Docker Sandbox with Chainloop 🐳

Hi, my name is Miguel and today I want to show you how to run Docker Sandbox alongside Chainloop in this example repository that we have here, which has both a Go and a Node application.

And I'm going to simulate what it would be to basically run a change, a change using cloud code and how all this session and all this information can be capture and analyze using Chainloop and of course running it inside the Docker Sandbox.

So basically what we need, what they have in my environment, I have the app clone the repository and I also have ENV file which contains a Chainloop token.

The Chainloop token is what's not as needed to push the session to Chainloop.

So let me.

So let's get started.

We're going to run it, we're going to run this example and what you will do, you can run it as sbx, run with the.

I'm calling the git but.

Or you can run it, or you can create an sb, a Sandbox environment file that you can also use.

So I just run it.

And what you can see, this is basically a cloud code instance.

But there is an additional information up here telling you that this is going to record Chainloop is going to record this session.

So this is the integration that we have done with Docker in this case.

So this is running in a Docker Sandbox, as you can see here.

But now we're going to make a change and see what's new.

And what I want to do is to add a change that says report the health of the event bus in the status endpoint.

So this is a new feature that I want to introduce.

We have a status endpoint that returns information about the health of the database.

But now we also want to do the equivalent for the, for the event bus.

And So there is nothing special here.

But I'm just developing how I will do any other change.

I can't create a spec in advance if I want to and then record it.

Or I can do it directly in this case, for the sake of doing the demo, I'm just doing it directly.

Okay, so it seems that you just created the pull request.

So if we go to the pull request, it indeed modified the status page, for the event bus output.

But also something that you might have noticed here is saying that there is a coding session available in this URL and this is where the magic happens.

So basically Chainloop has sent, or the integration that we did inside the sandbox has sent the evidence, the transcript of removing secrets and redacting it, with all the different calls that we do, the tools that are called, and we take that information and we can tell you which commits, have happened, how much was the change, what files have been modified, by whom, whether it was human or AI.

In this case, all the changes were done by AI, as you saw in the demo.

What, tools have we called the pr?

Then we have a set of policies that have been running.

So this is something that you can configure in the system yourself.

You can define what MCPs are allowed, what AI agents or models or harnesses are allowed.

So you can configure this.

These are policies that we have available in our system.

So you can define things like, I want to make sure that we're using an AI agent that we're allowed, or that the model that we have is one of the ones that we support.

Like in this case you can do, like, I want to make sure that we only solve Sonet Family things like that.

But going back, what you might have seen is.

So we have here like the session contributed with the associated pull request.

And in this pull request that I showed before, now we also have all this information that we were talking about about the session, what actually changed.

But we also now have a set of like scores.

And these scores are basically an analysis on the scope of the change alongside, the transcript and the code.

And we can tell you whether the change has been scoped to the actual spec.

For example, in this case I didn't have a spec.

But imagine that you provide the spec.

That's why you get the context and planning.

It checks whether it's as a solution, is what is expected, whether you ran some verification or it was aligned.

This case is a little bit like very small change.

But you can imagine when there is a bigger change, you will get a lot of signals here to know how healthy this session is.

And this is something that you get out of the box.

So here you can see all this information.

And then of course from the organization point of view at Chainloop, you can start seeing at the high level how much of the code that you are generating in your organization is on through AI, how many PRs are actually AI assisted versus manual.

You can see which models which harnesses, so on and so forth, as well as, what's the quality of the contributions which are the scoring that I was talking about.

So this is the.

Once you do that.

As you can see the demo, it didn't contain.

You didn't need to do anything special.

you just run the plot code using the Docker Sandbox and it worked.

Like any other change that you will do, you can always merge it and you will be good to go.

Once we merged it, then this session will be part of the rest of the SDLC or the superdeliver lifecycle capabilities.

So this session that now has been recorded here, you can now take it into account and analyze it in the context of the rest.

So this is the session, we have the two commits that we're doing, the PR checks that we are doing, etc.

Etc.

So you can imagine how this by providing, by running this, by injecting, by sending this evidence, you're connecting it to the rest of the so called supply chain, activities.

For example, in this case, I know that's a little messy, but you have a SAS report, you might have a vulnerability report.

All of that is connected automatically.

So that's it.

you can find more information about how to use how to use can loop with Docker in this guide and that's Docker Sandbox.

And here we explain what you can get, how to install, what are the prerequisites and how to run it in two different ways.

That's it.

I hope that it's useful.

Thank you.