coilyco-flight-deck/umbra

Watch

sandbox: leak-free placement for the .cliguard exec symlink #227

Merged

coilysiren merged 5 commits from issue-185-sandbox-leakfree into main

2026-07-14 09:29:40 +00:00

coilyco-ops commented

2026-07-14 09:06:16 +00:00

Member

This keeps the sandbox's $0-sensitive exec symlink inside a private tmpfs view of the canonical tool directory, so the helper can still exec .<tool>.cliguard without leaving a host-side artifact.

What changed: pre-resolve wrapped tools, stash real binaries first, overlay the canonical tool dir with a private tmpfs, and place the exec symlink there.
Why: the old path worked but left .<tool>.cliguard behind on the host.
Tests: go test -vet=off -p 1 ./cli/sandbox ./cli/shell; full make test hit container scratch-space limits in this environment.

closes #185
ward.workflow: pull-request-and-merge

This keeps the sandbox's `$0`-sensitive exec symlink inside a private tmpfs view of the canonical tool directory, so the helper can still exec `.<tool>.cliguard` without leaving a host-side artifact. - What changed: pre-resolve wrapped tools, stash real binaries first, overlay the canonical tool dir with a private tmpfs, and place the exec symlink there. - Why: the old path worked but left `.<tool>.cliguard` behind on the host. - Tests: `go test -vet=off -p 1 ./cli/sandbox ./cli/shell`; full `make test` hit container scratch-space limits in this environment. closes #185 ward.workflow: pull-request-and-merge

coilyco-ops added 1 commit

2026-07-14 09:06:16 +00:00

sandbox: keep exec symlink off host filesystem

ci / lint (pull_request) Failing after 36s

Details

ci / secrets (pull_request) Successful in 20s

Details

ci / test (pull_request) Successful in 1m2s

Details

d4bb2a1062

closes #185

coilyco-ops added 1 commit

2026-07-14 09:11:21 +00:00

ci: route Go scratch to runner temp

ci / test (pull_request) Failing after 0s

Details

ci / lint (pull_request) Failing after 0s

Details

ci / secrets (pull_request) Successful in 6s

Details

d13a169c9a

Use runner.temp for Go build, module, and golangci-lint caches so the CI jobs do not fill the container overlay during typecheck.

coilyco-ops added 1 commit

2026-07-14 09:12:31 +00:00

ci: export Go scratch through runner env

ci / lint (pull_request) Failing after 19s

Details

ci / secrets (pull_request) Successful in 8s

Details

ci / test (pull_request) Successful in 47s

Details

d1057cd33f

Configure Go build, module, and golangci-lint scratch through GITHUB_ENV so Forgejo and GitHub runners can use the runner temp volume without relying on unsupported job-level expressions.

coilyco-ops added 1 commit

2026-07-14 09:19:37 +00:00

ci: tame golangci-lint scratch use

ci / lint (pull_request) Failing after 50s

Details

ci / test (pull_request) Successful in 1m4s

Details

ci / secrets (pull_request) Successful in 11s

Details

f64e4cc35e

coilyco-ops added 1 commit

2026-07-14 09:24:52 +00:00

sandbox: reduce jail setup complexity

ci / test (pull_request) Successful in 1m16s

Details

ci / secrets (pull_request) Successful in 9s

Details

ci / lint (pull_request) Successful in 31s

Details

97a01ccfba

Signed-off-by: Codex <noreply@openai.com>

coilysiren merged commit b28749551c into main

2026-07-14 09:29:40 +00:00

coilysiren referenced this pull request from a commit

2026-07-14 09:29:41 +00:00

Merge pull request 'sandbox: leak-free placement for the .cliguard exec symlink' (#227) from issue-185-sandbox-leakfree into main

coilyco-ops referenced this pull request

2026-07-14 09:30:34 +00:00

sandbox: leak-free placement for the .<tool>.cliguard exec symlink #185

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/umbra!227

No description provided.

Rows
Columns