/**
 * Docker Sandbox Module
 *
 * Executes commands in isolated Docker containers for maximum security.
 * Provides filesystem isolation, network restrictions, and resource limits.
 */
import { EventEmitter } from 'events';
export interface SandboxConfig {
    /** Docker image to use */
    image: string;
    /** Host path to mount as /workspace */
    workspaceMount?: string;
    /** Command timeout in ms */
    timeout: number;
    /** Memory limit (e.g., '512m') */
    memoryLimit: string;
    /** CPU limit (e.g., '1.0') */
    cpuLimit: string;
    /** Whether networking is enabled */
    networkEnabled: boolean;
    /** Whether the root filesystem is read-only */
    readOnly: boolean;
}
export interface SandboxResult {
    success: boolean;
    output: string;
    error?: string;
    exitCode: number;
    durationMs: number;
    containerId?: string;
}
export declare class DockerSandbox extends EventEmitter {
    private config;
    private activeContainers;
    constructor(config?: Partial<SandboxConfig>);
    /**
     * Check if Docker is available on the system.
     */
    static isAvailable(): boolean;
    /**
     * Execute a command in a sandboxed container.
     */
    execute(command: string, opts?: Partial<SandboxConfig>): Promise<SandboxResult>;
    /**
     * Execute with streaming output. Yields stdout chunks as they arrive.
     */
    executeStreaming(command: string, opts?: Partial<SandboxConfig>): AsyncGenerator<string, SandboxResult>;
    /**
     * Kill a running container by name/id.
     */
    kill(containerId: string): Promise<boolean>;
    /**
     * Prune stopped sandbox containers (label-based).
     * Returns the number of containers pruned.
     */
    prune(): Promise<number>;
    /**
     * Get list of active sandbox container names.
     */
    getActive(): string[];
    /**
     * Cleanup all active containers.
     */
    dispose(): Promise<void>;
    /**
     * Build docker run arguments.
     */
    private buildDockerArgs;
}
