mention" | "auto" | undefined;
             enabled?: boolean | undefined;
+            mode?: "mention" | "auto" | undefined;
             allowlist?: string[] | undefined;
             blocklist?: string[] | undefined;
         } | undefined;
@@ -2493,37 +3137,6 @@ export declare const AgentConfigSchema: z.ZodObject<{
         timeout?: string | undefined;
         model?: string | undefined;
     }>>;
-    permissions: z.ZodOptional<z.ZodObject<{
-        mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["default", "acceptEdits", "bypassPermissions", "plan", "delegate", "dontAsk"]>>>;
-        allowed_tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        denied_tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        bash: z.ZodOptional<z.ZodObject<{
-            allowed_commands: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-            denied_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        }, "strip", z.ZodTypeAny, {
-            allowed_commands?: string[] | undefined;
-            denied_patterns?: string[] | undefined;
-        }, {
-            allowed_commands?: string[] | undefined;
-            denied_patterns?: string[] | undefined;
-        }>>;
-    }, "strip", z.ZodTypeAny, {
-        mode: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk";
-        allowed_tools?: string[] | undefined;
-        denied_tools?: string[] | undefined;
-        bash?: {
-            allowed_commands?: string[] | undefined;
-            denied_patterns?: string[] | undefined;
-        } | undefined;
-    }, {
-        mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
-        allowed_tools?: string[] | undefined;
-        denied_tools?: string[] | undefined;
-        bash?: {
-            allowed_commands?: string[] | undefined;
-            denied_patterns?: string[] | undefined;
-        } | undefined;
-    }>>;
     mcp_servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         command: z.ZodOptional<z.ZodString>;
         args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -2574,8 +3187,8 @@ export declare const AgentConfigSchema: z.ZodObject<{
                     name?: string | undefined;
                 }, {
                     id: string;
-                    mode?: "mention" | "auto" | undefined;
                     name?: string | undefined;
+                    mode?: "mention" | "auto" | undefined;
                     context_messages?: number | undefined;
                 }>, "many">>;
                 dm: z.ZodOptional<z.ZodObject<{
@@ -2584,13 +3197,13 @@ export declare const AgentConfigSchema: z.ZodObject<{
                     allowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
                     blocklist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
                 }, "strip", z.ZodTypeAny, {
-                    mode: "mention" | "auto";
                     enabled: boolean;
+                    mode: "mention" | "auto";
                     allowlist?: string[] | undefined;
                     blocklist?: string[] | undefined;
                 }, {
-                    mode?: "mention" | "auto" | undefined;
                     enabled?: boolean | undefined;
+                    mode?: "mention" | "auto" | undefined;
                     allowlist?: string[] | undefined;
                     blocklist?: string[] | undefined;
                 }>>;
@@ -2603,8 +3216,8 @@ export declare const AgentConfigSchema: z.ZodObject<{
                     name?: string | undefined;
                 }[] | undefined;
                 dm?: {
-                    mode: "mention" | "auto";
                     enabled: boolean;
+                    mode: "mention" | "auto";
                     allowlist?: string[] | undefined;
                     blocklist?: string[] | undefined;
                 } | undefined;
@@ -2612,13 +3225,13 @@ export declare const AgentConfigSchema: z.ZodObject<{
                 id: string;
                 channels?: {
                     id: string;
-                    mode?: "mention" | "auto" | undefined;
                     name?: string | undefined;
+                    mode?: "mention" | "auto" | undefined;
                     context_messages?: number | undefined;
                 }[] | undefined;
                 dm?: {
-                    mode?: "mention" | "auto" | undefined;
                     enabled?: boolean | undefined;
+                    mode?: "mention" | "auto" | undefined;
                     allowlist?: string[] | undefined;
                     blocklist?: string[] | undefined;
                 } | undefined;
@@ -2630,13 +3243,13 @@ export declare const AgentConfigSchema: z.ZodObject<{
                 allowlist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
                 blocklist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             }, "strip", z.ZodTypeAny, {
-                mode: "mention" | "auto";
                 enabled: boolean;
+                mode: "mention" | "auto";
                 allowlist?: string[] | undefined;
                 blocklist?: string[] | undefined;
             }, {
-                mode?: "mention" | "auto" | undefined;
                 enabled?: boolean | undefined;
+                mode?: "mention" | "auto" | undefined;
                 allowlist?: string[] | undefined;
                 blocklist?: string[] | undefined;
             }>>;
@@ -2653,15 +3266,15 @@ export declare const AgentConfigSchema: z.ZodObject<{
                     name?: string | undefined;
                 }[] | undefined;
                 dm?: {
-                    mode: "mention" | "auto";
                     enabled: boolean;
+                    mode: "mention" | "auto";
                     allowlist?: string[] | undefined;
                     blocklist?: string[] | undefined;
                 } | undefined;
             }[];
             dm?: {
-                mode: "mention" | "auto";
                 enabled: boolean;
+                mode: "mention" | "auto";
                 allowlist?: string[] | undefined;
                 blocklist?: string[] | undefined;
             } | undefined;
@@ -2675,20 +3288,20 @@ export declare const AgentConfigSchema: z.ZodObject<{
                 id: string;
                 channels?: {
                     id: string;
-                    mode?: "mention" | "auto" | undefined;
                     name?: string | undefined;
+                    mode?: "mention" | "auto" | undefined;
                     context_messages?: number | undefined;
                 }[] | undefined;
                 dm?: {
-                    mode?: "mention" | "auto" | undefined;
                     enabled?: boolean | undefined;
+                    mode?: "mention" | "auto" | undefined;
                     allowlist?: string[] | undefined;
                     blocklist?: string[] | undefined;
                 } | undefined;
             }[];
             dm?: {
-                mode?: "mention" | "auto" | undefined;
                 enabled?: boolean | undefined;
+                mode?: "mention" | "auto" | undefined;
                 allowlist?: string[] | undefined;
                 blocklist?: string[] | undefined;
             } | undefined;
@@ -2713,15 +3326,15 @@ export declare const AgentConfigSchema: z.ZodObject<{
                     name?: string | undefined;
                 }[] | undefined;
                 dm?: {
-                    mode: "mention" | "auto";
                     enabled: boolean;
+                    mode: "mention" | "auto";
                     allowlist?: string[] | undefined;
                     blocklist?: string[] | undefined;
                 } | undefined;
             }[];
             dm?: {
-                mode: "mention" | "auto";
                 enabled: boolean;
+                mode: "mention" | "auto";
                 allowlist?: string[] | undefined;
                 blocklist?: string[] | undefined;
             } | undefined;
@@ -2737,20 +3350,20 @@ export declare const AgentConfigSchema: z.ZodObject<{
                 id: string;
                 channels?: {
                     id: string;
-                    mode?: "mention" | "auto" | undefined;
                     name?: string | undefined;
+                    mode?: "mention" | "auto" | undefined;
                     context_messages?: number | undefined;
                 }[] | undefined;
                 dm?: {
-                    mode?: "mention" | "auto" | undefined;
                     enabled?: boolean | undefined;
+                    mode?: "mention" | "auto" | undefined;
                     allowlist?: string[] | undefined;
                     blocklist?: string[] | undefined;
                 } | undefined;
             }[];
             dm?: {
-                mode?: "mention" | "auto" | undefined;
                 enabled?: boolean | undefined;
+                mode?: "mention" | "auto" | undefined;
                 allowlist?: string[] | undefined;
                 blocklist?: string[] | undefined;
             } | undefined;
@@ -3080,135 +3693,101 @@ export declare const AgentConfigSchema: z.ZodObject<{
             when?: string | undefined;
         })[] | undefined;
     }>>;
-    docker: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
+    docker: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodObject<{
         /** Enable Docker containerization for this agent (default: false) */
         enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         /** Use ephemeral containers (fresh per job, auto-removed) vs persistent (reuse across jobs, kept for inspection) */
         ephemeral: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-        /** Docker image to use (default: anthropic/claude-code:latest) */
-        image: z.ZodOptional<z.ZodString>;
-        /** Network isolation mode (default: bridge for full network access) */
-        network: z.ZodDefault<z.ZodOptional<z.ZodEnum<["none", "bridge", "host"]>>>;
         /** Memory limit (e.g., "2g", "512m") (default: 2g) */
         memory: z.ZodDefault<z.ZodOptional<z.ZodString>>;
         /** CPU shares (relative weight, 512 is normal) */
         cpu_shares: z.ZodOptional<z.ZodNumber>;
-        /** Container user as "UID:GID" string (default: match host user) */
-        user: z.ZodOptional<z.ZodString>;
         /** Maximum containers to keep per agent before cleanup (default: 5) */
         max_containers: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-        /** Additional volume mounts in Docker format: "host:container:mode" */
-        volumes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         /** Workspace mount mode: rw (read-write, default) or ro (read-only) */
         workspace_mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["rw", "ro"]>>>;
-        /** Environment variables to pass to the container (supports ${VAR} interpolation) */
-        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        /** @deprecated Use 'image' instead */
-        base_image: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        enabled: boolean;
-        ephemeral: boolean;
-        network: "none" | "bridge" | "host";
-        memory: string;
-        max_containers: number;
-        workspace_mode: "rw" | "ro";
-        image?: string | undefined;
-        cpu_shares?: number | undefined;
-        user?: string | undefined;
-        volumes?: string[] | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
-    }, {
-        enabled?: boolean | undefined;
-        ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
-        memory?: string | undefined;
-        cpu_shares?: number | undefined;
-        user?: string | undefined;
-        max_containers?: number | undefined;
-        volumes?: string[] | undefined;
-        workspace_mode?: "rw" | "ro" | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
-    }>, {
+        /** Tmpfs mounts in format "path" or "path:options" (e.g., "/tmp", "/tmp:size=100m,mode=1777") */
+        tmpfs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Maximum number of processes (PIDs) allowed in the container (prevents fork bombs) */
+        pids_limit: z.ZodOptional<z.ZodNumber>;
+        /** Container labels for organization and filtering */
+        labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /** CPU period in microseconds (default: 100000 = 100ms). Used with cpu_quota for hard CPU limits. */
+        cpu_period: z.ZodOptional<z.ZodNumber>;
+        /** CPU quota in microseconds per cpu_period. E.g., cpu_period=100000 + cpu_quota=50000 = 50% of one CPU. */
+        cpu_quota: z.ZodOptional<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
-        volumes?: string[] | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
     }>, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
-        volumes?: string[] | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
     }>, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
-        volumes?: string[] | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
     }>>;
     instances: z.ZodOptional<z.ZodObject<{
         max_concurrent: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
@@ -3220,6 +3799,8 @@ export declare const AgentConfigSchema: z.ZodObject<{
     model: z.ZodOptional<z.ZodString>;
     max_turns: z.ZodOptional<z.ZodNumber>;
     permission_mode: z.ZodOptional<z.ZodEnum<["default", "acceptEdits", "bypassPermissions", "plan", "delegate", "dontAsk"]>>;
+    allowed_tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    denied_tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     /** Path to metadata JSON file written by agent (default: metadata.json in workspace) */
     metadata_file: z.ZodOptional<z.ZodString>;
     /**
@@ -3248,25 +3829,15 @@ export declare const AgentConfigSchema: z.ZodObject<{
     docker?: {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
-        volumes?: string[] | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
-    } | undefined;
-    permissions?: {
-        mode: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk";
-        allowed_tools?: string[] | undefined;
-        denied_tools?: string[] | undefined;
-        bash?: {
-            allowed_commands?: string[] | undefined;
-            denied_patterns?: string[] | undefined;
-        } | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
     } | undefined;
     work_source?: {
         type: "github";
@@ -3304,6 +3875,8 @@ export declare const AgentConfigSchema: z.ZodObject<{
         model?: string | undefined;
     } | undefined;
     permission_mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
+    allowed_tools?: string[] | undefined;
+    denied_tools?: string[] | undefined;
     chat?: {
         discord?: {
             bot_token_env: string;
@@ -3318,15 +3891,15 @@ export declare const AgentConfigSchema: z.ZodObject<{
                     name?: string | undefined;
                 }[] | undefined;
                 dm?: {
-                    mode: "mention" | "auto";
                     enabled: boolean;
+                    mode: "mention" | "auto";
                     allowlist?: string[] | undefined;
                     blocklist?: string[] | undefined;
                 } | undefined;
             }[];
             dm?: {
-                mode: "mention" | "auto";
                 enabled: boolean;
+                mode: "mention" | "auto";
                 allowlist?: string[] | undefined;
                 blocklist?: string[] | undefined;
             } | undefined;
@@ -3445,27 +4018,17 @@ export declare const AgentConfigSchema: z.ZodObject<{
     max_turns?: number | undefined;
     model?: string | undefined;
     docker?: {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
-        env?: Record<string, string> | undefined;
-        base_image?: string | undefined;
-    } | undefined;
-    permissions?: {
-        mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
-        allowed_tools?: string[] | undefined;
-        denied_tools?: string[] | undefined;
-        bash?: {
-            allowed_commands?: string[] | undefined;
-            denied_patterns?: string[] | undefined;
-        } | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
     } | undefined;
     work_source?: {
         type: "github";
@@ -3503,6 +4066,8 @@ export declare const AgentConfigSchema: z.ZodObject<{
         model?: string | undefined;
     } | undefined;
     permission_mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
+    allowed_tools?: string[] | undefined;
+    denied_tools?: string[] | undefined;
     chat?: {
         discord?: {
             bot_token_env: string;
@@ -3510,20 +4075,20 @@ export declare const AgentConfigSchema: z.ZodObject<{
                 id: string;
                 channels?: {
                     id: string;
-                    mode?: "mention" | "auto" | undefined;
                     name?: string | undefined;
+                    mode?: "mention" | "auto" | undefined;
                     context_messages?: number | undefined;
                 }[] | undefined;
                 dm?: {
-                    mode?: "mention" | "auto" | undefined;
                     enabled?: boolean | undefined;
+                    mode?: "mention" | "auto" | undefined;
                     allowlist?: string[] | undefined;
                     blocklist?: string[] | undefined;
                 } | undefined;
             }[];
             dm?: {
-                mode?: "mention" | "auto" | undefined;
                 enabled?: boolean | undefined;
+                mode?: "mention" | "auto" | undefined;
                 allowlist?: string[] | undefined;
                 blocklist?: string[] | undefined;
             } | undefined;
@@ -3707,7 +4272,7 @@ export declare const FleetConfigSchema: z.ZodObject<{
         description?: string | undefined;
     }>>;
     defaults: z.ZodOptional<z.ZodObject<{
-        docker: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
+        docker: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
             /** Enable Docker containerization for this agent (default: false) */
             enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
             /** Use ephemeral containers (fresh per job, auto-removed) vs persistent (reuse across jobs, kept for inspection) */
@@ -3730,143 +4295,266 @@ export declare const FleetConfigSchema: z.ZodObject<{
             workspace_mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["rw", "ro"]>>>;
             /** Environment variables to pass to the container (supports ${VAR} interpolation) */
             env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            /** Port bindings in format "hostPort:containerPort" or "containerPort" (e.g., "8080:80", "3000") */
+            ports: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** Tmpfs mounts in format "path" or "path:options" (e.g., "/tmp", "/tmp:size=100m,mode=1777") */
+            tmpfs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** Maximum number of processes (PIDs) allowed in the container (prevents fork bombs) */
+            pids_limit: z.ZodOptional<z.ZodNumber>;
+            /** Container labels for organization and filtering */
+            labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            /** CPU period in microseconds (default: 100000 = 100ms). Used with cpu_quota for hard CPU limits. */
+            cpu_period: z.ZodOptional<z.ZodNumber>;
+            /** CPU quota in microseconds per cpu_period. E.g., cpu_period=100000 + cpu_quota=50000 = 50% of one CPU. */
+            cpu_quota: z.ZodOptional<z.ZodNumber>;
             /** @deprecated Use 'image' instead */
             base_image: z.ZodOptional<z.ZodString>;
-        }, "strip", z.ZodTypeAny, {
+            /**
+             * Raw dockerode HostConfig passthrough for advanced options.
+             * Values here override any translated options (e.g., host_config.Memory overrides memory).
+             * See dockerode documentation for available options.
+             */
+            host_config: z.ZodOptional<z.ZodType<HostConfig, z.ZodTypeDef, HostConfig>>;
+        }, "strict", z.ZodTypeAny, {
             enabled: boolean;
             ephemeral: boolean;
-            network: "none" | "bridge" | "host";
             memory: string;
             max_containers: number;
             workspace_mode: "rw" | "ro";
-            image?: string | undefined;
+            network: "none" | "bridge" | "host";
+            labels?: Record<string, string> | undefined;
             cpu_shares?: number | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
             user?: string | undefined;
             volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         }, {
+            labels?: Record<string, string> | undefined;
             enabled?: boolean | undefined;
             ephemeral?: boolean | undefined;
-            image?: string | undefined;
-            network?: "none" | "bridge" | "host" | undefined;
             memory?: string | undefined;
             cpu_shares?: number | undefined;
-            user?: string | undefined;
             max_containers?: number | undefined;
-            volumes?: string[] | undefined;
             workspace_mode?: "rw" | "ro" | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
+            network?: "none" | "bridge" | "host" | undefined;
+            user?: string | undefined;
+            volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         }>, {
             enabled: boolean;
             ephemeral: boolean;
-            network: "none" | "bridge" | "host";
             memory: string;
             max_containers: number;
             workspace_mode: "rw" | "ro";
-            image?: string | undefined;
+            network: "none" | "bridge" | "host";
+            labels?: Record<string, string> | undefined;
             cpu_shares?: number | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
             user?: string | undefined;
             volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         }, {
+            labels?: Record<string, string> | undefined;
             enabled?: boolean | undefined;
             ephemeral?: boolean | undefined;
-            image?: string | undefined;
-            network?: "none" | "bridge" | "host" | undefined;
             memory?: string | undefined;
             cpu_shares?: number | undefined;
-            user?: string | undefined;
             max_containers?: number | undefined;
-            volumes?: string[] | undefined;
             workspace_mode?: "rw" | "ro" | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
+            network?: "none" | "bridge" | "host" | undefined;
+            user?: string | undefined;
+            volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         }>, {
             enabled: boolean;
             ephemeral: boolean;
-            network: "none" | "bridge" | "host";
             memory: string;
             max_containers: number;
             workspace_mode: "rw" | "ro";
-            image?: string | undefined;
+            network: "none" | "bridge" | "host";
+            labels?: Record<string, string> | undefined;
             cpu_shares?: number | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
             user?: string | undefined;
             volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         }, {
+            labels?: Record<string, string> | undefined;
             enabled?: boolean | undefined;
             ephemeral?: boolean | undefined;
+            memory?: string | undefined;
+            cpu_shares?: number | undefined;
+            max_containers?: number | undefined;
+            workspace_mode?: "rw" | "ro" | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
             image?: string | undefined;
             network?: "none" | "bridge" | "host" | undefined;
-            memory?: string | undefined;
+            user?: string | undefined;
+            volumes?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
+            base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
+        }>, {
+            enabled: boolean;
+            ephemeral: boolean;
+            memory: string;
+            max_containers: number;
+            workspace_mode: "rw" | "ro";
+            network: "none" | "bridge" | "host";
+            labels?: Record<string, string> | undefined;
             cpu_shares?: number | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
             user?: string | undefined;
-            max_containers?: number | undefined;
             volumes?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
+            base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
+        }, {
+            labels?: Record<string, string> | undefined;
+            enabled?: boolean | undefined;
+            ephemeral?: boolean | undefined;
+            memory?: string | undefined;
+            cpu_shares?: number | undefined;
+            max_containers?: number | undefined;
             workspace_mode?: "rw" | "ro" | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
+            network?: "none" | "bridge" | "host" | undefined;
+            user?: string | undefined;
+            volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         }>, {
             enabled: boolean;
             ephemeral: boolean;
-            network: "none" | "bridge" | "host";
             memory: string;
             max_containers: number;
             workspace_mode: "rw" | "ro";
-            image?: string | undefined;
+            network: "none" | "bridge" | "host";
+            labels?: Record<string, string> | undefined;
             cpu_shares?: number | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
             user?: string | undefined;
             volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         }, {
+            labels?: Record<string, string> | undefined;
             enabled?: boolean | undefined;
             ephemeral?: boolean | undefined;
+            memory?: string | undefined;
+            cpu_shares?: number | undefined;
+            max_containers?: number | undefined;
+            workspace_mode?: "rw" | "ro" | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
             image?: string | undefined;
             network?: "none" | "bridge" | "host" | undefined;
-            memory?: string | undefined;
+            user?: string | undefined;
+            volumes?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
+            base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
+        }>, {
+            enabled: boolean;
+            ephemeral: boolean;
+            memory: string;
+            max_containers: number;
+            workspace_mode: "rw" | "ro";
+            network: "none" | "bridge" | "host";
+            labels?: Record<string, string> | undefined;
             cpu_shares?: number | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
             user?: string | undefined;
-            max_containers?: number | undefined;
             volumes?: string[] | undefined;
-            workspace_mode?: "rw" | "ro" | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
-        }>>;
-        permissions: z.ZodOptional<z.ZodObject<{
-            mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["default", "acceptEdits", "bypassPermissions", "plan", "delegate", "dontAsk"]>>>;
-            allowed_tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-            denied_tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-            bash: z.ZodOptional<z.ZodObject<{
-                allowed_commands: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-                denied_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-            }, "strip", z.ZodTypeAny, {
-                allowed_commands?: string[] | undefined;
-                denied_patterns?: string[] | undefined;
-            }, {
-                allowed_commands?: string[] | undefined;
-                denied_patterns?: string[] | undefined;
-            }>>;
-        }, "strip", z.ZodTypeAny, {
-            mode: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk";
-            allowed_tools?: string[] | undefined;
-            denied_tools?: string[] | undefined;
-            bash?: {
-                allowed_commands?: string[] | undefined;
-                denied_patterns?: string[] | undefined;
-            } | undefined;
+            host_config?: HostConfig | undefined;
         }, {
-            mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
-            allowed_tools?: string[] | undefined;
-            denied_tools?: string[] | undefined;
-            bash?: {
-                allowed_commands?: string[] | undefined;
-                denied_patterns?: string[] | undefined;
-            } | undefined;
+            labels?: Record<string, string> | undefined;
+            enabled?: boolean | undefined;
+            ephemeral?: boolean | undefined;
+            memory?: string | undefined;
+            cpu_shares?: number | undefined;
+            max_containers?: number | undefined;
+            workspace_mode?: "rw" | "ro" | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
+            network?: "none" | "bridge" | "host" | undefined;
+            user?: string | undefined;
+            volumes?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
+            base_image?: string | undefined;
+            host_config?: HostConfig | undefined;
         }>>;
         work_source: z.ZodOptional<z.ZodUnion<[z.ZodObject<{
             type: z.ZodLiteral<"github">;
@@ -3993,31 +4681,31 @@ export declare const FleetConfigSchema: z.ZodObject<{
         model: z.ZodOptional<z.ZodString>;
         max_turns: z.ZodOptional<z.ZodNumber>;
         permission_mode: z.ZodOptional<z.ZodEnum<["default", "acceptEdits", "bypassPermissions", "plan", "delegate", "dontAsk"]>>;
+        allowed_tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        denied_tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
         max_turns?: number | undefined;
         model?: string | undefined;
         docker?: {
             enabled: boolean;
             ephemeral: boolean;
-            network: "none" | "bridge" | "host";
             memory: string;
             max_containers: number;
             workspace_mode: "rw" | "ro";
-            image?: string | undefined;
+            network: "none" | "bridge" | "host";
+            labels?: Record<string, string> | undefined;
             cpu_shares?: number | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
             user?: string | undefined;
             volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
-        } | undefined;
-        permissions?: {
-            mode: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk";
-            allowed_tools?: string[] | undefined;
-            denied_tools?: string[] | undefined;
-            bash?: {
-                allowed_commands?: string[] | undefined;
-                denied_patterns?: string[] | undefined;
-            } | undefined;
+            host_config?: HostConfig | undefined;
         } | undefined;
         work_source?: {
             type: "github";
@@ -4055,31 +4743,31 @@ export declare const FleetConfigSchema: z.ZodObject<{
             model?: string | undefined;
         } | undefined;
         permission_mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
+        allowed_tools?: string[] | undefined;
+        denied_tools?: string[] | undefined;
     }, {
         max_turns?: number | undefined;
         model?: string | undefined;
         docker?: {
+            labels?: Record<string, string> | undefined;
             enabled?: boolean | undefined;
             ephemeral?: boolean | undefined;
-            image?: string | undefined;
-            network?: "none" | "bridge" | "host" | undefined;
             memory?: string | undefined;
             cpu_shares?: number | undefined;
-            user?: string | undefined;
             max_containers?: number | undefined;
-            volumes?: string[] | undefined;
             workspace_mode?: "rw" | "ro" | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
+            network?: "none" | "bridge" | "host" | undefined;
+            user?: string | undefined;
+            volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
-        } | undefined;
-        permissions?: {
-            mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
-            allowed_tools?: string[] | undefined;
-            denied_tools?: string[] | undefined;
-            bash?: {
-                allowed_commands?: string[] | undefined;
-                denied_patterns?: string[] | undefined;
-            } | undefined;
+            host_config?: HostConfig | undefined;
         } | undefined;
         work_source?: {
             type: "github";
@@ -4117,6 +4805,8 @@ export declare const FleetConfigSchema: z.ZodObject<{
             model?: string | undefined;
         } | undefined;
         permission_mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
+        allowed_tools?: string[] | undefined;
+        denied_tools?: string[] | undefined;
     }>>;
     working_directory: z.ZodOptional<z.ZodObject<{
         root: z.ZodString;
@@ -4184,7 +4874,7 @@ export declare const FleetConfigSchema: z.ZodObject<{
         port?: number | undefined;
         secret_env?: string | undefined;
     }>>;
-    docker: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
+    docker: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
         /** Enable Docker containerization for this agent (default: false) */
         enabled: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         /** Use ephemeral containers (fresh per job, auto-removed) vs persistent (reuse across jobs, kept for inspection) */
@@ -4207,112 +4897,266 @@ export declare const FleetConfigSchema: z.ZodObject<{
         workspace_mode: z.ZodDefault<z.ZodOptional<z.ZodEnum<["rw", "ro"]>>>;
         /** Environment variables to pass to the container (supports ${VAR} interpolation) */
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /** Port bindings in format "hostPort:containerPort" or "containerPort" (e.g., "8080:80", "3000") */
+        ports: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Tmpfs mounts in format "path" or "path:options" (e.g., "/tmp", "/tmp:size=100m,mode=1777") */
+        tmpfs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        /** Maximum number of processes (PIDs) allowed in the container (prevents fork bombs) */
+        pids_limit: z.ZodOptional<z.ZodNumber>;
+        /** Container labels for organization and filtering */
+        labels: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /** CPU period in microseconds (default: 100000 = 100ms). Used with cpu_quota for hard CPU limits. */
+        cpu_period: z.ZodOptional<z.ZodNumber>;
+        /** CPU quota in microseconds per cpu_period. E.g., cpu_period=100000 + cpu_quota=50000 = 50% of one CPU. */
+        cpu_quota: z.ZodOptional<z.ZodNumber>;
         /** @deprecated Use 'image' instead */
         base_image: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
+        /**
+         * Raw dockerode HostConfig passthrough for advanced options.
+         * Values here override any translated options (e.g., host_config.Memory overrides memory).
+         * See dockerode documentation for available options.
+         */
+        host_config: z.ZodOptional<z.ZodType<HostConfig, z.ZodTypeDef, HostConfig>>;
+    }, "strict", z.ZodTypeAny, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
         volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }>, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
         volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }>, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
         volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
+        memory?: string | undefined;
+        cpu_shares?: number | undefined;
+        max_containers?: number | undefined;
+        workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
         image?: string | undefined;
         network?: "none" | "bridge" | "host" | undefined;
-        memory?: string | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
+        base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
+    }>, {
+        enabled: boolean;
+        ephemeral: boolean;
+        memory: string;
+        max_containers: number;
+        workspace_mode: "rw" | "ro";
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
-        max_containers?: number | undefined;
         volumes?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
+        base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
+    }, {
+        labels?: Record<string, string> | undefined;
+        enabled?: boolean | undefined;
+        ephemeral?: boolean | undefined;
+        memory?: string | undefined;
+        cpu_shares?: number | undefined;
+        max_containers?: number | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }>, {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
         volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }, {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
+        memory?: string | undefined;
+        cpu_shares?: number | undefined;
+        max_containers?: number | undefined;
+        workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
         image?: string | undefined;
         network?: "none" | "bridge" | "host" | undefined;
-        memory?: string | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
+        base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
+    }>, {
+        enabled: boolean;
+        ephemeral: boolean;
+        memory: string;
+        max_containers: number;
+        workspace_mode: "rw" | "ro";
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
-        max_containers?: number | undefined;
         volumes?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
+        base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
+    }, {
+        labels?: Record<string, string> | undefined;
+        enabled?: boolean | undefined;
+        ephemeral?: boolean | undefined;
+        memory?: string | undefined;
+        cpu_shares?: number | undefined;
+        max_containers?: number | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     }>>;
 }, "strict", z.ZodTypeAny, {
     version: number;
@@ -4323,16 +5167,23 @@ export declare const FleetConfigSchema: z.ZodObject<{
     docker?: {
         enabled: boolean;
         ephemeral: boolean;
-        network: "none" | "bridge" | "host";
         memory: string;
         max_containers: number;
         workspace_mode: "rw" | "ro";
-        image?: string | undefined;
+        network: "none" | "bridge" | "host";
+        labels?: Record<string, string> | undefined;
         cpu_shares?: number | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
         user?: string | undefined;
         volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     } | undefined;
     working_directory?: {
         root: string;
@@ -4356,25 +5207,23 @@ export declare const FleetConfigSchema: z.ZodObject<{
         docker?: {
             enabled: boolean;
             ephemeral: boolean;
-            network: "none" | "bridge" | "host";
             memory: string;
             max_containers: number;
             workspace_mode: "rw" | "ro";
-            image?: string | undefined;
+            network: "none" | "bridge" | "host";
+            labels?: Record<string, string> | undefined;
             cpu_shares?: number | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
             user?: string | undefined;
             volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
-        } | undefined;
-        permissions?: {
-            mode: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk";
-            allowed_tools?: string[] | undefined;
-            denied_tools?: string[] | undefined;
-            bash?: {
-                allowed_commands?: string[] | undefined;
-                denied_patterns?: string[] | undefined;
-            } | undefined;
+            host_config?: HostConfig | undefined;
         } | undefined;
         work_source?: {
             type: "github";
@@ -4412,6 +5261,8 @@ export declare const FleetConfigSchema: z.ZodObject<{
             model?: string | undefined;
         } | undefined;
         permission_mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
+        allowed_tools?: string[] | undefined;
+        denied_tools?: string[] | undefined;
     } | undefined;
     webhooks?: {
         enabled: boolean;
@@ -4420,18 +5271,25 @@ export declare const FleetConfigSchema: z.ZodObject<{
     } | undefined;
 }, {
     docker?: {
+        labels?: Record<string, string> | undefined;
         enabled?: boolean | undefined;
         ephemeral?: boolean | undefined;
-        image?: string | undefined;
-        network?: "none" | "bridge" | "host" | undefined;
         memory?: string | undefined;
         cpu_shares?: number | undefined;
-        user?: string | undefined;
         max_containers?: number | undefined;
-        volumes?: string[] | undefined;
         workspace_mode?: "rw" | "ro" | undefined;
+        tmpfs?: string[] | undefined;
+        pids_limit?: number | undefined;
+        cpu_period?: number | undefined;
+        cpu_quota?: number | undefined;
+        image?: string | undefined;
+        network?: "none" | "bridge" | "host" | undefined;
+        user?: string | undefined;
+        volumes?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        ports?: string[] | undefined;
         base_image?: string | undefined;
+        host_config?: HostConfig | undefined;
     } | undefined;
     working_directory?: {
         root: string;
@@ -4454,27 +5312,25 @@ export declare const FleetConfigSchema: z.ZodObject<{
         max_turns?: number | undefined;
         model?: string | undefined;
         docker?: {
+            labels?: Record<string, string> | undefined;
             enabled?: boolean | undefined;
             ephemeral?: boolean | undefined;
-            image?: string | undefined;
-            network?: "none" | "bridge" | "host" | undefined;
             memory?: string | undefined;
             cpu_shares?: number | undefined;
-            user?: string | undefined;
             max_containers?: number | undefined;
-            volumes?: string[] | undefined;
             workspace_mode?: "rw" | "ro" | undefined;
+            tmpfs?: string[] | undefined;
+            pids_limit?: number | undefined;
+            cpu_period?: number | undefined;
+            cpu_quota?: number | undefined;
+            image?: string | undefined;
+            network?: "none" | "bridge" | "host" | undefined;
+            user?: string | undefined;
+            volumes?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            ports?: string[] | undefined;
             base_image?: string | undefined;
-        } | undefined;
-        permissions?: {
-            mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
-            allowed_tools?: string[] | undefined;
-            denied_tools?: string[] | undefined;
-            bash?: {
-                allowed_commands?: string[] | undefined;
-                denied_patterns?: string[] | undefined;
-            } | undefined;
+            host_config?: HostConfig | undefined;
         } | undefined;
         work_source?: {
             type: "github";
@@ -4512,6 +5368,8 @@ export declare const FleetConfigSchema: z.ZodObject<{
             model?: string | undefined;
         } | undefined;
         permission_mode?: "default" | "acceptEdits" | "bypassPermissions" | "plan" | "delegate" | "dontAsk" | undefined;
+        allowed_tools?: string[] | undefined;
+        denied_tools?: string[] | undefined;
     } | undefined;
     agents?: {
         path: string;
@@ -4524,8 +5382,6 @@ export declare const FleetConfigSchema: z.ZodObject<{
     } | undefined;
 }>;
 export type PermissionMode = z.infer<typeof PermissionModeSchema>;
-export type BashPermissions = z.infer<typeof BashPermissionsSchema>;
-export type Permissions = z.infer<typeof PermissionsSchema>;
 export type WorkSourceType = z.infer<typeof WorkSourceTypeSchema>;
 export type WorkSourceLabels = z.infer<typeof WorkSourceLabelsSchema>;
 export type GitHubAuth = z.infer<typeof GitHubAuthSchema>;
@@ -4533,7 +5389,13 @@ export type GitHubWorkSource = z.infer<typeof GitHubWorkSourceSchema>;
 export type BaseWorkSource = z.infer<typeof BaseWorkSourceSchema>;
 export type WorkSource = z.infer<typeof WorkSourceSchema>;
 export type Instances = z.infer<typeof InstancesSchema>;
+export type AgentDockerInput = z.input<typeof AgentDockerSchema>;
+export type AgentDocker = z.infer<typeof AgentDockerSchema>;
+export type FleetDockerInput = z.input<typeof FleetDockerSchema>;
+export type FleetDocker = z.infer<typeof FleetDockerSchema>;
+/** @deprecated Use AgentDockerInput or FleetDockerInput instead */
 export type DockerInput = z.input<typeof DockerSchema>;
+/** @deprecated Use AgentDocker or FleetDocker instead */
 export type Docker = z.infer<typeof DockerSchema>;
 export type Defaults = z.infer<typeof DefaultsSchema>;
 export type WorkingDirectory = z.infer<typeof WorkingDirectorySchema>;