@@ -325,6 +325,10 @@ export async function createContainerProfile(options: ProfileOptions): Promise<C
     const args = ['create', '--name', name, '--read-only', '--user', '10001:10001', '--cap-drop=ALL',
       '--security-opt=no-new-privileges', '--security-opt=seccomp=builtin', '--runtime=runc', '--pids-limit=128', '--memory=512m', '--memory-swap=512m',
       '--cpus=1', '--shm-size=16m', '--ipc=private', '--cgroupns=private',
+      // The supervisor reads the agent's output through `docker start --attach` and bounds it there. The daemon keeps no
+      // copy (#165): with the daemon's default driver (json-file, unbounded unless the daemon is set otherwise) it could grow
+      // until the supervisor stops the container.
+      '--log-driver=none',
       `--network=${options.network.name}`, '--dns=127.0.0.1', '--env', 'HOME=/home/codeboost',
       '--env', `CODEBOOST_PHASE=${invocation.phase}`,
       '--label', `io.codeboost.invocation=${ownershipId}`, ...ownerLabelArgs(containerOwner),
 
@@ -190,6 +190,7 @@ type Inspect = {
     CpuPercent: number; IOMaximumBandwidth: number; IOMaximumIOps: number; DeviceCgroupRules: unknown[] | null;
     StorageOpt?: Record<string, string> | null; CgroupParent: string;
     RestartPolicy?: { Name?: string; MaximumRetryCount?: number } | null; Runtime: string;
+    LogConfig?: DaemonLogConfig;
     Devices: unknown[] | null; DeviceRequests: unknown[] | null; Tmpfs: Record<string, string> | null;
     Mounts: Array<{ Type: string; Source: string; Target: string; ReadOnly: boolean;
       TmpfsOptions?: { SizeBytes?: number; Mode?: number; Options?: unknown };
@@ -200,6 +201,16 @@ type Inspect = {
   NetworkSettings: { Networks: Record<string, unknown>; Ports: Record<string, unknown> };
 };
 
+type DaemonLogConfig = { Type?: string; Config?: Record<string, string> | null } | null | undefined;
+/**
+ * Whether an inspected `HostConfig.LogConfig` keeps no daemon log (#165): driver `none`, and only options whose key
+ * starts with `cache-`. A daemon copies its own `cache-*` log options into every container, whatever its driver (moby
+ * v27.4.0, `logcache.MergeDefaultLogConfig`), and with `none` no logger or cache starts, so they do nothing. The CLI
+ * refuses any option with `none`, but the API stores whatever it is given.
+ */
+export const keepsNoDaemonLog = (config: DaemonLogConfig): boolean => config?.Type === 'none'
+  && Object.keys(config.Config ?? {}).every(key => key.startsWith('cache-'));
+
 /** Validate daemon-resolved configuration before starting an agent. */
 export async function validateContainer(container: string, profile: ContainerProfile, timeoutMs = 30_000,
   signal?: AbortSignal, processLifecycle?: ProcessGroupLifecycle): Promise<void> {
@@ -244,7 +255,8 @@ export async function validateContainer(container: string, profile: ContainerPro
     || host.CpuCount !== 0 || host.CpuPercent !== 0 || host.IOMaximumBandwidth !== 0 || host.IOMaximumIOps !== 0
     || host.DeviceCgroupRules !== null || host.StorageOpt != null || host.CgroupParent !== ''
     || !['', 'no'].includes(host.RestartPolicy?.Name ?? '') || (host.RestartPolicy?.MaximumRetryCount ?? 0) !== 0
-    || host.Runtime !== 'runc')
+    || host.Runtime !== 'runc'
+    || !keepsNoDaemonLog(host.LogConfig))
     throw new Error('Container daemon configuration is missing required lockdown.');
   if (JSON.stringify(host.Dns) !== JSON.stringify(['127.0.0.1']))
     throw new Error('Container DNS configuration changed.');
 
@@ -239,6 +239,7 @@ Nothing else from your computer is inside. So `~/.ssh`, `~/.config/gh`, `~/.npmr
 | Runs as a non-root user; all Linux capabilities dropped (`--cap-drop=ALL`); `--security-opt=no-new-privileges` | The agent cannot become root or use privileged system calls. |
 | No `--privileged`, no `--device`, no host network, no Docker socket, and no host mounts other than the bounded worktree, separate read-only Git metadata, runner-prepared read-only schema input, and read-only sign-in file | Nothing on the host is reachable through the container. |
 | Limits on processes, memory, and CPU (`--pids-limit`, `--memory`, `--cpus`) | Bound the agent's consumption of these resources; they do not guarantee zero host performance impact. |
+| No Docker daemon log (`--log-driver=none`) | The supervisor reads the agent's output as it is written (`docker start --attach`) and bounds it there. The daemon keeps no copy that a fast writer could grow before the supervisor stops the container. |
 | `/work` lives on a dedicated size-limited task filesystem with hard byte and inode limits, allocated before the invocation; never an unbounded host-directory bind | Large output and many tiny files fail inside the task filesystem instead of growing without limit on the host. |
 
 **Output and time enforcement.** A trusted supervisor outside the invocation container incrementally captures every agent/check command with hard limits of 16 MiB stdout, 4 MiB stderr, and 20 MiB combined, including protocol envelopes. Host buffers, persisted logs, and UI forwarding obey the same per-invocation limits; task-log retention has a configured total byte cap and never accumulates unbounded output across retries. Before launch, require a finite wall deadline (default 10 minutes, capped by the remaining task budget; configured overrides must also be finite). On overflow/deadline or capture failure, stop consuming into retained buffers, terminate the entire container including descendants, escalate to forced container kill if graceful termination fails, and record a bounded failure diagnostic. Never wait indefinitely for EOF from an orphan child, silently treat truncated output as success, or run tests/commit after this failure. Container tests must exercise infinite stdout, infinite stderr, mixed streams, and a child ignoring SIGTERM, while measuring bounded host capture and completed termination. For structured vendor output, the transport cap includes envelope headroom; separately enforce the 1 MiB plan-document limit after extraction.
 
@@ -37,6 +37,7 @@ Each row is a T9 requirement for the Docker suite. The suite fails if any row fa
 | Planning and questions cannot run a process | `agent-policy`: tool sets exclude the command tool, and command dispatch refuses these phases |
 | Codex runs in no phase, because it cannot read code without its shell (see [Codex is refused in every phase](#codex-is-refused-in-every-phase)) | `agent-policy`: the Codex command refuses all five phases; `agent-adapter`: the Codex start call refuses them and allocates nothing; `runner-execution`: an execute task with Codex is refused before task storage exists |
 | A planning answer is checked against the mounted schema | `agent-policy`: only the Claude planning command passes `--json-schema`; `agent-container`: the profile refuses a command whose schema differs from the mounted file; `agent-adapter`: the answer is read from `structured_output` |
+| The Docker daemon keeps no log of an agent container (#165): the supervisor's bounded capture through `docker start --attach` is the only copy of its output. This covers the agent container only. The runner's other containers keep the daemon's default log: the task-storage script containers (`docker run --rm`, `agents/container/storage.ts`), whose log is removed with the container while the client bounds what it reads, and the storage keeper and egress proxy, which write no output | `agent-container`: the created container's `LogConfig` is driver `none` with no option but `cache-*` ones; the validator refuses a container with a `json-file` log or a bounded `local` log; every probe that returns output shows the attach still delivers it. `agent-daemon-log`: the rule (`keepsNoDaemonLog`) also refuses driver `none` with a log option, which only the API can set, and accepts the `cache-*` options a daemon copies into every container |
 | Task and scratch byte and inode limits hold | `agent-container`: task capacity; scratch capacity for Codex and Claude (`/tmp`, `HOME`, `CODEX_HOME`, output directory) |
 | Hard links and alias writes from `.git/config` and objects fail, and metadata stays unchanged | `agent-container`: metadata alias probe in planning, review and execute, with a digest of `.git` before and after |
 | Mountpoint replacement fails | `agent-container`: metadata and metadata alias probes (`mv` and `rm -rf` of `.git`) |
 
@@ -20,12 +20,12 @@ Issue #6 tracked the v1 plan library contract and the runner obligations that ca
 | Hostile repository, issue, lesson, feedback, previous-plan and continuation-context text in every authoring prompt | **This change** (revised drafts, suggestions and the continuation context) | `test/planning-author.test.ts` |
 | Container mounts: Git metadata on its own filesystem, read-only, with no writable hard links or aliases into it | Done before this change | `agents/container/profile.ts`, probe `metadata-alias` in `agents/policy.ts`; `test/agent-container.test.ts` ("keeps Git metadata read-only, on another filesystem, and mounted against replacement", "keeps Git metadata unchanged under link, alias, truncation and replacement attempts during %s"), negative controls in `test/agent-gate.test.ts` (real Docker) |
 | Process termination: output overflow, deadline and cancellation stop the whole container, including a process that ignores SIGTERM | Done before this change | `agents/adapters/supervisor.ts`; `test/agent-supervisor.test.ts` ("terminates %s at bounded output limits", "enforces a finite wall deadline and force-settles the container", "preserves the first cancellation reason until an ignored SIGTERM fully settles") (real Docker) |
-| Output shown in the UI bounded: captured output comes only from the supervisor, which bounds stdout and stderr; when a planning run exits with an error, the provider's message quotes its output with whitespace collapsed, cut to at most 300 UTF-16 code units (`runner/planning-provider.ts`) | Done before this change; 300-unit quote tested in this change | `test/agent-supervisor.test.ts` output-limit cases (real Docker); `test/planning-provider.test.ts` ("quotes at most 300 code units of a failed run's output, with whitespace collapsed"). The Docker daemon's own log is #165 |
+| Output shown in the UI bounded: captured output comes only from the supervisor, which bounds stdout and stderr; when a planning run exits with an error, the provider's message quotes its output with whitespace collapsed, cut to at most 300 UTF-16 code units (`runner/planning-provider.ts`) | Done before this change; 300-unit quote tested in this change | `test/agent-supervisor.test.ts` output-limit cases (real Docker); `test/planning-provider.test.ts` ("quotes at most 300 code units of a failed run's output, with whitespace collapsed"). The Docker daemon's own log is #165 (*later:* the daemon keeps none) |
 | Output limits at the exact byte | **This change** (tests; the supervisor already enforced the limits) | Supervisor enforcement: `test/agent-supervisor.test.ts` (real Docker). Decoder behaviour only, not a limit: the Claude decoder handles an envelope of exactly the stdout ceiling, and the 1 MiB parser limit applies to the decoded answer at the exact byte: `test/agent-adapter.test.ts`. At #6 the decoder re-serialized the answer, so the limit applied to the re-encoded text. *Later:* #166 returns the exact text of `structured_output` in the CLI's envelope, so the limit applies to those bytes |
 | Prompt byte budget before spawn | Done before this change | `MAX_PROMPT_BYTES` in `core/planning-author.ts`; `test/planning-author.test.ts` ("accepts exactly the prompt byte limit and rejects the next byte without truncation") |
 | Model budget before spawn | Moved to #163 | — |
 | Planning profile probed at startup | Moved to #164 | — |
-| Docker daemon log limits | Moved to #165 | — |
+| Docker daemon log limits | Moved to #165. *Later:* fixed in #165 with `--log-driver=none`, checked before launch | `agents/container/profile.ts`, `agents/container/run.ts`; `test/agent-container.test.ts` ("creates the agent container with no Docker daemon log", "refuses an agent container with %s at validation") (real Docker), `test/agent-daemon-log.test.ts`. Agent containers only; the runner's other containers (task-storage scripts, the keeper, the egress proxy) keep the daemon's default log |
 | Claude structured output under the v1 parsing contract | Moved to #166 (found during this change). *Later:* fixed in #166 | `agents/adapters/claude.ts`; `test/agent-adapter.test.ts` ("lets draft validation refuse %s in a structured answer") |
 
 ## Schema loading
 
@@ -13,7 +13,7 @@ import { AGENT_IMAGE, assertBuiltAgentImage, buildAgentImage } from '../agents/c
 import { assertContainerProfile, createContainerProfile, disposeContainerProfile,
   containerProfileResources, isContainerProfileAuthentic } from '../agents/container/profile.ts';
 import { createValidatedContainer, disposeValidatedContainer, prepareTaskFilesystems, removeTaskFilesystems, runContainer,
-  startValidatedContainer, hasExactOptions, validateContainer } from '../agents/container/run.ts';
+  startValidatedContainer, hasExactOptions, keepsNoDaemonLog, validateContainer } from '../agents/container/run.ts';
 import { createTaskClone } from '../git/clone.ts';
 import { hasOwnerLabels } from '../agents/labels.ts';
 import { exportTaskDiff, exportTaskPaths, importTaskPaths, isRecoveredTaskStorage, prepareTaskFilesystemsAsync, taskFilesystemOwner, EXPORT_SCRIPT,
@@ -224,6 +224,31 @@ describe('real Docker agent isolation', () => {
     expect(args).toContain('--cgroupns=private');
   }, 60_000);
 
+  // #165: the supervisor bounds the output it reads through `docker start --attach`; the daemon must keep no copy.
+  it('creates the agent container with no Docker daemon log', async () => {
+    const live = await profile(fixture(), 'planning', 'noop');
+    await createValidatedContainer(live); containers.add(live.name);
+    const inspected = JSON.parse(docker('container', 'inspect', live.name))[0] as
+      { HostConfig: { LogConfig: { Type: string; Config: Record<string, string> | null } } };
+    // Driver `none`, with no option but the `cache-*` ones a daemon copies from its own log options, if it has any.
+    expect(inspected.HostConfig.LogConfig.Type).toBe('none');
+    expect(Object.keys(inspected.HostConfig.LogConfig.Config ?? {}).filter(key => !key.startsWith('cache-'))).toEqual([]);
+    expect(keepsNoDaemonLog(inspected.HostConfig.LogConfig)).toBe(true);
+    await disposeValidatedContainer(live); containers.delete(live.name);
+  }, 60_000);
+
+  it.each([
+    ['a json-file daemon log', (args: readonly string[]) => args.map(arg => arg === '--log-driver=none' ? '--log-driver=json-file' : arg)],
+    ['a bounded local daemon log', (args: readonly string[]) => args.flatMap(arg => arg === '--log-driver=none'
+      ? ['--log-driver=local', '--log-opt', 'max-size=1m', '--log-opt', 'max-file=1'] : [arg])],
+  ] as const)('refuses an agent container with %s at validation', async (_label, change) => {
+    const valid = await profile(fixture(), 'planning', 'must-not-run');
+    expect(valid.args).toContain('--log-driver=none');
+    docker(...change(valid.args)); containers.add(valid.name);
+    await expect(validateContainer(valid.name, valid)).rejects.toThrow('lockdown');
+    docker('rm', '--force', valid.name); containers.delete(valid.name);
+  }, 60_000);
+
   it.each(['planning', 'review', 'execute'] as const)(
     'keeps Git metadata unchanged under link, alias, truncation and replacement attempts during %s', async phase => {
       expect(await runContainer(await profile(fixture(), phase, 'metadata-alias'))).toBe('metadata-unchanged');
 
@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest';
+import { keepsNoDaemonLog } from '../agents/container/run.ts';
+
+// The validator's rule for an agent container's daemon log (#165), for configurations the CLI cannot make: it refuses
+// `--log-opt` with driver `none`, but the API stores any option, and a daemon copies its `cache-*` log options into
+// every container (moby v27.4.0). The created container itself is checked against real Docker in agent-container.
+describe('keepsNoDaemonLog', () => {
+  it('accepts only driver none, with no option but cache ones', () => {
+    expect(keepsNoDaemonLog({ Type: 'none', Config: {} })).toBe(true);
+    expect(keepsNoDaemonLog({ Type: 'none', Config: null })).toBe(true);
+    expect(keepsNoDaemonLog({ Type: 'none', Config: { 'cache-disabled': 'true', 'cache-max-size': '1m' } })).toBe(true);
+    for (const config of [undefined, null, {}, { Type: 'json-file', Config: {} }, { Type: 'NONE', Config: {} },
+      { Type: 'local', Config: { 'max-size': '1m', 'max-file': '1' } }, { Type: 'none', Config: { mode: 'non-blocking' } },
+      { Type: 'none', Config: { 'max-size': '1m' } }, { Type: 'none', Config: { 'cache-disabled': 'true', mode: 'non-blocking' } },
+    ] as Parameters<typeof keepsNoDaemonLog>[0][]) expect(keepsNoDaemonLog(config)).toBe(false);
+  });
+});