Repository navigation
Update default runsc flags configuration - #2361
Merged
Benjamin Elder (BenTheElder) merged 1 commit intoOct 17, 2026
Merged
Benjamin Elder (BenTheElder) merged 1 commit into
Benjamin Elder (BenTheElder) merged 1 commit into
Conversation
Jake Gaylor (jhgaylor)
added a commit
to arugula-salad/sandpit
that referenced
this pull request
Oct 10, 2026
…20) * substrate: ports through the agent; workers with runsc --allow-suid - An agent guest's ports go through its agent (engine.AgentDialPort), as on Firecracker: any TCP, and "http", the sprite's own HTTP service started on demand, which the Sprites API's URL proxy asks for. Through the router only E2B's agentless guest goes. - The WorkerPool runs home-cloud's ateom-gvisor v0.4.0-hc1, which passes runsc --allow-suid (upstream agent-substrate/substrate#2361), so sudo works in the guests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * k8s: pin this branch's tested sandpitd Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Collaborator
|
changes from this PR LGTM, discussing the underlying previous PR though. |
Collaborator
|
Davanum Srinivas (@dims) there's a logical conflict with one of your PRs trying to disable new-privs inside uVM, I think we need to follow up with Greg Castle (@destijl) about that. |
Fabricio Voznika (fvoznika)
force-pushed
the
runsc-default-flags
branch
2 times, most recently
from
October 13, 2026 23:53
544da0f to
6c29250
Compare
Collaborator
|
Benjamin Elder (@BenTheElder) can you point at the issue? Not sure what I should be looking at. |
Collaborator
|
er, that was #1904 Greg Castle (@destijl) |
Collaborator
|
I synced with dims, we agree just to make the behavior the same, and this direction is agreeable. Happy to merge this when rebased |
Fabricio Voznika (fvoznika)
force-pushed
the
runsc-default-flags
branch
2 times, most recently
from
October 14, 2026 23:47
76bc6e1 to
ebe993d
Compare
Collaborator
Author
|
Core tag cannot be set unconditionally. I'll send another PR for that. |
Collaborator
|
[did not see this in time after the rebase, will have to try again, we're merging a lot at the moment] |
Zheng Lammerts (zlammerts-svg)
requested a review
from Benjamin Elder (BenTheElder)
October 16, 2026 15:38
Collaborator
|
Benjamin Elder (@BenTheElder) I explicitly requested you to review and provide approval for this PR. Thanks a lot! |
Configure additional global flags for runsc sandboxes: - --allow-suid: allow setuid/setgid executables to run properly inside the sandbox (e.g. sudo). This behavior is controlled by the Process.NoNewPrivileges flag. - --host-settings=ignore: avoid redundant host kernel setting checks during startup. *AI disclosure: AI tooling assisted in writing and testing parts of this change.* Fixes agent-substrate#2136 - [x] Tests pass - [x] Appropriate changes to documentation are included in the PR
Fabricio Voznika (fvoznika)
force-pushed
the
runsc-default-flags
branch
from
October 16, 2026 20:06
ebe993d to
354fa7f
Compare
Benjamin Elder (BenTheElder)
approved these changes
Oct 17, 2026
2 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update default runsc flags configuration
Configure additional global flags for runsc sandboxes:
sandbox (e.g. sudo). This behavior is controlled by the
Process.NoNewPrivileges flag.
startup.
AI disclosure: AI tooling assisted in writing and testing parts of this change.
Updates #2136