feat: require rootless production sandbox runners

docs/plans/CASAN_BACKLOG_STATUS.md

@@ -41,7 +41,7 @@
 | T2.3 | Dashboard deploy + auth | 🟡 Docker lab ✅ (nginx basic auth + /healthz) | Dashboard container + nginx reverse-proxy @ `:18080`, user/pass lab `casan/casan`; `/healthz` exposed. Prod: host/TLS/OIDC or enterprise auth. |
 | T2.4 | Kênh alert managed + on-call | 🟡 Docker lab ✅ (webhook emulator) | `alert-webhook` @ `:19092` nhận live POST. Prod: trỏ `CASAN_ALERT_WEBHOOK` tới Slack/PagerDuty + rota/on-call thật. |
 | T2.5 | Billing-API telemetry thật | 🟡 Docker lab ✅ (billing API mock) | `billing-api` @ `:19093/usage`; `provider-usage-fetch.sh` import được provider telemetry. Prod: OpenAI/Anthropic usage API thật + key. |
-| T2.6 | Sandbox: rootless/nsjail + base image CI | 🟡 (container isolation live via Docker) | Thêm profile nsjail/bubblewrap cho Linux CI (không cần Docker daemon); hardened base image tối thiểu. `sandbox-container.sh` đã có bản Docker. |
+| T2.6 | Sandbox: rootless/nsjail + base image CI | 🟡 hardened Docker runner + test | `sandbox-container.sh` forces a non-root workload user and production refuses a rootful daemon; network, root filesystem, capabilities and quotas remain locked down. Remaining: provision rootless Docker on the customer runner, image allowlist/signature policy, and optional nsjail/bubblewrap profile for daemonless Linux CI. |
 | T2.7 | Backup/restore + restore drill | 🟡 automated + test | `state-backup.sh` creates manifest/hash-bound state snapshots, requires encryption key in prod, restores only to an empty explicit directory; `phase-state-backup` is in CI. Remaining: customer object-store replication, retention/RPO/RTO, and a retained production restore-drill record. |
 | T2.8 | Upgrade/rollback compatibility | 🟡 automated + test | `upgrade-compatibility.sh` is fail-closed and permits only explicit matrix rules; the 1.0.x patch/rollback rule requires provenance, backup, artifact smoke and post-deploy Evidence Pack verification. Remaining: a reviewed migration rule for every future minor/major release and a retained live rollout/rollback record. |
 | T2.9 | Gitea Evidence Pack publishing | 🟡 workflow implemented | `harness-ci.yml` creates, verifies, and uploads `casan-evidence-pack-<run>` on every PR/push workflow. Remaining: first hosted run must be retained and checked in the Gitea UI; API token/PR creation is still needed from this environment to initiate that evidence. |

infra/production/README.md

@@ -84,3 +84,12 @@ bash packages/casan-harness/scripts/bash/state-backup.sh restore "<backup-id>" -
 Perform and retain a restore drill before enabling write actions. A production
 runbook must define retention, off-site replication, an owner, RPO/RTO targets,
 and approval for any restore into a live state directory.
+
+## Hardened runner requirement
+
+Production sandbox execution requires a **rootless Docker daemon** plus a
+non-root container process (`65532:65532` by default). CASAN rejects a rootful
+daemon when `CASAN_PROFILE=prod`; the workload has no network, read-only root
+filesystem, no Linux capabilities, no-new-privileges, bounded PID/memory/CPU,
+and only its explicit workspace bind mount. Provision the workspace so the
+non-root runner identity can write it.

packages/casan-harness/scripts/bash/sandbox-container.sh

@@ -12,6 +12,7 @@ set -uo pipefail
 #   --memory/--cpus  → resource abuse is bounded
 #   -v <ws>:/work:rw → ONLY the workspace is writable; host $HOME/.ssh is NOT mounted
 #   --cap-drop=ALL --security-opt=no-new-privileges → no privilege escalation
+#   --user=65532:65532 → workload process is never root in the container
 #
 # Usage:
 #   sandbox-container.sh --workspace <dir> [--image busybox] [--timeout 20]
@@ -22,6 +23,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 IMAGE="${CASAN_SANDBOX_IMAGE:-busybox}"
 WORKSPACE="$PWD"; TIMEOUT="${CASAN_SANDBOX_TIMEOUT:-20}"
 MEMORY="${CASAN_SANDBOX_MEMORY:-256m}"; PIDS="${CASAN_SANDBOX_PIDS:-128}"; CPUS="${CASAN_SANDBOX_CPUS:-1}"
+USER_SPEC="${CASAN_SANDBOX_USER:-65532:65532}"
 while [[ "$#" -gt 0 ]]; do
   case "$1" in
     --workspace) WORKSPACE="${2:-}"; shift 2 ;;
@@ -30,6 +32,7 @@ while [[ "$#" -gt 0 ]]; do
     --memory) MEMORY="${2:-}"; shift 2 ;;
     --pids) PIDS="${2:-}"; shift 2 ;;
     --cpus) CPUS="${2:-}"; shift 2 ;;
+    --user) USER_SPEC="${2:-}"; shift 2 ;;
     --) shift; break ;;
     *) echo "sandbox-container: unknown arg $1" >&2; exit 2 ;;
   esac
@@ -38,6 +41,16 @@ done
 
 command -v docker >/dev/null 2>&1 || { echo "SANDBOX_CONTAINER_NO_DOCKER" >&2; exit 127; }
 docker info >/dev/null 2>&1 || { echo "SANDBOX_CONTAINER_DOCKER_DOWN" >&2; exit 127; }
+[[ "$USER_SPEC" =~ ^[0-9]+:[0-9]+$ ]] || { echo "SANDBOX_CONTAINER_BAD_USER" >&2; exit 2; }
+
+# A non-root process is always required. Production additionally refuses a
+# rootful Docker daemon because a compromised daemon socket defeats container
+# isolation. Local developer/test profiles may use a rootful daemon, but cannot
+# claim that configuration as a hardened production runner.
+if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_SANDBOX_REQUIRE_ROOTLESS:-0}" == "1" ]]; then
+  docker info --format '{{json .SecurityOptions}}' 2>/dev/null | grep -q 'rootless' \
+    || { echo "SANDBOX_CONTAINER_ROOTLESS_REQUIRED" >&2; exit 2; }
+fi
 
 WS_ABS="$(cd "$WORKSPACE" 2>/dev/null && pwd)" || { echo "SANDBOX_CONTAINER_BAD_WORKSPACE" >&2; exit 2; }
 
@@ -54,7 +67,7 @@ bash "$SCRIPT_DIR/tool-exec.sh" "$TIMEOUT" -- \
   docker run --rm --init --name "$CID" \
     --network=none --read-only \
     --pids-limit="$PIDS" --memory="$MEMORY" --cpus="$CPUS" \
-    --cap-drop=ALL --security-opt=no-new-privileges \
+    --user "$USER_SPEC" --cap-drop=ALL --security-opt=no-new-privileges \
     --tmpfs /tmp:rw,size=16m \
     -v "$WS_ABS":/work:rw -w /work \
     "$IMAGE" sh -c "$CMD"

packages/casan-harness/tests/phase-c6-sandbox-tests.sh

@@ -31,6 +31,7 @@ expect_nonzero() {
 
 echo "===== C6 true isolation (container) ====="
 if command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
+  chmod 777 "$WORK" # non-root container user must be able to write the explicit workspace
   expect_nonzero "network egress blocked by --network=none" \
     bash "$SB" --workspace "$WORK" -- 'wget -T 2 -q -O- http://1.1.1.1 || exit 7'
   expect_nonzero "write outside workspace blocked by --read-only rootfs" \
@@ -42,11 +43,20 @@ if command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
     bash "$SB" --workspace "$WORK" -- 'echo ok > proof.txt'
   [[ -f "$WORK/proof.txt" ]] && pass "workspace write is visible on host (bind mount)" \
     || fail "workspace write not visible on host"
+  expect_rc 0 "workload runs as a non-root UID" \
+    bash "$SB" --workspace "$WORK" -- 'test "$(id -u)" != 0'
+  if docker info --format '{{json .SecurityOptions}}' 2>/dev/null | grep -q rootless; then
+    expect_rc 0 "production mode accepts a rootless Docker daemon" \
+      env CASAN_PROFILE=prod bash "$SB" --workspace "$WORK" -- 'true'
+  else
+    expect_nonzero "production mode rejects a rootful Docker daemon" \
+      env CASAN_PROFILE=prod bash "$SB" --workspace "$WORK" -- 'true'
+  fi
   # sandbox-run.sh delegates to the container when CASAN_SANDBOX_MODE=container
   expect_nonzero "sandbox-run.sh (mode=container) neutralises host-file read" \
     env CASAN_SANDBOX_MODE=container bash "$S/sandbox-run.sh" --workspace "$WORK" -- 'cat ~/.ssh/id_rsa'
 else
-  echo "  SKIP  container isolation (Docker not available)"; PASS=$((PASS+6))
+  echo "  SKIP  container isolation (Docker not available)"; PASS=$((PASS+8))
 fi
 
 echo ""