unkin-agent
3ec134147a
Allow launches only under configured roots
...
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
Replace the launch-dir denylist with an allowlist of roots from
allowed-paths (default $HOME), always refusing $HOME dot-dirs and
invalid roots under /run, /tmp, /var/tmp, /proc, /sys or /dev.
2026-10-24 17:05:33 +11:00
unkin-agent
af55d83de6
Port the launcher to Go on the podman API bindings
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
2026-10-24 16:49:43 +11:00
benvin
1e250f1113
Merge pull request 'Add agent-sandbox launcher, images and CI' ( #1 ) from benvin/scaffold into main
...
Reviewed-on: #1
2026-10-24 16:19:57 +11:00
unkin-agent
07d93b0fe1
Refuse launch dirs containing the allowlist's resolved location
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
2026-10-23 22:51:11 +11:00
unkin-agent
71c1999e27
Abort on invalid allowlist lines; refuse launch dirs exposing $HOME or the allowlist
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
2026-10-23 22:46:24 +11:00
unkin-agent
edbe3faeb0
Skip exact hosts covered by a .domain in nginx maps; confine router with SELinux
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
2026-10-23 22:37:51 +11:00
unkin-agent
4ee52cb615
Add README
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
2026-10-23 22:29:21 +11:00
unkin-agent
7a6cb93fdb
Add pre-commit and Woodpecker pipelines
2026-10-23 22:29:18 +11:00
unkin-agent
0144546973
Add Makefile and RPM packaging
2026-10-23 22:29:18 +11:00
unkin-agent
c3b7a32bd1
Add launcher and default allowlist
2026-10-23 22:29:18 +11:00
unkin-agent
3d0563a12c
Add sandbox image with nested podman
2026-10-23 22:29:18 +11:00
unkin-agent
4122e3592b
Add router image for allowlisted egress
2026-10-23 22:29:18 +11:00
gitadmin
20c9c9ff26
Initial commit
2026-10-23 22:19:17 +11:00
unkin-agent
benvin
gitadmin