
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@mastra/docker
Advanced tools
Affected versions:
Docker container sandbox provider for Mastra workspaces. Uses long-lived containers with docker exec for command execution. Targets local development, CI/CD, air-gapped deployments, and cost-sensitive scenarios where cloud sandboxes are unnecessary.
npm install @mastra/docker
import { Agent } from '@mastra/core/agent';
import { Workspace } from '@mastra/core/workspace';
import { DockerSandbox } from '@mastra/docker';
const workspace = new Workspace({
sandbox: new DockerSandbox({
image: 'node:22-slim',
timeout: 60_000, // 60 second timeout (default: 5 minutes)
}),
});
const agent = new Agent({
name: 'my-agent',
model: 'anthropic/claude-opus-4-6',
workspace,
});
Use mounts (mapped 1:1 onto Docker's HostConfig.Mounts) when you need mount
options that the -v/volumes syntax cannot express — most notably mounting a
subdirectory of a named volume. Requires Docker Engine 26.0+ (API v1.45+) for
subpath.
const workspace = new Workspace({
sandbox: new DockerSandbox({
image: 'node:22-slim',
mounts: [
// Read-only parent from a named volume
{ type: 'volume', source: 'project-data', target: '/shared', readOnly: true },
// Writable per-conversation subdirectory of the same volume
{
type: 'volume',
source: 'project-data',
target: '/work',
volumeOptions: { subpath: 'conversations/abc123' },
},
],
}),
});
volumes and mounts can be combined; both are passed through to Docker.
Note: Docker does not create
volumeOptions.subpathfor you — the subdirectory must already exist inside the named volume before the container starts, otherwise the mount fails. Provision it ahead of time (for example, with a one-off container that createsconversations/abc123in the volume).
See the package changelog for version history and release notes.
We have an open community Discord. Come and say hello and let us know if you have any questions or need any help getting things running.
FAQs
Docker container sandbox provider for Mastra workspaces
The npm package @mastra/docker receives a total of 4,461 weekly downloads. As such, @mastra/docker popularity was classified as popular.
We found that @mastra/docker demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.