refactor: replace podman-seccomp.json with minimal cap_add, harden bwrap, add sandbox tests

2026-04-05 19:03:06 +00:00
parent a8707ca8f6
commit cef0f3f988
4 changed files with 111 additions and 1131 deletions
@@ -4,9 +4,13 @@ x-common-config: &common-config
    dockerfile: Dockerfile
  volumes:
    - ~/.nanobot:/home/nanobot/.nanobot
+  cap_drop:
+    - ALL
+  cap_add:
+    - SYS_ADMIN
  security_opt:
    - apparmor=unconfined
-    - seccomp=./podman-seccomp.json
+    - seccomp=unconfined

 services:
  nanobot-gateway: