Kendr Code

Configure a verified sandbox for autonomous permissions.

Kendr Code keeps Auto (sandboxed) and Bypass permissions locked until the backend can prove that the selected container runtime, immutable image, network policy, and process cleanup boundary are ready. This guide covers the Windows and VS Code setup path.

Desktop and CLI Open the setup steps

VS Code Docker or Podman Digest-pinned image Fail-closed permissions

What “verified” means

A configured image is not enough. Kendr verifies the local runtime every time the project is refreshed and exposes autonomous profiles only when all required checks pass.

Check	Required state
Project	The Kendr Code project is trusted.
Backend	`container`, not native host execution or WSL alone.
Engine	A trusted Docker or Podman executable reaches a local Linux container daemon.
Image	The exact image is present locally and referenced as `repository@sha256:<64 lowercase hex characters>`.
Network	Container network access is denied by default and the policy is enforced.
Cleanup	Daemon-workload parent-death cleanup is attested for this engine and daemon endpoint.

Why the menu can still show disabled options

The permission menu reflects the backend attestation, not just the settings file. If any check fails, the options stay unavailable and the backend reason is shown so a setting cannot create a false sense of isolation.

Windows prerequisites

Install Docker Desktop configured for Linux containers, or install Podman with a running Linux-capable machine or VM.
Use an image reviewed by your organization or deployment owner. Kendr does not pull, build, or approve an image automatically.
Make sure the Docker or Podman daemon is running before the project is refreshed.
Use a trusted Kendr Code project. Autonomous modes are never available for an untrusted project.

Important Windows boundary

Native Windows host execution and WSL2 are approval-only for these profiles. WSL2 is useful for command compatibility, but it is not treated as an isolation boundary because it can expose host files and networking. A Windows host-unrestricted setting does not unlock autonomous turns.

Prepare and verify the image

Replace the placeholders below with the reviewed image your team publishes. Use the tag only to obtain the image; copy the immutable digest into Kendr Code settings.

# PowerShell
docker pull <reviewed-registry>/<image>:<tag>
docker version
docker info --format '{{.OSType}}'

# Read the immutable digest for the locally pulled image
$image = docker image inspect --format '{{index .RepoDigests 0}}' <reviewed-registry>/<image>:<tag>
$image

# Kendr must use:
# <reviewed-registry>/<image>@sha256:<64 lowercase hex characters>

With Podman, use the equivalent podman pull, podman info, and podman image inspect commands. The final setting must still use the digest form, never a mutable tag such as :latest.

Configure VS Code

Open the Kendr Code permission menu and choose Configure autonomous permissions…, or run Kendr Code: Configure Autonomous Permissions from the Command Palette.
Set kendr.code.sandboxBackend to container.
Set kendr.code.containerEngine to docker, podman, or auto.
Set kendr.code.containerImage to the exact digest-pinned image.
Trust the project if prompted, then refresh Kendr Code. The extension applies the project sandbox configuration and asks the backend to verify it.

{
  "kendr.code.sandboxBackend": "container",
  "kendr.code.containerEngine": "docker",
  "kendr.code.containerImage": "<reviewed-registry>/<image>@sha256:<64 lowercase hex characters>"
}

Success state

Reopen the permission menu. Auto (sandboxed) and Bypass permissions are selectable only when the sandbox status reports both profiles available. Bypass still opens its confirmation step, and protected identity, capability, connector, and user-question decisions can continue to pause.

Diagnose an unavailable sandbox

Read the exact reason shown in the permission menu or Kendr Code output, then match it to the usual fix:

Reported reason	What to check
Configure an immutable image	Replace a tag or local name with `@sha256:` plus exactly 64 lowercase hexadecimal characters.
Docker or Podman is not available	Install the selected engine, start it, and ensure its executable is visible to the Kendr runtime.
Container engine or daemon is not ready	Start Docker Desktop or the Podman machine and confirm the daemon is a Linux-capable local endpoint.
Image is not available locally	Pull the reviewed image first, then configure the digest returned by `image inspect`.
Autonomous profiles remain locked	The runtime is usable, but parent-death cleanup has not yet been attested for this engine and endpoint. Keep using approval-based profiles and retry after runtime verification completes.
Project is untrusted	Trust the exact project folder in Kendr Code before configuring or using an autonomous profile.

Do not bypass the check

Do not substitute a mutable image tag, WSL2, native Windows host execution, or an unverified daemon just to make the controls appear enabled. Those paths intentionally remain approval-gated.