unkin-agent
f60caa7e98
Refuse launch dirs holding $PATH entries and mount the checked path
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
2026-10-24 17:43:06 +11:00
unkin-agent
bbc439fb09
Merge remote-tracking branch 'origin/benvin/go-launcher' into benvin/launch-dir-allowlist
2026-10-24 17:38:48 +11:00
unkin-agent
2e3dafb28a
Drop shell completions from the RPM
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
2026-10-24 17:38:05 +11:00
unkin-agent
a2a4eb31ca
Merge remote-tracking branch 'origin/benvin/go-launcher' into benvin/launch-dir-allowlist
...
# Conflicts:
# main_test.go
2026-10-24 17:37:57 +11:00
unkin-agent
ea4ed4af9d
Pass all arguments through to claude or --exec
ci/woodpecker/pr/pre-commit Pipeline was canceled
ci/woodpecker/pr/lint Pipeline was canceled
ci/woodpecker/pr/test Pipeline was canceled
ci/woodpecker/pr/build Pipeline was canceled
2026-10-24 17:37:16 +11:00
unkin-agent
3f1cc9644d
Merge benvin/go-launcher
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
2026-10-24 17:33:03 +11:00
unkin-agent
818ec3f59c
Refuse launch dirs containing the API socket and stop the service with the launcher
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
2026-10-24 17:29:08 +11:00
unkin-agent
90c7412194
Trust listed roots under dot-dirs, reject sensitive ones
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
2026-10-24 17:11:33 +11:00
unkin-agent
3ec134147a
Allow launches only under configured roots
...
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
Replace the launch-dir denylist with an allowlist of roots from
allowed-paths (default $HOME), always refusing $HOME dot-dirs and
invalid roots under /run, /tmp, /var/tmp, /proc, /sys or /dev.
2026-10-24 17:05:33 +11:00
unkin-agent
af55d83de6
Port the launcher to Go on the podman API bindings
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
2026-10-24 16:49:43 +11:00
benvin
1e250f1113
Merge pull request 'Add agent-sandbox launcher, images and CI' ( #1 ) from benvin/scaffold into main
...
Reviewed-on: #1
2026-10-24 16:19:57 +11:00
unkin-agent
07d93b0fe1
Refuse launch dirs containing the allowlist's resolved location
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
2026-10-23 22:51:11 +11:00
unkin-agent
71c1999e27
Abort on invalid allowlist lines; refuse launch dirs exposing $HOME or the allowlist
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
2026-10-23 22:46:24 +11:00
unkin-agent
edbe3faeb0
Skip exact hosts covered by a .domain in nginx maps; confine router with SELinux
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
2026-10-23 22:37:51 +11:00
unkin-agent
4ee52cb615
Add README
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
2026-10-23 22:29:21 +11:00
unkin-agent
7a6cb93fdb
Add pre-commit and Woodpecker pipelines
2026-10-23 22:29:18 +11:00
unkin-agent
0144546973
Add Makefile and RPM packaging
2026-10-23 22:29:18 +11:00
unkin-agent
c3b7a32bd1
Add launcher and default allowlist
2026-10-23 22:29:18 +11:00
unkin-agent
3d0563a12c
Add sandbox image with nested podman
2026-10-23 22:29:18 +11:00
unkin-agent
4122e3592b
Add router image for allowlisted egress
2026-10-23 22:29:18 +11:00
gitadmin
20c9c9ff26
Initial commit
2026-10-23 22:19:17 +11:00
unkin-agent
benvin
gitadmin