opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: default container sandbox to drop all capabilities and fix error assignment in container data write.

Browse source
This commit is contained in:
0x5487 2026-03-01 21:49:33 +08:00
parent 851dfa267a
commit befad966bb
2 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
pkg/agent/sandbox/container.go
View file

@ -653,7 +653,7 @@ func (f *containerFS) WriteFile(ctx context.Context, p string, data []byte, mkdi
defer attach.Close() defer attach.Close()
// Write data to the hijacked connection's stdin // Write data to the hijacked connection's stdin
if _, err := attach.Conn.Write(data); err != nil { if _, err = attach.Conn.Write(data); err != nil {
return fmt.Errorf("failed to write data to container: %w", err) return fmt.Errorf("failed to write data to container: %w", err)
} }

1
pkg/config/defaults.go
View file

@ -43,6 +43,7 @@ func DefaultConfig() *Config {
ApparmorProfile: "", ApparmorProfile: "",
DNS: []string{}, DNS: []string{},
ExtraHosts: []string{}, ExtraHosts: []string{},
CapDrop: []string{"ALL"},
Binds: []string{}, Binds: []string{},
}, },
Prune: AgentSandboxPruneConfig{ Prune: AgentSandboxPruneConfig{