fix(image): let bwrap actually create its sandbox, and prove it as the job user - #321
Merged
Merged
Conversation
…e job user The b19 conformance measurement came back "cannot run this local phase without network isolation" on a worker that carried /usr/bin/bwrap. The binary was never the capability: Ubuntu 24.04 ships kernel.apparmor_restrict_unprivileged_userns=1, so an unprivileged bwrap dies at "setting up uid map: Permission denied" -- inside every worker, docker-capable or not, because security.nesting does not lift a kernel-wide userns restriction. The image now carries Ubuntu's own answer for exactly this case: an AppArmor profile granting `userns,` to /usr/bin/bwrap alone. The restriction stays in force for everything else on the worker, untrusted pools are not widened, and the host sysctl is untouched. Provisioning loads the profile and runs the consumer's own probe as the runner; both smokes repeat it at boot, so a binary-present-capability-absent image can never pass again. Aliases move to b20/b13 (and the dormant VM manifests follow), because a recipe that produces different bytes must not build under a promoted name. Claude-Session: https://claude.ai/code/session_01LsGid6U5RrQdFvJmvYdGCF
rldyourmnd
force-pushed
the
fix/bwrap-can-actually-sandbox
branch
from
August 31, 2026 22:04
e264fa2 to
f317c81
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ai-stp conformance on b19 read unmeasured=7: bwrap was present and dead —
kernel.apparmor_restrict_unprivileged_userns=1denies the uid map to every unprivileged caller, nesting does not help, and only dockerd survives by being container-root. The fix is Ubuntu's own mechanism: an AppArmor profile grantinguserns,to /usr/bin/bwrap alone (verified live on a worker: probe exit 0). Provision runs the consumer's own probe as the runner, both smokes repeat it at boot. Aliases: b20/b13.https://claude.ai/code/session_01LsGid6U5RrQdFvJmvYdGCF