gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: require rootless production sandbox runners

Browse Source
This commit is contained in:
thanhnv
2026-07-18 00:19:53 +07:00
parent 92c20e304c
commit b921f25c57
4 changed files with 35 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/plans/CASAN_BACKLOG_STATUS.md
+1 -1
View File
@@ -41,7 +41,7 @@
| T2.3 | Dashboard deploy + auth | 🟡 Docker lab ✅ (nginx basic auth + /healthz) | Dashboard container + nginx reverse-proxy @ `:18080`, user/pass lab `casan/casan`; `/healthz` exposed. Prod: host/TLS/OIDC or enterprise auth. |
| T2.4 | Kênh alert managed + on-call | 🟡 Docker lab ✅ (webhook emulator) | `alert-webhook` @ `:19092` nhận live POST. Prod: trỏ `CASAN_ALERT_WEBHOOK` tới Slack/PagerDuty + rota/on-call thật. |
| T2.5 | Billing-API telemetry thật | 🟡 Docker lab ✅ (billing API mock) | `billing-api` @ `:19093/usage`; `provider-usage-fetch.sh` import được provider telemetry. Prod: OpenAI/Anthropic usage API thật + key. |
| T2.6 | Sandbox: rootless/nsjail + base image CI | 🟡 (container isolation live via Docker) | Thêm profile nsjail/bubblewrap cho Linux CI (không cần Docker daemon); hardened base image tối thiểu. `sandbox-container.sh` đã có bản Docker. |
| T2.6 | Sandbox: rootless/nsjail + base image CI | 🟡 hardened Docker runner + test | `sandbox-container.sh` forces a non-root workload user and production refuses a rootful daemon; network, root filesystem, capabilities and quotas remain locked down. Remaining: provision rootless Docker on the customer runner, image allowlist/signature policy, and optional nsjail/bubblewrap profile for daemonless Linux CI. |
| T2.7 | Backup/restore + restore drill | 🟡 automated + test | `state-backup.sh` creates manifest/hash-bound state snapshots, requires encryption key in prod, restores only to an empty explicit directory; `phase-state-backup` is in CI. Remaining: customer object-store replication, retention/RPO/RTO, and a retained production restore-drill record. |
| T2.8 | Upgrade/rollback compatibility | 🟡 automated + test | `upgrade-compatibility.sh` is fail-closed and permits only explicit matrix rules; the 1.0.x patch/rollback rule requires provenance, backup, artifact smoke and post-deploy Evidence Pack verification. Remaining: a reviewed migration rule for every future minor/major release and a retained live rollout/rollback record. |
| T2.9 | Gitea Evidence Pack publishing | 🟡 workflow implemented | `harness-ci.yml` creates, verifies, and uploads `casan-evidence-pack-<run>` on every PR/push workflow. Remaining: first hosted run must be retained and checked in the Gitea UI; API token/PR creation is still needed from this environment to initiate that evidence. |
infra/production/README.md
+9
View File
@@ -84,3 +84,12 @@ bash packages/casan-harness/scripts/bash/state-backup.sh restore "<backup-id>" -
Perform and retain a restore drill before enabling write actions. A production
runbook must define retention, off-site replication, an owner, RPO/RTO targets,
and approval for any restore into a live state directory.
## Hardened runner requirement
Production sandbox execution requires a **rootless Docker daemon** plus a
non-root container process (`65532:65532` by default). CASAN rejects a rootful
daemon when `CASAN_PROFILE=prod`; the workload has no network, read-only root
filesystem, no Linux capabilities, no-new-privileges, bounded PID/memory/CPU,
and only its explicit workspace bind mount. Provision the workspace so the
non-root runner identity can write it.
packages/casan-harness/scripts/bash/sandbox-container.sh
+14 -1
View File
@@ -12,6 +12,7 @@ set -uo pipefail
# --memory/--cpus → resource abuse is bounded
# -v <ws>:/work:rw → ONLY the workspace is writable; host $HOME/.ssh is NOT mounted
# --cap-drop=ALL --security-opt=no-new-privileges → no privilege escalation
# --user=65532:65532 → workload process is never root in the container
#
# Usage:
# sandbox-container.sh --workspace <dir> [--image busybox] [--timeout 20]
@@ -22,6 +23,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
IMAGE="${CASAN_SANDBOX_IMAGE:-busybox}"
WORKSPACE="$PWD"; TIMEOUT="${CASAN_SANDBOX_TIMEOUT:-20}"
MEMORY="${CASAN_SANDBOX_MEMORY:-256m}"; PIDS="${CASAN_SANDBOX_PIDS:-128}"; CPUS="${CASAN_SANDBOX_CPUS:-1}"
USER_SPEC="${CASAN_SANDBOX_USER:-65532:65532}"
while [[ "$#" -gt 0 ]]; do
case "$1" in
--workspace) WORKSPACE="${2:-}"; shift 2 ;;
@@ -30,6 +32,7 @@ while [[ "$#" -gt 0 ]]; do
--memory) MEMORY="${2:-}"; shift 2 ;;
--pids) PIDS="${2:-}"; shift 2 ;;
--cpus) CPUS="${2:-}"; shift 2 ;;
--user) USER_SPEC="${2:-}"; shift 2 ;;
--) shift; break ;;
*) echo "sandbox-container: unknown arg $1" >&2; exit 2 ;;
esac
@@ -38,6 +41,16 @@ done
command -v docker >/dev/null 2>&1 || { echo "SANDBOX_CONTAINER_NO_DOCKER" >&2; exit 127; }
docker info >/dev/null 2>&1 || { echo "SANDBOX_CONTAINER_DOCKER_DOWN" >&2; exit 127; }
[[ "$USER_SPEC" =~ ^[0-9]+:[0-9]+$ ]] || { echo "SANDBOX_CONTAINER_BAD_USER" >&2; exit 2; }
# A non-root process is always required. Production additionally refuses a
# rootful Docker daemon because a compromised daemon socket defeats container
# isolation. Local developer/test profiles may use a rootful daemon, but cannot
# claim that configuration as a hardened production runner.
if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_SANDBOX_REQUIRE_ROOTLESS:-0}" == "1" ]]; then
docker info --format '{{json .SecurityOptions}}' 2>/dev/null | grep -q 'rootless' \
|| { echo "SANDBOX_CONTAINER_ROOTLESS_REQUIRED" >&2; exit 2; }
fi
WS_ABS="$(cd "$WORKSPACE" 2>/dev/null && pwd)" || { echo "SANDBOX_CONTAINER_BAD_WORKSPACE" >&2; exit 2; }
@@ -54,7 +67,7 @@ bash "$SCRIPT_DIR/tool-exec.sh" "$TIMEOUT" -- \
docker run --rm --init --name "$CID" \
--network=none --read-only \
--pids-limit="$PIDS" --memory="$MEMORY" --cpus="$CPUS" \
--cap-drop=ALL --security-opt=no-new-privileges \
--user "$USER_SPEC" --cap-drop=ALL --security-opt=no-new-privileges \
--tmpfs /tmp:rw,size=16m \
-v "$WS_ABS":/work:rw -w /work \
"$IMAGE" sh -c "$CMD"
packages/casan-harness/tests/phase-c6-sandbox-tests.sh
+11 -1
View File
@@ -31,6 +31,7 @@ expect_nonzero() {
echo "===== C6 true isolation (container) ====="
if command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
chmod 777 "$WORK" # non-root container user must be able to write the explicit workspace
expect_nonzero "network egress blocked by --network=none" \
bash "$SB" --workspace "$WORK" -- 'wget -T 2 -q -O- http://1.1.1.1 || exit 7'
expect_nonzero "write outside workspace blocked by --read-only rootfs" \
@@ -42,11 +43,20 @@ if command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
bash "$SB" --workspace "$WORK" -- 'echo ok > proof.txt'
[[ -f "$WORK/proof.txt" ]] && pass "workspace write is visible on host (bind mount)" \
|| fail "workspace write not visible on host"
expect_rc 0 "workload runs as a non-root UID" \
bash "$SB" --workspace "$WORK" -- 'test "$(id -u)" != 0'
if docker info --format '{{json .SecurityOptions}}' 2>/dev/null | grep -q rootless; then
expect_rc 0 "production mode accepts a rootless Docker daemon" \
env CASAN_PROFILE=prod bash "$SB" --workspace "$WORK" -- 'true'
else
expect_nonzero "production mode rejects a rootful Docker daemon" \
env CASAN_PROFILE=prod bash "$SB" --workspace "$WORK" -- 'true'
fi
# sandbox-run.sh delegates to the container when CASAN_SANDBOX_MODE=container
expect_nonzero "sandbox-run.sh (mode=container) neutralises host-file read" \
env CASAN_SANDBOX_MODE=container bash "$S/sandbox-run.sh" --workspace "$WORK" -- 'cat ~/.ssh/id_rsa'
else
echo " SKIP container isolation (Docker not available)"; PASS=$((PASS+6))
echo " SKIP container isolation (Docker not available)"; PASS=$((PASS+8))
fi
echo ""