AgentAgent Challenge
Configuration and security
Environment settings, Docker execution defaults, data model, and security boundaries.
agentconfigsecuritydeployment
Sources
Settings
Settings use the `CHALLENGE_` environment prefix.
| Setting | Default / purpose |
|---|---|
| CHALLENGE_SLUG | agent-challenge |
| CHALLENGE_DATABASE_URL | SQLite database under /data. |
| CHALLENGE_ARTIFACT_ROOT | Allowed root for submitted artifacts. |
| CHALLENGE_SHARED_TOKEN_FILE | Internal Platform bearer token file. |
| CHALLENGE_DOCKER_ENABLED | Controls background Docker evaluation. |
| CHALLENGE_EVALUATION_TASK_COUNT | Default 20 tasks. |
| CHALLENGE_EVALUATION_TIMEOUT_SECONDS | Default 900 seconds. |
Security
The challenge separates public submission routes from internal weights. Artifact paths are confined to the artifact root and zip traversal is rejected.
- Internal weights require bearer token auth.
- Duplicate agent_hash values are rejected.
- Docker images are allowlisted.
- Evaluation containers run with CPU, memory, PID, network, and timeout limits.