Skip to content

feat: harden seccomp profile with deny-by-default approach #321

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Copilot wants to merge 2 commits into
base: main
Choose a base branch
from
+728 −13
Open

feat: harden seccomp profile with deny-by-default approach #321

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a0417d2
Initial plan
Copilot Jan 17, 2026
2c126cb
feat: harden seccomp profile with deny-by-default approach
Copilot Jan 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -219,6 +219,8 @@ The codebase follows a modular architecture with clear separation of concerns:
- Mounts entire host filesystem at `/host` and user home directory for full access
- `NET_ADMIN` capability required for iptables setup during initialization
- **Security:** `NET_ADMIN` is dropped via `capsh --drop=cap_net_admin` before executing user commands, preventing malicious code from modifying iptables rules
- **Seccomp Profile:** Uses deny-by-default syscall filtering (`containers/agent/seccomp-profile.json`). Only syscalls required for normal operation (Node.js, curl, git, npm) are allowed; dangerous syscalls like `ptrace`, `mount`, `kexec_load`, and namespace manipulation are blocked.
- **Dropped Capabilities:** `NET_RAW`, `SYS_PTRACE`, `SYS_MODULE`, `SYS_RAWIO`, `MKNOD` to reduce attack surface
- Two-stage entrypoint:
1. `setup-iptables.sh`: Configures iptables NAT rules to redirect HTTP/HTTPS traffic to Squid (agent container only)
2. `entrypoint.sh`: Drops NET_ADMIN capability, then executes user command as non-root user
Expand Down
Loading
Loading