Omar SobhandClaude Fable 5
ea5162ac65
tc-sandbox: - SandboxSpec/SandboxDriver + DockerDriver (bollard): uid 10001, cap-drop ALL, no-new-privileges, embedded seccomp deny profile (unshare/ptrace/ bpf/keyctl/mount/...), read-only rootfs with tmpfs /tmp + /home/agent, network=none, mem/cpu/pids limits - agent-base image: non-root, all setuid binaries stripped - 6 kernel-level assertion tests probing from INSIDE real containers: uid + CapEff==0, rootfs read-only, seccomp EPERM on unshare, zero traffic-carrying interfaces + failed egress connect, no setuid + NoNewPrivs=1, lifecycle tc-secrets: - ChaCha20-Poly1305 envelope encryption under a FileKey (generated 0600, AEAD tamper detection tested); secrets table ciphertext-at-rest - teamclaw-broker daemon: length-prefixed JSON over a unix socket; no protocol operation ever returns plaintext; InvokeHttp independently consumes the single-use execution grant against Postgres BEFORE touching any credential, then performs the call itself with the secret injected - Tests over the real socket + real Postgres + a real local HTTP receiver: encrypted at rest, pending approval refused, approved call carries the bearer token exactly once, grant replay refused, non-http URLs rejected 116 Rust + 61 frontend tests + 14 E2E journeys green. Co-Authored-By: Claude Fable 5 <[email protected]>
16 lines
608 B
Docker
16 lines
608 B
Docker
# The agent sandbox base image (spec §15): the "Computer" an agent's
|
|
# environment tools run inside. Non-root by construction, no setuid
|
|
# binaries, designed to run with cap-drop ALL, a seccomp deny profile,
|
|
# read-only rootfs, and no network.
|
|
FROM debian:bookworm-slim
|
|
|
|
RUN useradd --uid 10001 --user-group --create-home --shell /usr/sbin/nologin agent \
|
|
# No privilege-escalation paths: strip every setuid/setgid binary.
|
|
&& find / -xdev -perm /6000 -type f -delete
|
|
|
|
USER 10001:10001
|
|
WORKDIR /home/agent
|
|
|
|
# Idle keep-alive; the orchestrator execs work into the container.
|
|
CMD ["sleep", "infinity"]
|