Cowork Container Mode¶

Choose Container under Cowork Settings > Sub-Agent Execution Mode to run the next Cowork turn's sub-agents in Docker or Apple Container. The main agent continues to run in-process. The setting and image/timeout configuration persist in this browser or desktop profile, and each turn captures them when it starts.

Before starting¶

• Install Docker or configure Apple Container.
• Build or install the aigo-agent-runner:latest image using the Squad Container Mode instructions, or select a compatible custom image.
• Select a model that the application router can reach.
• Grant folders through Permitted Folders and enable recursive access for any folder the container needs. Each folder must also pass the shared mount allowlist.

An unavailable runtime, image, model route, or invalid mount fails the sub-agent. It never falls back to executing the task in-process. Remote agent profiles cannot satisfy container mode and are rejected.

Folders and credentials¶

Each container receives a private writable scratch directory at /workspace. A user working directory is never silently mounted there with write access. Permitted folders are mounted at /workspace/extra/folder-0, /workspace/extra/folder-1, and so on:

Folder changes apply to new turns; stop an active task to end its existing access. A bind mount includes descendants, so nonrecursive folder permissions are rejected. Extra mounts supplied in a request are rejected; only the backend's captured permitted folders determine mounts. The shared mount validator also rejects protected application directories.

The model uses the same application router as other runs. The grant accepts one request with the selected model, prompt, and output budget; retries and changed requests are refused. Usage comes from the router response, not container output. If a request was admitted but its usage is unavailable, limits conservatively reserve the prompt byte bound and full output allowance using configured model pricing. The run records an explicit estimate warning and leaves provider-reported usage unset. A missing model price cannot determine a dollar estimate. The container receives a temporary credential-proxy token, never a provider API key. Its token is revoked on completion, failure, timeout, Stop, cancellation, or application shutdown. On Apple Container the route uses the proxy's Unix socket relay.

Status and controls¶

The workspace rail's Sub-Agents tracker reports the runner's actual Provisioning, Running, Completed, Failed, or Timeout state. The configured timeout must be 1–120 minutes and bounds the whole batch task. Stop remains available through the run controls, and stopping the parent cancels its container children.

The runner accepts one task through stdin. Cowork does not provide a follow-up IPC directory or promise pause/resume for container children. Inspect the agent run's final result and error through the normal run history.

Troubleshooting¶

If a task cannot start, check the runtime and image, then the router and credential proxy. A mount error means the permitted folder, its recursive setting, or the mount allowlist needs correction. The bundled image cannot read mounted files without file-tool support; use an appropriate compatible image for that task.

Steering messages not reaching the agent¶

Container sub-agents reject steering explicitly. Stop the current task and submit a new one. Main-agent steering remains available and applies only to the main agent.