Carry D2 seccomp pinning into the egress proxy

Request and require Docker's builtin seccomp profile for the vendor egress
proxy too, and port D2's new regressions to the named isolation probes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: mchwang

agents/network/network.ts

@@ -84,8 +84,9 @@ const validateVendorNetwork = (network: VendorNetwork, invocation: InvocationInp
   if (!inspect?.State?.Running || inspect.Config?.Image !== identity.imageId || inspect.Config?.User !== '10001:10001'
     || inspect.Config?.Labels?.['io.codeboost.egress'] !== identity.allocationId || !inspect.HostConfig?.ReadonlyRootfs
     || inspect.HostConfig.Privileged || !inspect.HostConfig.CapDrop?.map(value => value.toUpperCase()).includes('ALL')
-    || (inspect.HostConfig.CapAdd?.length ?? 0) || inspect.HostConfig.SecurityOpt?.length !== 1
-    || !['no-new-privileges', 'no-new-privileges:true'].includes(inspect.HostConfig.SecurityOpt[0] ?? '')
+    || (inspect.HostConfig.CapAdd?.length ?? 0) || inspect.HostConfig.SecurityOpt?.length !== 2
+    || !inspect.HostConfig.SecurityOpt.some(option => ['no-new-privileges', 'no-new-privileges:true'].includes(option))
+    || !inspect.HostConfig.SecurityOpt.includes('seccomp=builtin')
     || inspect.HostConfig.PidsLimit !== 64 || inspect.HostConfig.Memory !== 64 * 1024 * 1024
     || inspect.HostConfig.MemorySwap !== 64 * 1024 * 1024 || inspect.HostConfig.NanoCpus !== 250_000_000
     || inspect.HostConfig.NetworkMode !== network.name || inspect.HostConfig.PidMode !== ''
@@ -130,7 +131,7 @@ export function createVendorNetwork(invocation: InvocationInput, imageId: string
       '--label', `io.codeboost.egress=${allocationId}`, name], remaining());
     proxyPlanned = true;
     docker(['run', '--detach', '--name', proxyContainer, '--read-only', '--user', '10001:10001',
-      '--cap-drop=ALL', '--security-opt=no-new-privileges', '--pids-limit=64', '--memory=64m', '--memory-swap=64m',
+      '--cap-drop=ALL', '--security-opt=no-new-privileges', '--security-opt=seccomp=builtin', '--pids-limit=64', '--memory=64m', '--memory-swap=64m',
       '--cpus=.25', '--network', name, '--network-alias', 'codeboost-proxy',
       '--label', `io.codeboost.egress=${allocationId}`, '--env', `CODEBOOST_ALLOWED_HOSTS=${VENDOR_HOSTS[vendor].join(',')}`,
       '--entrypoint', 'node', imageId, '/usr/local/lib/codeboost-egress-proxy.mjs'], remaining());

test/agent-container.test.ts

@@ -278,7 +278,7 @@ describe('real Docker agent isolation', () => {
   }, 60_000);
 
   it('retains credentials when a killed create cannot be proven absent', () => {
-    const data = fixture(), unsettled = profile(data, 'planning', ['true']);
+    const data = fixture(), unsettled = profile(data, 'planning', 'noop');
     const shim = join(data.root, 'docker-shim'); mkdirSync(shim);
     const realDocker = execFileSync('sh', ['-c', 'command -v docker'], { encoding: 'utf8' }).trim();
     // The create client hangs until its deadline kills it, so the daemon outcome stays unknown.
@@ -303,7 +303,7 @@ describe('real Docker agent isolation', () => {
   }, 60_000);
 
   it('rejects a container that relies on the daemon default seccomp profile', () => {
-    const data = fixture(), valid = profile(data, 'planning', ['true']);
+    const data = fixture(), valid = profile(data, 'planning', 'noop');
     docker(...valid.args.filter(arg => arg !== '--security-opt=seccomp=builtin')); containers.add(valid.name);
     expect(() => validateContainer(valid.name, valid)).toThrow('lockdown');
     docker('rm', '--force', valid.name); containers.delete(valid.name);
@@ -320,11 +320,11 @@ describe('real Docker agent isolation', () => {
   it('refuses a Codex auth path that is a link without resolving it', () => {
     const data = fixture(), link = join(data.root, 'auth-link.json');
     symlinkSync(data.fakeAuth, link);
-    expect(() => profile(data, 'planning', ['true'], { codexAuthFile: link })).toThrow('not a link');
+    expect(() => profile(data, 'planning', 'noop', { codexAuthFile: link })).toThrow('not a link');
   }, 60_000);
 
   it('rejects a restart policy that could relaunch the agent after it exits', () => {
-    const data = fixture(), valid = profile(data, 'planning', ['true']);
+    const data = fixture(), valid = profile(data, 'planning', 'noop');
     const imageIndex = valid.args.indexOf(imageId);
     docker(...valid.args.slice(0, imageIndex), '--restart=always', ...valid.args.slice(imageIndex));
     containers.add(valid.name);