Enforce builtin seccomp and pin clone directory identity

- Request Docker's builtin seccomp profile for the agent, keeper and seeder
  containers, since the daemon default can be unconfined (Docker Desktop
  reports profile=unconfined). Validation requires exactly
  no-new-privileges plus seccomp=builtin, and the startup probe refuses to
  exec unless /proc/self/status reports an active filter.
- Record the clone directory and .git identities at creation and re-verify
  them before and after seeding, so a replaced staging path is refused.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: mchwang

agents/container/probe.sh

@@ -22,6 +22,7 @@ for field in CapInh CapPrm CapEff CapBnd CapAmb; do
     || fail 'all capability sets must be empty'
 done
 [ "$(awk '/^NoNewPrivs:/ { print $2 }' /proc/self/status)" = '1' ] || fail 'no-new-privileges must be enabled'
+[ "$(awk '/^Seccomp:/ { print $2 }' /proc/self/status)" = '2' ] || fail 'a seccomp syscall filter must be enforced'
 require_option / ro
 
 [ "${HOME:-}" = '/home/codeboost' ] || fail 'HOME must be the isolated home directory'

agents/container/profile.ts

@@ -178,7 +178,7 @@ export function createContainerProfile(options: ProfileOptions): ContainerProfil
     const name = `codeboost-agent-${safeName(invocation.attemptId)}`, ownershipId = randomUUID();
     const readOnlyWork = ['planning', 'questions', 'review'].includes(invocation.phase);
     const args = ['create', '--name', name, '--read-only', '--user', '10001:10001', '--cap-drop=ALL',
-      '--security-opt=no-new-privileges', '--pids-limit=128', '--memory=512m', '--memory-swap=512m',
+      '--security-opt=no-new-privileges', '--security-opt=seccomp=builtin', '--pids-limit=128', '--memory=512m', '--memory-swap=512m',
       '--cpus=1', '--shm-size=16m', '--ipc=private', '--cgroupns=private',
       '--network=none', '--env', 'HOME=/home/codeboost', '--env', `CODEBOOST_PHASE=${invocation.phase}`,
       '--label', `io.codeboost.invocation=${ownershipId}`,

agents/container/run.ts

@@ -31,8 +31,10 @@ const createDeadline = (timeoutMs: number) => {
     return value;
   };
 };
-const exactNoNewPrivileges = (options: string[] | null | undefined) => options?.length === 1
-  && (options[0] === 'no-new-privileges' || options[0] === 'no-new-privileges:true');
+// Only no-new-privileges plus Docker's builtin seccomp profile; the daemon default may be unconfined.
+const exactSecurityOptions = (options: string[] | null | undefined) => options?.length === 2
+  && options.some(option => option === 'no-new-privileges' || option === 'no-new-privileges:true')
+  && options.includes('seccomp=builtin');
 export const hasExactOptions = (value: string | undefined, expected: readonly string[]) => {
   const parts = value?.split(',') ?? [];
   return parts.length === expected.length && new Set(parts).size === parts.length
@@ -128,7 +130,7 @@ export function validateContainer(container: string, profile: ContainerProfile,
     || inspect.Config.Labels?.['io.codeboost.invocation'] !== profile.ownershipId
     || !host.ReadonlyRootfs || host.Privileged
     || !host.CapDrop?.map(value => value.toUpperCase()).includes('ALL') || (host.CapAdd?.length ?? 0) !== 0
-    || !exactNoNewPrivileges(host.SecurityOpt)
+    || !exactSecurityOptions(host.SecurityOpt)
     || host.NetworkMode !== 'none' || host.PidMode !== '' || host.IpcMode !== 'private'
     || host.UTSMode !== '' || host.UsernsMode !== '' || host.CgroupnsMode !== 'private'
     || (host.Devices?.length ?? 0) !== 0 || (host.DeviceRequests?.length ?? 0) !== 0 || host.PidsLimit !== 128
@@ -199,7 +201,7 @@ export function validateContainer(container: string, profile: ContainerProfile,
     || keeper.HostConfig.Privileged || keeper.HostConfig.NetworkMode !== 'none'
     || !keeper.HostConfig.CapDrop?.map(value => value.toUpperCase()).includes('ALL')
     || (keeper.HostConfig.CapAdd?.length ?? 0) !== 0
-    || !exactNoNewPrivileges(keeper.HostConfig.SecurityOpt)
+    || !exactSecurityOptions(keeper.HostConfig.SecurityOpt)
     || keeperVolumes.get('/work')?.Name !== profile.filesystems.workVolume
     || keeperVolumes.get('/metadata')?.Name !== profile.filesystems.metadataVolume)
     throw new Error('Task filesystems must remain owned by their trusted keeper.');

agents/container/storage.ts

@@ -102,8 +102,7 @@ export function prepareTaskFilesystems(clone: TaskClone, limits: TaskStorageLimi
   for (const [name, value] of Object.entries(limits)) validLimit(value, name);
   if (!/^sha256:[0-9a-f]{64}$/.test(imageId)) throw new Error('Task filesystems require the immutable built image ID.');
   assertBuiltAgentImage(imageId);
-  assertTaskClone(clone);
-  const remaining = createDeadline(timeoutMs), staging = realpathSync(clone.directory);
+  const staging = assertTaskClone(clone), remaining = createDeadline(timeoutMs);
   if (/[\n,]/.test(staging)) throw new Error('Staging path cannot be represented as a Docker mount.');
   if (!lstatSync(`${staging}/.git`).isDirectory()) throw new Error('Staging clone must contain standalone Git metadata.');
   const allocationId = randomUUID();
@@ -125,16 +124,18 @@ export function prepareTaskFilesystems(clone: TaskClone, limits: TaskStorageLimi
       'cp -a --no-preserve=ownership,timestamps /run/codeboost-staging/.git/. /metadata/', 'mkdir -p /work/.git',
       'chown -R 10001:10001 /work /metadata'].join('; ');
     docker(['run', '--detach', '--name', keeper, '--read-only', '--user', '10001:10001', '--network=none',
-      '--cap-drop=ALL', '--security-opt=no-new-privileges', '--pids-limit=32', '--memory=128m', '--cpus=.25',
+      '--cap-drop=ALL', '--security-opt=no-new-privileges', '--security-opt=seccomp=builtin', '--pids-limit=32', '--memory=128m', '--cpus=.25',
       '--mount', `type=volume,source=${workVolume},target=/work`, '--mount', `type=volume,source=${metadataVolume},target=/metadata`,
       '--label', 'io.codeboost.task-storage=keeper', '--label', `io.codeboost.allocation=${allocationId}`,
       '--entrypoint', 'sleep', imageId, 'infinity'], remaining());
     docker(['run', '--rm', '--name', seeder, '--label', `io.codeboost.allocation=${allocationId}`,
       '--read-only', '--user', '0:0', '--network=none', '--cap-drop=ALL', '--cap-add=CHOWN',
-      '--cap-add=DAC_OVERRIDE', '--cap-add=FOWNER', '--security-opt=no-new-privileges', '--pids-limit=32',
+      '--cap-add=DAC_OVERRIDE', '--cap-add=FOWNER', '--security-opt=no-new-privileges', '--security-opt=seccomp=builtin', '--pids-limit=32',
       '--memory=128m', '--cpus=.25', '--mount', `type=bind,source=${staging},target=/run/codeboost-staging,readonly`,
       '--mount', `type=volume,source=${workVolume},target=/work`, '--mount', `type=volume,source=${metadataVolume},target=/metadata`,
       '--entrypoint', 'sh', imageId, '-c', seed], remaining());
+    // Reject a staging directory swapped while the seeder was reading it.
+    assertTaskClone(clone);
     remaining();
     const filesystems = Object.freeze({ keeper, workVolume, metadataVolume, ...limits });
     allocations.set(filesystems, Object.freeze({ allocationId,

git/clone.ts

@@ -4,10 +4,25 @@ import { lstatSync, mkdtempSync, opendirSync, realpathSync, rmSync } from 'node:
 import { isAbsolute, join, relative, resolve } from 'node:path';
 import type { TaskClone } from '../agents/contract.ts';
 
-const trustedClones = new WeakSet<TaskClone>();
+interface DirectoryIdentity { readonly dev: number; readonly ino: number }
+interface CloneIdentity { readonly directory: string; readonly root: DirectoryIdentity; readonly metadata: DirectoryIdentity }
+const trustedClones = new WeakMap<TaskClone, CloneIdentity>();
+const directoryIdentity = (path: string): DirectoryIdentity | undefined => {
+  const stat = lstatSync(path, { throwIfNoEntry: false });
+  return stat?.isDirectory() && !stat.isSymbolicLink() ? { dev: stat.dev, ino: stat.ino } : undefined;
+};
+const sameDirectory = (actual: DirectoryIdentity | undefined, expected: DirectoryIdentity) =>
+  actual?.dev === expected.dev && actual.ino === expected.ino;
 
-export function assertTaskClone(clone: TaskClone): void {
-  if (!trustedClones.has(clone)) throw new Error('Task clone was not created by the trusted clone builder.');
+/** Authenticate a clone and prove its staging directory is still the one the builder created. */
+export function assertTaskClone(clone: TaskClone): string {
+  const identity = trustedClones.get(clone);
+  if (!identity) throw new Error('Task clone was not created by the trusted clone builder.');
+  if (!sameDirectory(directoryIdentity(identity.directory), identity.root)
+    || !sameDirectory(directoryIdentity(join(identity.directory, '.git')), identity.metadata)
+    || realpathSync(identity.directory) !== identity.directory)
+    throw new Error('Task clone directory was replaced after it was created.');
+  return identity.directory;
 }
 
 /**
@@ -86,7 +101,9 @@ export function createTaskClone(options: {
     run(directory, 'checkout', '--detach', options.head);
     if (run(directory, 'rev-parse', 'HEAD') !== options.head) throw new Error('Task head changed during clone.');
     const clone = Object.freeze({ id: randomUUID(), taskId: options.taskId, directory, head: options.head });
-    trustedClones.add(clone);
+    const root = directoryIdentity(directory), cloneMetadata = directoryIdentity(metadata);
+    if (!root || !cloneMetadata) throw new Error('Task clone directory is not a real directory.');
+    trustedClones.set(clone, Object.freeze({ directory: realpathSync(directory), root, metadata: cloneMetadata }));
     return clone;
   } catch (error) {
     rmSync(directory, { recursive: true, force: true });

test/agent-container.test.ts

@@ -1,6 +1,6 @@
 import { execFileSync, spawnSync } from 'node:child_process';
 import { randomBytes, randomUUID } from 'node:crypto';
-import { chmodSync, existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, mkdtempSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterAll, beforeAll, describe, expect, it } from 'vitest';
@@ -285,6 +285,32 @@ describe('real Docker agent isolation', () => {
     expect(existsSync(unsettled.codexAuthFile!)).toBe(true);
   }, 60_000);
 
+  it('refuses to seed a clone whose staging directory was replaced after creation', () => {
+    const data = fixture();
+    const clone = createTaskClone({ source: data.source, parent: join(data.root, 'staging'), taskId: 'task-2',
+      head: git(data.source, 'rev-parse', 'HEAD') });
+    renameSync(clone.directory, `${clone.directory}-original`);
+    mkdirSync(clone.directory); git(clone.directory, 'init');
+    expect(() => prepareTaskFilesystems(clone, {
+      workBytes: 16 * 1024 * 1024, workInodes: 512, metadataBytes: 16 * 1024 * 1024, metadataInodes: 512,
+    }, imageId)).toThrow('replaced after it was created');
+  }, 60_000);
+
+  it('rejects a container that relies on the daemon default seccomp profile', () => {
+    const data = fixture(), valid = profile(data, 'planning', ['true']);
+    docker(...valid.args.filter(arg => arg !== '--security-opt=seccomp=builtin')); containers.add(valid.name);
+    expect(() => validateContainer(valid.name, valid)).toThrow('lockdown');
+    docker('rm', '--force', valid.name); containers.delete(valid.name);
+  }, 60_000);
+
+  it('startup probe refuses to exec when seccomp filtering is disabled', () => {
+    const result = spawnSync('docker', ['run', '--rm', '--read-only', '--user', '10001:10001', '--cap-drop=ALL',
+      '--security-opt=no-new-privileges', '--security-opt=seccomp=unconfined', '--network=none', imageId, 'true'],
+      { encoding: 'utf8', timeout: 60_000 });
+    expect(result.status).toBe(78);
+    expect(result.stderr).toContain('seccomp syscall filter must be enforced');
+  }, 60_000);
+
   it('refuses a Codex auth path that is a link without resolving it', () => {
     const data = fixture(), link = join(data.root, 'auth-link.json');
     symlinkSync(data.fakeAuth, link);