Simplify runtime providers

.env.example

@@ -62,8 +62,6 @@ PARSAR_PG_PORT=15432
 PARSAR_HOST_IP=
 # Set to parsar:local after running: make docker-build PARSAR_IMAGE=parsar PARSAR_IMAGE_TAG=local
 PARSAR_SERVER_IMAGE=parsar:local
-# Run: stat -c '%g' /var/run/docker.sock  (Linux) or stat -f '%g' (macOS)
-DOCKER_GID=999
 
 # -----------------------------------------------------------------------------
 # Feishu Bot (optional — see docs/deploy/lan-deploy.md)

.github/workflows/sandbox-image-release.yml

@@ -1,11 +1,7 @@
-# Build + push the Parsar sandbox images to GHCR.
+# Build + push the Parsar E2B-compatible sandbox image to GHCR.
 #
-# One Dockerfile (infra/sandbox/Dockerfile), two published images selected
-# by --build-arg BASE_IMAGE:
-#   - parsar-sandbox            local docker-backed sandbox provider
-#                                (AGENT_DAEMON_SANDBOX_BACKEND=docker),
-#                                multi-arch (amd64 + arm64)
-#   - parsar-sandbox-e2b  e2b.app SaaS template, amd64 only
+# Published image:
+#   - parsar-sandbox-e2b  E2B-compatible template, amd64 only
 #
 # Both compile parsar-daemon + the parsar CLI from source in the shared
 # Dockerfile's builder stage — neither depends on a published
@@ -19,7 +15,6 @@
 #   - Manual workflow_dispatch             -> build + push
 #
 # Output:
-#   ghcr.io/<owner-lowercase>/parsar-sandbox:<tag>
 #   ghcr.io/<owner-lowercase>/parsar-sandbox-e2b:<tag>
 #     - latest        on default-branch pushes
 #     - <short-sha>   on every build
@@ -29,7 +24,7 @@
 # `images:` field, or just build infra/sandbox/Dockerfile locally and
 # never run this workflow.
 
-name: sandbox images
+name: e2b sandbox image
 
 on:
   push:
@@ -64,46 +59,23 @@ permissions:
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - variant: local
-            image_name: parsar-sandbox
-            base_image: ubuntu:22.04
-            platforms_pr: linux/amd64
-            platforms_publish: linux/amd64,linux/arm64
-          - variant: e2b
-            image_name: parsar-sandbox-e2b
-            base_image: e2bdev/base:latest
-            # e2b.app sandboxes are amd64 only — no point publishing arm64.
-            platforms_pr: linux/amd64
-            platforms_publish: linux/amd64
     steps:
       - name: Checkout
         uses: actions/checkout@v7
 
-      - name: Set up QEMU
-        if: github.event_name != 'pull_request' && matrix.variant == 'local'
-        uses: docker/setup-qemu-action@v4
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
       - name: Choose build platforms
         id: platforms
         shell: bash
         run: |
-          if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]; then
-            echo "value=${{ matrix.platforms_pr }}" >> "$GITHUB_OUTPUT"
-          else
-            echo "value=${{ matrix.platforms_publish }}" >> "$GITHUB_OUTPUT"
-          fi
+          echo "value=linux/amd64" >> "$GITHUB_OUTPUT"
 
       - name: Compute lowercase GHCR image name
         id: image
         shell: bash
-        run: echo "name=ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/${{ matrix.image_name }}" >> "$GITHUB_OUTPUT"
+        run: echo "name=ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/parsar-sandbox-e2b" >> "$GITHUB_OUTPUT"
 
       - name: Log in to GitHub Container Registry
         if: github.event_name != 'pull_request'
@@ -132,9 +104,9 @@ jobs:
           file: infra/sandbox/Dockerfile
           platforms: ${{ steps.platforms.outputs.value }}
           build-args: |
-            BASE_IMAGE=${{ matrix.base_image }}
+            BASE_IMAGE=e2bdev/base:latest
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha,scope=sandbox-${{ matrix.variant }}
-          cache-to: type=gha,mode=max,scope=sandbox-${{ matrix.variant }}
+          cache-from: type=gha,scope=sandbox-e2b
+          cache-to: type=gha,mode=max,scope=sandbox-e2b

Dockerfile

@@ -6,6 +6,7 @@
 #   - parsar-server     (default CMD, serves the API and the SPA)
 #   - parsar-migrate    (goose migration runner)
 #   - parsar-bootstrap  (first-owner provisioning CLI)
+#   - parsar-daemon     (manual daemon runtime)
 #   - /app/web/dist       (Vite build output, served via PARSAR_WEB_DIST)
 #   - /app/migrations     (SQL migrations, picked up via PARSAR_MIGRATIONS_DIR)
 #
@@ -66,7 +67,7 @@ COPY packages ./packages
 RUN pnpm --filter @parsar/web build
 
 ###############################################################################
-# Stage 2: go-builder — compile the three Go binaries.
+# Stage 2: go-builder — compile the Go binaries.
 #
 # CGO is off so the binaries are statically linked and can run on a
 # minimal runtime. trimpath strips build-host file paths from the
@@ -88,7 +89,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 COPY internal ./internal
 COPY server ./server
 
-# Build all three binaries in one RUN so the layer represents one
+# Build server-side binaries in one RUN so the layer represents one
 # logical "compile" operation. -s -w strips debug info / symbol table;
 # combined they shave ~25% off binary size with no runtime cost.
 RUN --mount=type=cache,target=/go/pkg/mod \
@@ -123,6 +124,8 @@ RUN --mount=type=cache,target=/go/pkg/mod \
           ./apps/parsar-daemon/cmd/parsar-daemon; \
     done
 
+RUN cp "/out/daemon/parsar-daemon-linux-${TARGETARCH}" /out/parsar-daemon
+
 ###############################################################################
 # Stage 3: runtime — debian-slim with a non-root user.
 #
@@ -160,6 +163,7 @@ RUN set -eux; \
 COPY --from=go-builder /out/parsar-server    /usr/local/bin/parsar-server
 COPY --from=go-builder /out/parsar-migrate   /usr/local/bin/parsar-migrate
 COPY --from=go-builder /out/parsar-bootstrap /usr/local/bin/parsar-bootstrap
+COPY --from=go-builder /out/parsar-daemon    /usr/local/bin/parsar-daemon
 
 # Per-platform parsar-daemon binaries. RegisterParsarDaemonDownloadRoute
 # serves these (from PARSAR_DAEMON_BINARY_DIR) to the one-line connect

INSTALL.md

@@ -22,14 +22,9 @@ user is the administrator.
 ## Requirements
 
 - Docker Engine with Docker Compose v2.
-- Linux host with access to `/var/run/docker.sock`. The local compose stack
-  enables Docker-managed agent sandboxes and mounts the Docker socket. The
-  sandbox image (`ghcr.io/minimax-ai-dev/parsar-sandbox:latest`) is pulled
-  automatically — build your own instead with:
-  ```bash
-  docker build -f infra/sandbox/Dockerfile -t parsar-sandbox:local .
-  PARSAR_SANDBOX_IMAGE=parsar-sandbox:local ./install.sh
-  ```
+- `parsar-server` does not need host container-engine privileges. Local
+  execution uses `manual_daemon`; managed isolation uses an E2B-compatible
+  provider.
 
 ## What The Installer Does
 

apps/web/src/components/runtime/RuntimeStatusBanner.tsx

@@ -79,7 +79,6 @@ function describeStatus(
     available: boolean
     sandbox_agent_count: number
     profile: string
-    configured_by?: string
     credential_masked?: string | null
   },
 ): BannerKeys {