gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: require rootless production sandbox runners

Browse Source
This commit is contained in:
thanhnv
2026-07-18 00:19:53 +07:00
parent 92c20e304c
commit b921f25c57
4 changed files with 35 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/production/README.md
+9
View File
@@ -84,3 +84,12 @@ bash packages/casan-harness/scripts/bash/state-backup.sh restore "<backup-id>" -
Perform and retain a restore drill before enabling write actions. A production
runbook must define retention, off-site replication, an owner, RPO/RTO targets,
and approval for any restore into a live state directory.
## Hardened runner requirement
Production sandbox execution requires a **rootless Docker daemon** plus a
non-root container process (`65532:65532` by default). CASAN rejects a rootful
daemon when `CASAN_PROFILE=prod`; the workload has no network, read-only root
filesystem, no Linux capabilities, no-new-privileges, bounded PID/memory/CPU,
and only its explicit workspace bind mount. Provision the workspace so the
non-root runner identity can write it.