feat: sandbox exec calls with bwrap and run container as non-root

2026-03-16 23:55:19 -07:00
parent 49fc50b1e6
commit 7913e7150a
8 changed files with 1204 additions and 7 deletions
@@ -3,7 +3,10 @@ x-common-config: &common-config
    context: .
    dockerfile: Dockerfile
  volumes:
-    - ~/.nanobot:/root/.nanobot
+    - ~/.nanobot:/home/nanobot/.nanobot
+  security_opt:
+    - apparmor=unconfined
+    - seccomp=./podman-seccomp.json

 services:
  nanobot-gateway: