From 3d0563a12cc7be0265c80a9cfa09c2bddf1c8183 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Fri, 23 Oct 2026 22:29:01 +1100
Subject: [PATCH] Add sandbox image with nested podman

---
 Containerfile   | 37 +++++++++++++++++++++++++++++++++++++
 containers.conf | 17 +++++++++++++++++
 2 files changed, 54 insertions(+)
 create mode 100644 Containerfile
 create mode 100644 containers.conf

diff --git a/Containerfile b/Containerfile
new file mode 100644
index 0000000..4b598c1
--- /dev/null
+++ b/Containerfile
@@ -0,0 +1,37 @@
+FROM artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+# Internal CA over plain HTTP, pinned by the repodata pkgid; HTTPS after this.
+ARG CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f44/Packages/unkin-ca-certificates-2026.10.2-1.fc44.x86_64.rpm"
+ARG CA_RPM_SHA256="19929d13dd7a0542af3bf1dce736568b87159914b0261d7a9965edfd58dfc9cd"
+# hadolint ignore=DL3041
+RUN curl -fsSLo /tmp/ca.rpm "$CA_RPM_URL" \
+    && echo "$CA_RPM_SHA256  /tmp/ca.rpm" | sha256sum -c - \
+    && dnf install -y /tmp/ca.rpm \
+    && rm /tmp/ca.rpm \
+    && dnf clean all
+
+# hadolint ignore=DL3041
+RUN printf '%s\n' '[claude-code]' 'name=claude-code' \
+        'baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/claude-code/' \
+        'gpgcheck=0' >/etc/yum.repos.d/claude-code.repo \
+    && dnf install -y --setopt=install_weak_deps=False \
+        bind-utils claude-code curl fuse-overlayfs git-core iproute jq less \
+        openssh-clients passt podman procps-ng \
+    && dnf clean all
+
+# No setuid binaries; nested rootless podman needs only newuidmap's file caps
+# (lost in image layers) and subordinate ids inside keep-id's namespace.
+RUN find / -xdev -type f -perm /6000 -exec chmod ug-s {} + \
+    && rpm --setcaps shadow-utils \
+    && useradd -u 1000 -m claude \
+    && echo 'claude:1:999' >/etc/subuid \
+    && echo 'claude:1001:64535' >>/etc/subuid \
+    && cp /etc/subuid /etc/subgid
+
+COPY containers.conf /etc/containers/containers.conf
+
+USER 1000
+WORKDIR /home/claude
+CMD ["claude"]
diff --git a/containers.conf b/containers.conf
new file mode 100644
index 0000000..89baaa6
--- /dev/null
+++ b/containers.conf
@@ -0,0 +1,17 @@
+# Nested podman inside the sandbox. Nested containers share the sandbox's
+# netns by default so they see its DNS and loopback forwarders; either way they
+# have no route out.
+[containers]
+netns = "host"
+# The sandbox's /proc is masked and /proc/sys read-only, and it may not set
+# hostnames or cgroups, so nested containers share those with it.
+default_sysctls = []
+volumes = ["/proc:/proc"]
+utsns = "host"
+ipcns = "host"
+cgroupns = "host"
+cgroups = "disabled"
+
+[engine]
+cgroup_manager = "cgroupfs"
+events_logger = "file"