Configuration
Configuration
Environment variables and sandbox-policy.yaml for processd-mcp and the sandbox manager.
Two files matter on a Linux binary install:
| File | Role |
|---|---|
/etc/processd-mcp/processd-mcp.env | Process environment. systemd EnvironmentFile. |
| Policy YAML (optional) | Kernel sandbox. Path in MCP_SANDBOX_POLICY_FILE. |
The desktop app writes the same YAML schema through the GUI. The manager image is configured with PROCESSD_MANAGER_* env vars in compose.
There is no hot reload. Change env or YAML, then restart the process.
Kernel environment
The installer creates /etc/processd-mcp/processd-mcp.env mode 600:
MCP_HOST=127.0.0.1
MCP_PORT=8080
PROCESSD_TOKEN=<random hex>| Variable | Default | Meaning |
|---|---|---|
MCP_HOST | 0.0.0.0 without the installer; installer sets 127.0.0.1 | Bind address. See Linux binary. |
MCP_PORT | 8080 | Listen port. |
PROCESSD_TOKEN | unset (no auth) | Value of X-Access-Token. Always set this. |
MCP_SANDBOX_POLICY_FILE | unset (no kernel sandbox) | Absolute path to policy YAML. |
MCP_SANDBOX_RUNTIME_DIR | $TMPDIR/processd-mcp/sandbox | Helper runtime dir. |
MCP_DEFAULT_SHELL | $SHELL or /bin/bash | Shell for Bash. |
MCP_ALLOW_ESCALATED | false | Break-glass: skip sandbox for shell tools. Keep false in production. |
MCP_ALLOW_LOGIN_SHELL | true | Login shell for Bash. |
MCP_BASH_DEFAULT_TIMEOUT_MS | 120000 | Default Bash timeout. |
MCP_BASH_MAX_TIMEOUT_MS | 600000 | Hard max timeout. |
MCP_WEB_FETCH_DEFAULT_TIMEOUT_MS | 30000 | WebFetch timeout. |
MCP_WEB_FETCH_DEFAULT_MAX_BYTES | 2 MiB | WebFetch body cap. |
MCP_BASH_INLINE_OUTPUT_MAX_CHARS | 30000 | Bash stdout+stderr above this is saved under .processd/bash. |
MCP_READ_INLINE_OUTPUT_MAX_CHARS | 30000 | UTF-8 files and converted office/PDF Markdown above this must be read with limit. |
MCP_READ_OUTPUT_DIR | .processd/read | Internal cache of converted Markdown (<sha256>-<basename>.md). |
PROCESSD_ENV_* copies into the command environment (prefix stripped). Example: PROCESSD_ENV_TERM=linux becomes TERM=linux inside Bash.
Edit the env file, then:
sudo systemctl restart processd-mcpPolicy YAML
See Sandbox policy for the full schema and a worked example.
Manager
The Kubernetes Helm chart sets these on processd-manager:
| Variable | Typical | Meaning |
|---|---|---|
PROCESSD_MANAGER_PUBLIC_BASE_URL | http://127.0.0.1:18080 | Base URL returned by the manager. Scheduler rewrites this to its own public_base_url. |
PROCESSD_MANAGER_SANDBOX_TTL_SECONDS | 3600 | Idle sandbox lifetime. |
PROCESSD_K8S_POOL_TARGET | 2 | Number of idle sandbox Pods to keep ready. |
PROCESSD_K8S_MAX_SANDBOXES | unset | Optional cap on creating and running sandboxes, including Pods terminating or awaiting cleanup; does not change the idle pool target. |
Cluster walkthrough: Sandbox cluster.