feat: require rootless production sandbox runners

packages/casan-harness/scripts/bash/sandbox-container.sh

@@ -12,6 +12,7 @@ set -uo pipefail
 #   --memory/--cpus  → resource abuse is bounded
 #   -v <ws>:/work:rw → ONLY the workspace is writable; host $HOME/.ssh is NOT mounted
 #   --cap-drop=ALL --security-opt=no-new-privileges → no privilege escalation
+#   --user=65532:65532 → workload process is never root in the container
 #
 # Usage:
 #   sandbox-container.sh --workspace <dir> [--image busybox] [--timeout 20]
@@ -22,6 +23,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 IMAGE="${CASAN_SANDBOX_IMAGE:-busybox}"
 WORKSPACE="$PWD"; TIMEOUT="${CASAN_SANDBOX_TIMEOUT:-20}"
 MEMORY="${CASAN_SANDBOX_MEMORY:-256m}"; PIDS="${CASAN_SANDBOX_PIDS:-128}"; CPUS="${CASAN_SANDBOX_CPUS:-1}"
+USER_SPEC="${CASAN_SANDBOX_USER:-65532:65532}"
 while [[ "$#" -gt 0 ]]; do
   case "$1" in
     --workspace) WORKSPACE="${2:-}"; shift 2 ;;
@@ -30,6 +32,7 @@ while [[ "$#" -gt 0 ]]; do
     --memory) MEMORY="${2:-}"; shift 2 ;;
     --pids) PIDS="${2:-}"; shift 2 ;;
     --cpus) CPUS="${2:-}"; shift 2 ;;
+    --user) USER_SPEC="${2:-}"; shift 2 ;;
     --) shift; break ;;
     *) echo "sandbox-container: unknown arg $1" >&2; exit 2 ;;
   esac
@@ -38,6 +41,16 @@ done
 
 command -v docker >/dev/null 2>&1 || { echo "SANDBOX_CONTAINER_NO_DOCKER" >&2; exit 127; }
 docker info >/dev/null 2>&1 || { echo "SANDBOX_CONTAINER_DOCKER_DOWN" >&2; exit 127; }
+[[ "$USER_SPEC" =~ ^[0-9]+:[0-9]+$ ]] || { echo "SANDBOX_CONTAINER_BAD_USER" >&2; exit 2; }
+
+# A non-root process is always required. Production additionally refuses a
+# rootful Docker daemon because a compromised daemon socket defeats container
+# isolation. Local developer/test profiles may use a rootful daemon, but cannot
+# claim that configuration as a hardened production runner.
+if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_SANDBOX_REQUIRE_ROOTLESS:-0}" == "1" ]]; then
+  docker info --format '{{json .SecurityOptions}}' 2>/dev/null | grep -q 'rootless' \
+    || { echo "SANDBOX_CONTAINER_ROOTLESS_REQUIRED" >&2; exit 2; }
+fi
 
 WS_ABS="$(cd "$WORKSPACE" 2>/dev/null && pwd)" || { echo "SANDBOX_CONTAINER_BAD_WORKSPACE" >&2; exit 2; }
 
@@ -54,7 +67,7 @@ bash "$SCRIPT_DIR/tool-exec.sh" "$TIMEOUT" -- \
   docker run --rm --init --name "$CID" \
     --network=none --read-only \
     --pids-limit="$PIDS" --memory="$MEMORY" --cpus="$CPUS" \
-    --cap-drop=ALL --security-opt=no-new-privileges \
+    --user "$USER_SPEC" --cap-drop=ALL --security-opt=no-new-privileges \
     --tmpfs /tmp:rw,size=16m \
     -v "$WS_ABS":/work:rw -w /work \
     "$IMAGE" sh -c "$CMD"