172a38c344
cap-drop ALL removes DAC_OVERRIDE, which root needs to write to bind-mounted directories owned by the host user (uid 1000). This broke persistent Docker sandboxes — the container couldn't write to /workspace or /root. Add back the minimum capabilities needed: - DAC_OVERRIDE: root can write to bind-mounted dirs owned by host user - CHOWN: package managers (pip, npm, apt) need to set file ownership - FOWNER: needed for operations on files owned by other users Still drops all other capabilities (NET_RAW, SYS_ADMIN, etc.) and keeps no-new-privileges. Security boundary is the container itself. Verified end-to-end: create files → destroy container → new container with same task_id → files persist on host and are accessible in the new container. |
||
|---|---|---|
| .. | ||
| environments | ||
| __init__.py | ||
| approval.py | ||
| browser_tool.py | ||
| clarify_tool.py | ||
| code_execution_tool.py | ||
| cronjob_tools.py | ||
| debug_helpers.py | ||
| delegate_tool.py | ||
| file_operations.py | ||
| file_tools.py | ||
| fuzzy_match.py | ||
| homeassistant_tool.py | ||
| honcho_tools.py | ||
| image_generation_tool.py | ||
| interrupt.py | ||
| mcp_tool.py | ||
| memory_tool.py | ||
| mixture_of_agents_tool.py | ||
| openrouter_client.py | ||
| patch_parser.py | ||
| process_registry.py | ||
| registry.py | ||
| rl_training_tool.py | ||
| send_message_tool.py | ||
| session_search_tool.py | ||
| skill_manager_tool.py | ||
| skills_guard.py | ||
| skills_hub.py | ||
| skills_sync.py | ||
| skills_tool.py | ||
| terminal_tool.py | ||
| todo_tool.py | ||
| transcription_tools.py | ||
| tts_tool.py | ||
| vision_tools.py | ||
| web_tools.py | ||