Drift · isolation and security

Each Drift user lives in a per-user Docker container with an ephemeral volume daisy-ws-{uid}. There's no cross-user access.

What's ensured:

· Sandbox boundary — inside the container the user sees exactly /workspace (no uid in the path), with no mount of neighbors.
· SSRF guard on MCP URLs and the fetch_url tool — blocks private/loopback/link-local/cloud-metadata.
· Auth — every request is verified by a dft_* token; 5 active tokens per user, instant revoke.
· Access — Drift is open to everyone whose key has Qwen: Free on Qwen 3.6, paid plans with their models, Kimi K2.6 on Starter and Pro.
· Session TTL — the MCP registry lives in core memory, dropped after 720s or in the dispatch finally block.
· Privacy — model request bodies are saved only if history is turned on in your hub account; otherwise only metrics remain. We don't train on your data.

Reference sections (markdown for agents)