Skip to content

image: bubblewrap, socat and ripgrep, what agents sandbox their commands with #235

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aledbf merged 1 commit into from
Nov 12, 2026
Merged

image: bubblewrap, socat and ripgrep, what agents sandbox their commands with #235

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion image/build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -218,7 +218,7 @@ in_image() { stat_in_image "$1" | grep -q '^Inode:'; }

# /sbin/init is what this image is: a userland whose first process is systemd, and what a
# boot with `init=/sbin/init` lands on. /bin/sh is what `spin-machine boot --init /bin/sh` runs.
for f in /sbin/init /bin/sh /bin/bash /usr/bin/docker /usr/local/bin/task; do
for f in /sbin/init /bin/sh /bin/bash /usr/bin/docker /usr/local/bin/task /usr/bin/bwrap /usr/bin/socat /usr/bin/rg; do
in_image "$f" || { echo "ERROR: the image has no $f" >&2; exit 1; }
done

Expand Down
10 changes: 10 additions & 0 deletions image/mkosi.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,16 @@ Packages=
less
strace
btop
# What the coding agents a workspace runs sandbox their commands with: Codex's Linux
# sandbox and Claude Code's (sandbox-runtime) are both bwrap plus seccomp, and neither
# uses Landlock (#221, checked in their source 2026-11-12). Codex carries a bwrap of its
# own; sandbox-runtime refuses to start without bwrap and socat on PATH, socat being its
# network proxy out of the sandbox. ripgrep is how it finds the .git/hooks and editor
# configs below the working directory to mount read-only: without rg the scan fails, it
# logs at debug level, and the command runs without those denies.
bubblewrap
socat
ripgrep
# file, because scripts branch on what it says and a `command not found` in that
# position reads as the archive being wrong rather than the tool being absent.
file
Expand Down
Loading