Repository navigation
image: bubblewrap, socat and ripgrep, what agents sandbox their commands with - #235
Merged
Merged
Conversation
…nds with Codex's Linux sandbox and Claude Code's (sandbox-runtime) are both bwrap plus seccomp; neither uses Landlock (#221). sandbox-runtime refuses to start without bwrap and socat on PATH, and without rg it silently skips the scan that mounts nested .git/hooks and editor configs read-only. build.sh asserts all three in the finished image. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
aledbf
force-pushed
the
image/bubblewrap
branch
from
November 12, 2026 04:38
7a77871 to
3d80ac2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The coding agents a workspace runs sandbox their commands with bubblewrap. Following up on #221 (closed): neither Codex nor Claude Code uses Landlock. Both use bwrap + seccomp, and the guest kernel already gives them what they need: unprivileged user namespaces and seccomp filter.
What changes
image/mkosi.confadds three packages, andimage/build.shasserts each binary in the finished image:bubblewrap: Codex and sandbox-runtime both use it. Codex ships its own copy, but sandbox-runtime refuses to start if there is none on PATH.socat: sandbox-runtime's proxy for getting the network out of the sandbox. It also refuses to start without it (checkLinuxDependencies).ripgrep: sandbox-runtime runsrg --filesto find.git/hooks,.git/configand editor configs in subdirectories, then mounts them read-only (linux-sandbox-utils.ts:582). Withoutrgthe scan fails, it logs at debug level, and the command runs without those denies. The sandbox ends up weaker and nothing says so.I checked the source on 2026-11-12: openai/codex @ 6bfdc75 and anthropic-experimental/sandbox-runtime @ 41501a6 (0.0.82).
Checked
task image:build: OK, andbuild.shfinds/usr/bin/bwrap,/usr/bin/socatand/usr/bin/rg. The image goes from 857M to 863M.spin-machine boot --init /bin/shand ran asnobody(uid 65534):bwrap --unshare-user --unshare-net --unshare-pid --ro-bind / / --proc /proc --dev /dev --tmpfs /tmp→BWRAP_OK uid=65534.rg --files→RG_OK, andsocat→SOCAT_OK.A new image is a new base for the next boot. The fingerprint does not hash the base image, so it does not move.
🤖 Generated with Claude Code