mirror of
https://github.com/nearai/ironclaw.git
synced 2026-09-03 08:06:01 +08:00
f88ef87cef
* feat(sandbox): mediate GitHub CLI credentials * refactor(sandbox): genericize staged process credentials * refactor(sandbox): replace GitHub credential carve-out with manifest-declared bindings (#7825) * fix(sandbox): address PR #7810 review findings - share one quote-aware single_direct_argv predicate between kernel authorization enrichment and shell dispatch (host_api::process); reject path-form executables; single-quote backslashes stay literal; defined double-quote escape set - constrain credential authority to active-extension declarations with deterministic collision rejection (no registry-wide first-wins) - GitHub binding uses the CLI's real 'token ' authorization scheme - delegate supports_credentialed_direct_command to the wrapped transport (Railway no longer advertises unsupported direct-exec) - cancellation/panic-safe credential cleanup guard; teardown deletes material even when proxy reload fails; reject empty placeholders and header names before rendering replace rules - keep secret material zeroized through bundle composition and atomic writes; ironclaw-exec emits outcome markers on spawn failure (126/127) - cause-preserving staging errors; case-normalized credential comparison fields; fail-closed binding-validation and enrichment-authority tests - re-capture host_api size ceiling (20_579 -> 20_728) for the shared parser move * fix(ci): align GitHub auth scheme expectations * fix(sandbox): preserve authorized credential descriptors * fix(sandbox): keep Docker bind mounts stable * fix(sandbox): authorize generic shell credential contexts * fix(host-runtime): guide authenticated shell contexts * fix(sandbox): stabilize authenticated shell reuse * fix(ci): repair credential surface contracts * fix(host-runtime): scope credential contexts to sandbox profiles * test(credentials): assert declared GitHub auth prefix * test(host-api): consolidate authorized witness seam * test(composition): include empty shell credential contexts * fix(review): tighten sandbox credential authority * fix: stabilize IronHub runtime assembly test * fix: grant shell manifest credentials * test: cover shell credential grants through factory * test: align GitHub credential header assertion
31 lines
886 B
Docker
31 lines
886 B
Docker
# Phase 2 worker for the persistent local-Docker user sandbox.
|
|
# Keep the base digest aligned with RailwayPreviewSandboxConfig's default.
|
|
FROM python:3.12-slim@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
curl \
|
|
git \
|
|
gh \
|
|
jq \
|
|
nodejs \
|
|
npm \
|
|
tini \
|
|
util-linux \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN groupadd --gid 1000 sandbox \
|
|
&& useradd --uid 1000 --gid sandbox --create-home --shell /bin/sh sandbox
|
|
|
|
COPY --chmod=0755 docker/sandbox/ironclaw-exec \
|
|
docker/sandbox/ironclaw-sandbox-idle \
|
|
/usr/local/bin/
|
|
ENV HOME=/home/sandbox \
|
|
GH_CONFIG_DIR=/workspace/.config/gh
|
|
WORKDIR /workspace
|
|
USER 1000:1000
|
|
|
|
ENTRYPOINT ["tini", "--"]
|
|
CMD ["/usr/local/bin/ironclaw-sandbox-idle"]
|