feat(templates): add enterprise policy presets (locked-down/internet/gpu)

templates/presets/README.md

@@ -0,0 +1,30 @@
+# E2B Policy Presets (experimental)
+
+Opinionated, enterprise-ready sandbox policy presets. Select a preset by name
+instead of hand-editing source.
+
+| Preset | Internet | Code exec | GPU | Intended use |
+|---|---|---|---|---|
+| `locked-down` | blocked | restricted | no | regulated / offline evaluation |
+| `internet-enabled` | allowed | standard | no | research assistants, web tools |
+| `gpu-enabled` | allowed | standard | yes | training, inference, vision |
+
+Presets are JSON files in this directory. A preset is a documented *contract*,
+not a runtime; the platform integration layer reads the file and applies the
+corresponding sandbox flags.
+
+## Selecting a preset
+
+```bash
+# future CLI (planned)
+e2b template create --preset locked-down my-template
+
+# today: reference the JSON file directly in your template config
+cat templates/presets/locked-down.json
+```
+
+## Status
+
+Minimum delighter slice (Wave 3 P1). Presets are documented and testable but
+are not yet wired into the sandbox runtime. See `tests/presets.test.json` for
+schema coverage.

templates/presets/gpu-enabled.json

@@ -0,0 +1,24 @@
+{
+  "name": "gpu-enabled",
+  "description": "GPU-attached environment for training, inference, and vision workloads. Outbound internet allowed.",
+  "network": {
+    "egress": "allow",
+    "allowlist": ["*"],
+    "audit": true
+  },
+  "runtime": {
+    "allow_shell": true,
+    "allow_package_install": true,
+    "max_processes": 128,
+    "max_memory_mb": 16384
+  },
+  "gpu": {
+    "enabled": true,
+    "min_vram_gb": 16
+  },
+  "audit": {
+    "log_stdout": true,
+    "log_stderr": true,
+    "retention_days": 14
+  }
+}

templates/presets/internet-enabled.json

@@ -0,0 +1,23 @@
+{
+  "name": "internet-enabled",
+  "description": "Outbound internet allowed with an egress audit log. Standard code execution. No GPU.",
+  "network": {
+    "egress": "allow",
+    "allowlist": ["*"],
+    "audit": true
+  },
+  "runtime": {
+    "allow_shell": true,
+    "allow_package_install": true,
+    "max_processes": 64,
+    "max_memory_mb": 4096
+  },
+  "gpu": {
+    "enabled": false
+  },
+  "audit": {
+    "log_stdout": true,
+    "log_stderr": true,
+    "retention_days": 14
+  }
+}

templates/presets/locked-down.json

@@ -0,0 +1,22 @@
+{
+  "name": "locked-down",
+  "description": "Offline, no network egress, restricted code execution. For regulated workloads and evaluation harnesses.",
+  "network": {
+    "egress": "deny",
+    "allowlist": []
+  },
+  "runtime": {
+    "allow_shell": false,
+    "allow_package_install": false,
+    "max_processes": 16,
+    "max_memory_mb": 2048
+  },
+  "gpu": {
+    "enabled": false
+  },
+  "audit": {
+    "log_stdout": true,
+    "log_stderr": true,
+    "retention_days": 30
+  }
+}

templates/presets/presets.test.json

@@ -0,0 +1,5 @@
+{
+  "$comment": "Minimal schema coverage for policy presets. Asserts required keys on every preset.",
+  "required_keys": ["name", "description", "network", "runtime", "gpu", "audit"],
+  "presets": ["locked-down", "internet-enabled", "gpu-enabled"]
+}