Add capabilities at build
This commit is contained in:
Samuel Aubertin
38
README.md
38
README.md
@@ -25,7 +25,6 @@ brew install coreutils gnu-tar jq
|
||||
cat > path/to/project/.sloptrap <<'EOF'
|
||||
name=path/to/project
|
||||
packages_extra=make
|
||||
codex_args=--sandbox danger-full-access --ask-for-approval never
|
||||
EOF
|
||||
|
||||
cat > path/to/project/.sloptrapignore <<'EOF'
|
||||
@@ -54,7 +53,7 @@ brew install coreutils gnu-tar jq
|
||||
The manifest is optional. When absent, sloptrap derives:
|
||||
- `name = basename(project directory)`
|
||||
- `packages_extra = ""` (none)
|
||||
- `codex_args = "--sandbox danger-full-access --ask-for-approval never"`
|
||||
- `capabilities = ""` (none)
|
||||
If a build is requested and no `.sloptrap` exists, sloptrap prompts to create one interactively.
|
||||
|
||||
Supported keys when the manifest is present:
|
||||
@@ -63,11 +62,13 @@ Supported keys when the manifest is present:
|
||||
| --- | --- | --- |
|
||||
| `name` | project directory name | Must match `^[A-Za-z0-9_.-]+$`. Used for image/container naming. |
|
||||
| `packages_extra` | *empty* | Additional Debian packages installed during `docker/podman build`. Tokens must be alphanumeric plus `+.-`. |
|
||||
| `codex_args` | `--sandbox danger-full-access --ask-for-approval never` | Passed verbatim to the Codex CLI entrypoint. Tokens are shell-split, so quote values with spaces (e.g., `--profile security-audit`). |
|
||||
| `capabilities` | *empty* | Optional privileged features. Supported values are `apt-install`, `packet-capture`, and `nested-podman`. |
|
||||
| `allow_host_network` | `false` | `true` opts into `--network host`; keep `false` unless the project absolutely requires direct access to host-local services. |
|
||||
`codex_args` are appended after the default sandbox flag, and sloptrap refuses to run if the resulting `--sandbox` mode is anything other than `workspace-write`, `workspace-read-only`, or `danger-full-access`.
|
||||
|
||||
Values containing `$`, `` ` ``, or newlines are rejected to prevent command injection. Setting illegal keys or malformed values aborts the run before containers start.
|
||||
sloptrap always runs Codex with `--sandbox danger-full-access --ask-for-approval never`. `codex_args` is deprecated and rejected if present.
|
||||
|
||||
Capability trust is local state, not part of the repository. Builds for manifests that request capabilities require either an interactive trust confirmation or `--trust-capabilities`. Trusted capabilities can then be activated per run with `--enable-capability <name>`.
|
||||
|
||||
### `.sloptrapignore`
|
||||
|
||||
@@ -79,13 +80,15 @@ Values containing `$`, `` ` ``, or newlines are rejected to prevent command inje
|
||||
## CLI Reference
|
||||
|
||||
```
|
||||
./sloptrap [--dry-run] [--print-config] <code-directory> [target ...]
|
||||
./sloptrap [--dry-run] [--print-config] [--trust-capabilities] [--enable-capability <name> ...] <code-directory> [target ...]
|
||||
```
|
||||
|
||||
Options:
|
||||
|
||||
- `--dry-run` — print the container/engine commands that would run without executing them.
|
||||
- `--print-config` — output the resolved manifest values, defaults, and ignore list.
|
||||
- `--trust-capabilities` — trust the manifest's requested capabilities for the current build flow.
|
||||
- `--enable-capability <name>` — enable a trusted runtime capability for this invocation. Repeat for multiple capabilities.
|
||||
- `-h, --help` — display usage.
|
||||
- `--` — stop option parsing; remaining arguments are treated as targets.
|
||||
|
||||
@@ -94,9 +97,10 @@ Behaviour:
|
||||
- Missing manifests are treated as default configuration; when a build is requested, sloptrap runs the interactive wizard if a TTY is available, otherwise it warns and continues with defaults.
|
||||
- `SLOPTRAP_CONTAINER_ENGINE` overrides engine auto-detection.
|
||||
- If `${HOME}/.codex/auth.json` is absent or empty, sloptrap prepends a login run before executing your targets.
|
||||
- Fresh interactive `run` sessions receive a launcher-generated startup prompt telling the agent it is inside sloptrap, summarising the resolved manifest/runtime state, and pointing it at `/workspace/.sloptrap` for exact project configuration. `resume` does not inject that prompt again.
|
||||
- Exit status mirrors the last target executed; errors in parsing or setup abort early with a message.
|
||||
|
||||
`--print-config` fields include `manifest_present=true|false`, resolved paths, and the sanitised ignore mount roots so you can confirm what will be hidden inside the container.
|
||||
`--print-config` fields include `manifest_present=true|false`, requested/enabled capability lists, trust status, resolved paths, and the sanitised ignore mount roots so you can confirm what will be hidden inside the container.
|
||||
|
||||
### Regression Suite
|
||||
|
||||
@@ -112,7 +116,7 @@ Targets are supplied after the code directory. When omitted, sloptrap defaults t
|
||||
| `build` | Download Codex (if missing), verify SHA-256, and build the container image. |
|
||||
| `build-if-missing` | No-op when the image already exists; otherwise delegates to `build`. |
|
||||
| `rebuild` | Rebuild the image from scratch (`--no-cache`). |
|
||||
| `run` | Default goal. Runs the container with Codex as entrypoint and passes `codex_args`. |
|
||||
| `run` | Default goal. Runs the container with Codex using sloptrap's built-in runtime flags. |
|
||||
| `resume <session-id>` | Continues a Codex session by running `codex resume <session-id>` inside the container (builds if needed). |
|
||||
| `login` | Starts Codex in login mode to bootstrap shared `${HOME}/.codex/auth.json` credentials. |
|
||||
| `shell` | Launches `/bin/bash` inside the container for debugging. |
|
||||
@@ -122,22 +126,30 @@ Targets are supplied after the code directory. When omitted, sloptrap defaults t
|
||||
|
||||
The launcher executes targets sequentially, so `./sloptrap repo build run` performs an explicit rebuild before invoking Codex. Extra targets may be added in the future; unknown names fail fast.
|
||||
|
||||
### Capability Helpers
|
||||
|
||||
When a trusted capability is enabled for a run, the container includes helper commands:
|
||||
|
||||
- `slop-apt install <package...>` for session-scoped package installation.
|
||||
- `slopcap capture --interface <iface> [--filter <expr>] [--output <path>] [--stdout]` for packet capture.
|
||||
- `sloppodman <pull|build|tag|run|ps|logs|stop|rm|inspect> ...` for nested Podman workflows. `build` contexts and Dockerfiles must remain inside `/workspace`, and pushes are not supported.
|
||||
|
||||
## Execution Environment
|
||||
|
||||
- Container engine: Podman or podman with identical command lines. Podman uses `--userns=keep-id`; Docker receives the equivalent `--user UID:GID`.
|
||||
- Container engine: Podman or Docker with identical command lines. Podman uses `--userns=keep-id`; Docker receives the equivalent `--user UID:GID` for standard runs.
|
||||
- Filesystem view: the project directory mounts at `/workspace`; `${HOME}/.codex/sloptrap/state/<project-hash>` mounts at `/codex`; `${HOME}/.codex/auth.json` mounts at `/codex/auth.json`.
|
||||
- Ignore filter: `.sloptrapignore` entries are overlaid with tmpfs directories or empty bind mounts so data remains unavailable to Codex.
|
||||
- Network: the container always runs with `--network host`. sloptrap does not filter or proxy outbound traffic.
|
||||
- Process context: capabilities are dropped, `no-new-privileges` is set, the root filesystem is read-only, and scratch paths (`/tmp`, `/run`, `/run/lock`) are tmpfs mounts. Resource limits follow the launcher defaults.
|
||||
- Codex configuration: runtime flags come from `codex_args`. Persistent Codex state is project-scoped under `${HOME}/.codex/sloptrap/state/`, while credentials are shared via `${HOME}/.codex/auth.json`.
|
||||
- Network: isolated networking is used by default; `allow_host_network=true` opts into `--network host`.
|
||||
- Process context: standard runs drop capabilities, set `no-new-privileges`, use a read-only root filesystem, and keep scratch paths (`/tmp`, `/run`, `/run/lock`) on tmpfs. Capability-enabled runs may selectively add the runtime options required for the requested capability.
|
||||
- Codex configuration: runtime flags are fixed to `--sandbox danger-full-access --ask-for-approval never`. Persistent Codex state is project-scoped under `${HOME}/.codex/sloptrap/state/`, while credentials are shared via `${HOME}/.codex/auth.json`.
|
||||
|
||||
## Threat Model and Limits
|
||||
|
||||
- **Outbound disclosure**: prompts and referenced data travel from the container to the configured LLM endpoint. Any file content within `/workspace` or environment data exposed to the process can appear in that traffic.
|
||||
- **Shared storage**: `/workspace`, project-scoped `/codex`, and `/codex/auth.json` are host mounts. Files written to these locations become visible on the host and to the LLM provider through prompts.
|
||||
- **Environment surface**: the container receives a minimal fixed environment (HOME/XDG paths, `CODEX_HOME`). The manifest no longer allows injecting additional environment variables.
|
||||
- **Process isolation**: the container runs without additional Linux capabilities and with a read-only root filesystem. The container and host still share the same kernel; a kernel-level escape would affect host confidentiality.
|
||||
- **Networking stance**: traffic is unrestricted once it leaves the container. sloptrap does not enforce an allowlist or DNS policy, and `--network host` is always used because the bundled Codex CLI must reach an upstream LLM provider. If you require an offline or firewalled workflow, sloptrap is not an appropriate launcher.
|
||||
- **Process isolation**: standard runs keep a read-only root filesystem and no extra Linux capabilities. Capability-enabled runs deliberately relax specific runtime controls for the enabled feature, so they should be treated as a stronger trust decision than a default session.
|
||||
- **Networking stance**: traffic is unrestricted once it leaves the container. sloptrap does not enforce an allowlist or DNS policy. Host networking is opt-in per manifest; if you require an offline or firewalled workflow, sloptrap is not an appropriate launcher.
|
||||
- **Persistence**: Codex history and logs accumulate per project under `${HOME}/.codex/sloptrap/state/`. Sensitive prompts recorded on disk remain on the host after the session. Because `.git/` is ignored inside the container, any historical secrets in Git objects stay outside the LLM context unless explicitly surfaced in the working tree.
|
||||
- **Codex cache hygiene**: per-project state mounts remain writable by the container and hold prompts/history/state, while `${HOME}/.codex/auth.json` holds shared credentials. Rotate credentials regularly and protect both locations.
|
||||
- **Secret scanning**: sloptrap does not perform secret discovery or redaction; any credentials present in the project remain available to Codex and the upstream provider.
|
||||
|
||||
Reference in New Issue
Block a user