Add agent-sandbox launcher, images and CI #1
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: unkin/agent-sandbox#1
Reference in New Issue
Block a user
Delete Branch "benvin/scaffold"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Claude Code needs a sandbox that only sees the launch directory and can only reach allowlisted hosts, enforced by network topology rather than proxy env vars.
agent-sandboxlauncher: per-session internal network, pod and router; mounts only$PWD$HOME, its parents or the allowlist dir; abort on any invalid allowlist line.example.org+example.orgorexample.org:22) writesexample.orgtwice into both nginxhostnamesmaps; nginx fails withconflicting parameter "example.org"and the session never starts → leave exact hosts that a.domainentry already covers out of$map(dnsmasq still needs their host-record), and add that case to tests/test.shlabel=disable→ mount the private tmp dir with:ro,Zand keep SELinux confinementdieruns inside$(router_config …)/$(allowlist_entries …)where errexit is off, so the error prints and the session starts with only the entries sorted before the bad line (verified:api.anthropic.com,bad host,zzz.example.com→ rc=0, only api.anthropic.com configured) → validate first in the parent shell (e.g.allowlist_entries "$ALLOWLIST" >/dev/null || exit 1before line 173, orshopt -s inherit_errexit), and add a test thatrouter_configfails on a bad mid-file entry$HOME(or any parent of$CONFIG_DIR/$ALLOWLIST) mounts the allowlist read-write, so claude can widen the next session's egress → refuse to start whenreadlink -f "$ALLOWLIST"is under$PWDdirname "$ALLOWLIST"checks the symlink's dir, not the file's real location; withallowed-hostssymlinked into e.g.~/dotfiles, launching from~/dotfilespasses the check and claude gets the allowlist read-write → also checkdirname "$(realpath -m "$ALLOWLIST")"and add a launch test for a symlinked allowlist file$XDG_RUNTIME_DIR(e.g./run/user/$UID,/run) are accepted, mounting the user D-Bus socket (systemd-run --user= host exec;gdbusis in the image) and the host podman socket when active; contradicts README.md:22 → refuse them the same way as$HOME(resolve,inside "$runtime" "$pwd"), add a test.