refactor: replace podman-seccomp.json with minimal cap_add, harden bwrap, add sandbox tests

2026-04-05 19:03:06 +00:00
parent a8707ca8f6
commit cef0f3f988
4 changed files with 111 additions and 1131 deletions
@@ -25,7 +25,7 @@ def _bwrap(command: str, workspace: str, cwd: str) -> str:
    optional  = ["/bin", "/lib", "/lib64", "/etc/alternatives",
                 "/etc/ssl/certs", "/etc/resolv.conf", "/etc/ld.so.cache"]

-    args = ["bwrap"]
+    args = ["bwrap", "--new-session", "--die-with-parent"]
    for p in required: args += ["--ro-bind",     p, p]
    for p in optional: args += ["--ro-bind-try", p, p]
    args += [