Configuration tables

Every field of vessel.toml, declared tool files and deployment.toml, with its type, default and constraints. These tables are generated from AstralVessel's pydantic models when the site is built. Unknown keys are refused in every table. For what each setting does, see vessel.toml and deployment.toml.

vessel.toml

Manifest

The top level of vessel.toml.

Field	Type	Default	Constraints
agent	AgentSection	required
model	ModelSection	required
tools	ToolsSection	table below
sandbox	SandboxSection	table below
output	OutputSection	table below

AgentSection

[agent]

Field	Type	Default	Constraints
name	str	required	matches ^[a-z][a-z0-9-]{0,62}$
description	str	required
version	str	"0.1.0"
examples	list[str]	[]

ModelSection

[model]

Field	Type	Default	Constraints
endpoint	str	"env:VESSEL_MODEL_URL"
model	str	required
api_key	str	"env:VESSEL_MODEL_KEY"
temperature	float	0.2
max_steps	int	40	>= 1, <= 200
max_output_tokens	int	8192	>= 256
send_reasoning	bool	false
images	bool	false

ToolsSection

[tools]

Field	Type	Default	Constraints
builtin	list[str]	[]
declared	list[str]	[]

Also checked when the file loads:

• Every builtin entry must be one of read, grep, glob, list, bash, webfetch, websearch.

SandboxSection

[sandbox]

Field	Type	Default	Constraints
workdir	str	"/workspace"
mounts	list[Mount]	[]
deadline_seconds	int	600	>= 5, <= 3600
tool_timeout_seconds	int	60	>= 1, <= 600
tool_output_chars	int	20000	>= 1000, <= 200000
dockerfile	str | None	none

Also checked when the file loads:

• dockerfile must be inside the agent folder.

Mount

An entry of [sandbox] mounts.

Field	Type	Default	Constraints
source	str	required
target	str	required
read_only	bool	true

OutputSection

[output]

Field	Type	Default	Constraints
primitives	bool	false
files	list["png" | "svg" | "csv" | "pdf"]	[]

Declared tool files

DeclaredTool

Field	Type	Default	Constraints
name	str	required	matches ^[a-z][a-z0-9_]{0,62}$
description	str	required
command	list[str] | None	none
service	str | None	none	matches ^[a-z][a-z0-9-]{0,62}$
path	str | None	none	matches ^/[A-Za-z0-9._~/-]{0,200}$
parameters	dict[str, Any]	{"type": "object", "properties": {}}
timeout_seconds	int | None	none
input	"json-stdin" | "args"	"json-stdin"
scope	"tools:read" | "tools:search" | "tools:files" | "tools:write" | "tools:system" | "tools:execute"	"tools:read"

Also checked when the file loads:

• Exactly one of command or service.
• A service tool needs path, with no .. segment.
• The name may not repeat another declared tool or a built-in tool.

deployment.toml

DeploymentFile

The top level of deployment.toml.

Field	Type	Default	Constraints
vessel	VesselSection	table below
egress	EgressSection	required
search	SearchSection	table below
agents	list[AgentEntry]	required
apps	list[AppEntry]	[]
issuers	list[IssuerEntry]	[]

Also checked when the file loads:

• At least one agent; agent ids are unique.
• At least one [[apps]] or [[issuers]].
• App names are unique; issuer ids and issuer URLs are each unique.
• Every agent an app or issuer names must exist.

VesselSection

[vessel]

Field	Type	Default	Constraints
project	str	"astralvessel"	matches ^[a-z0-9][a-z0-9_-]{0,62}$
public_url	str	"http://vessel:8700"
front_subnet	str	"172.31.247.0/24"
front_address	str	"172.31.247.10"
task_ttl_hours	float	24	> 0

Also checked when the file loads:

• front_address must be inside front_subnet, and front_subnet must be a network address (172.31.247.0/24, not 172.31.247.1/24).
• front_subnet must be a /28 or larger, and front_address must be in its lower half; other containers on front get addresses from the upper half.

EgressSection

[egress]

Field	Type	Default	Constraints
upstream_url	str	required
upstream_key	str	"env:VESSEL_UPSTREAM_MODEL_KEY"

Also checked when the file loads:

• upstream_url must be an http:// or https:// URL with a host and no spaces, or env:NAME with a valid variable name.

SearchSection

[search]

Field	Type	Default	Constraints
provider	"searxng" | "duckduckgo"	"searxng"

AgentEntry

[[agents]]

Field	Type	Default	Constraints
id	str	required	matches ^[a-z][a-z0-9-]{0,62}$
package	str	required
sandbox	SandboxProfile	table below
services	dict[str, ServiceGrant]	{}
prompt_append	list[str]	[]
model	str | None	none	min length 1

Also checked when the file loads:

• The services keys must match the services the agent's tools name, no more and no fewer.
• Each prompt_append file must exist inside the agent folder.

SandboxProfile

[agents.sandbox]

Field	Type	Default	Constraints
mounts	list[MountGrant]	[]
memory	str	"2g"
cpus	float	2	> 0
pids	int	512	>= 32
scratch	str	"256m"
turn_disk	str | None	none
user_disk	str | None	none

Also checked when the file loads:

• Each mount must be read-only, and the targets must match the agent's [sandbox] mounts exactly.
• turn_disk defaults to a quarter of scratch and user_disk to half; sizes look like 64m or 2g, and 0 < turn_disk <= user_disk <= scratch.

MountGrant

An entry of [agents.sandbox] mounts.

Field	Type	Default	Constraints
target	str	required
source	str	required
read_only	bool	true

ServiceGrant

[agents.services.<name>]

Field	Type	Default	Constraints
url	str	required
headers	dict[str, str]	{}

Also checked when the file loads:

• Header names may not start with X-Vessel-.
• A literal url must start with http:// or https:// and carry no ? or #.

AppEntry

[[apps]]

Field	Type	Default	Constraints
name	str	required	matches ^[a-z][a-z0-9-]{0,62}$
key_sha256	str	required
agents	list[str]	required

IssuerEntry

[[issuers]]

Field	Type	Default	Constraints
id	str	required	matches ^[a-z][a-z0-9-]{0,62}$
issuer	str	required
audience	str	required
jwks_url	str | None	none
jwks_file	str | None	none
authorized_parties	list[str]	[]
algorithms	list[str]	["RS256", "ES256", "EdDSA"]
agents	list[str]	required

Also checked when the file loads:

• Exactly one of jwks_url or jwks_file.
• jwks_url must start with https://.
• algorithms must be non-empty and drawn from RS256, RS384, RS512, PS256, ES256, ES384, EdDSA.