Repository navigation
feat(execd): execd as sandbox init with hardening floor (OSEP-0018) - #1474
Conversation
Make execd the sandbox init (PID 1): it becomes the parent of the user entrypoint, reaps every child through a single reaper, forwards application signals, and owns the container lifecycle (entrypoint exit code is propagated to the runtime). - --init flag + EXECD_INIT bootstrap.sh exec branch (default off, classic background-and-wait topology unchanged) - single reaper (only wait4-family caller) with pre-reap WNOWAIT barrier; managedProcess abstraction replaces Cmd.Wait across all launch paths (command, bash session, PTY, isolated session) - signal forwarding (HUP/USR1/USR2/WINCH) and SIGTERM graceful shutdown; subreaper fallback when not PID 1; PR_SET_DUMPABLE(0) - hardening.init_mode/signal_shield reported on the capabilities endpoint (spec + Go/Python SDKs aligned) - unit tests for the reaper and lifecycle; bootstrap contract test
Route every user-code launch (entrypoint, /command, /code, PTY) through a native launcher that applies the privilege floor between fork and exec: execd credential env stripped, bounding set trimmed to keep_capabilities (default none), no_new_privs, identity drop to the image user, ambient caps raised, and the seccomp filter installed last. - native/launcher.c: static prelude helper, fail-closed on malformed policy, fail-open per step; built/installed by the Makefile and image - [hardening] enabled + keep_capabilities in the isolation TOML; the launcher's execve is reserved and rejected at config time (execveat stays valid); [seccomp] deny is reused as the floor filter - isolated sessions exempt: the bwrap workload is already reduced inside the namespace, and flooring the bwrap process would deny unshare and strip the caps it needs to build the namespace - hardening.cap_drop/seccomp/landlock/ebpf layer states on the capabilities endpoint (spec + Go/Python SDKs aligned) - all layers fail open: missing launcher or CAP_SETPCAP degrades with a reason instead of blocking startup
Single server-side switch (default false) that sets EXECD_INIT=1 in the sandbox environment across all paths (Docker, K8s Batch/Agent, Pool taskTemplate). bootstrap.sh then execs execd --init, so topology and the --init flag stay in lockstep by construction (OSEP-0018 open question 1). Execd init mode and hardening remain independently controllable; the switch is intended to be flipped on by default in a later release.
Runs the execd image with EXECD_INIT=1 in Docker and verifies the init contract end to end: execd is PID 1 with the workload as its direct child, orphans are reaped (no zombie accumulation), in-namespace kill -9 1 is inert (signal shield), entrypoint exit codes are propagated, runtime SIGTERM is forwarded with the workload status preserved, and with [hardening] enabled the floor applies (CapEff=0, no_new_privs, seccomp filter, env strip) while the capabilities endpoint reports pid1 + active layers. Also covers the Pool-style backgrounded topology reporting subreaper mode. Wired into execd-test.yml (ubuntu smoke job); EXECD_TEST_IMAGE allows local iteration against a prebuilt image.
Add [landlock] enabled/extra_writable/extra_readable on top of the hardening floor. The launcher applies the filesystem allowlist between the identity drop and seccomp: system paths and /proc/self read+exec, writable device files and the controlling tty, /tmp, /run, and allowed_writable — everything else denied. A root EXECUTE-only rule covers traversal and execve of any binary without granting reads, and all of /proc is never granted (would re-expose /proc/1). The kernel ABI is probed (v1-v4) and the launcher trims access bits (REFER/TRUNCATE) accordingly; ABI < 1 reports unsupported and skips. The container regression now enables landlock and asserts that /proc/1/environ is unreadable by the workload when the layer is active.
Opt-in exec/connect/privilege audit, scoped to the sandbox cgroup and written as rotating JSONL (stable envelope: ts/event/sandbox_id/pid/comm plus per-kind fields). Ships as the execd-ebpf build variant (CGO + cilium/ebpf); the default image is unchanged and reports disabled. - BPF programs (CO-RE): sched_process_exec (filename+argv via __data_loc), inet_sock_set_state (dst ip:port), commit_creds kprobe (uid/gid deltas, cap_added) - kernel compatibility from 5.10: the exec trace event layout change in 5.16 is handled with a bpf_core_field_exists discriminator, the kernel_cap_t shape change in 6.3 with a layout-agnostic 8-byte read; Landlock (phase 3) still requires >= 5.13 and degrades to unsupported - [ebpf] enabled/observe/audit_file config; capabilities endpoint layer state (active/unsupported/degraded/disabled), all fail-open - Dockerfile ebpf target + make build-ebpf; generated bytecode committed; unit tests for event decoding; CI runs the ebpf-tagged tests
github-actions
Bot
added
component/execd
component/k8s
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 40aac69149
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Single commit addressing every failing check on PR opensandbox-group#1474: - Dockerfile: the execd-ebpf stage was the last FROM, making the ebpf variant the default image (missing /execd, bootstrap). Move the ebpf stages before the final default-image stage so the main image is unchanged. - license: add the Apache header to the bpf2go-generated files (verify-license). - golangci-lint: gci import grouping in initmode_linux/hardening_linux, rename effectiveCapsHave's 'cap' param (predeclared), nolint the test-only reaper stop/quitOnce, and nolint:gocognit on ptyViewerClientReadLoop (pre-existing main failure, not part of this work). - kotlin: move parameter comments to their own lines (ktlint discouraged-comment-location) and apply spotless formatting; the SDK CI failure was downstream of the kotlin job. C#/JS E2E docker-bridge failures are still under investigation.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1a530afd90
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bc9f081a67
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c8d228a722
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
…16 items) execd runtime: - reaper: drop reaped pids from the owned map (unbounded growth + stale process-group signalling after PID reuse) - hardening: prefer the trusted /opt/opensandbox launcher over PATH; launcher-policy memfd is MFD_CLOEXEC and closed after Start - landlock: expand rules onto each mount point beneath a grant (bind mounts were invisible to path_beneath rules) - launcher: capability ABI v3 keeps caps > 31 (two 32-bit words) eBPF observation: - populate sandbox_id in every JSONL record (was always empty) - resolve the cgroup id under the cgroup v2 mount (was stat-ing a container-root-relative path) - requested hooks that fail to attach now degrade instead of active - connect events store IPv4 as ::ffff:a.b.c.d so the decoder formats dotted IPv4 - privilege events emit on capability-only changes too - stub reports unsupported when [ebpf] enabled in the default build distribution: - docker/k8s distribute opensandbox-launcher (/usr/local/libexec source that is not shadowed by the k8s shared volume) - pool taskTemplate: include execd_run_as_init in needs_task_template and exec bootstrap so the shim's TERM trap targets execd - Dockerfile: main image ships the launcher under /usr/local/libexec; the ebpf target builds static (CGO_ENABLED=0, cilium/ebpf is pure Go) and keeps the default image layout (/execd, bootstrap, helpers) so it can be used as runtime.execd_image SDKs: - python/javascript handwritten IsolatedCapabilities gain the hardening object (HardeningStatus/HardeningLayerState)
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f29d5b447c
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 29fa1598cb
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fe54248265
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5cd04c8209
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Regenerate the JS execd client from the spec and extend the handwritten adapters so every SDK exposes the hardening object (init_mode, signal_shield, cap_drop/seccomp/landlock/ebpf layer states): - javascript: generated execd.ts gains hardening + HardeningLayerState - kotlin: IsolatedCapabilities.hardening domain model + adapter mapping (with a mock-server test) — the generated sandbox-api client picks the spec up at build time - csharp: IsolatedCapabilities gains Hardening/HardeningStatus/ HardeningLayerState records Go and Python already carried the field; MCP and code-interpreter SDKs do not consume the capabilities endpoint.
…ase 5) With runtime.execd_run_as_init enabled, the pool taskTemplate no longer backgrounds bootstrap: the task-executor shim's shell execs bootstrap.sh, which execs `execd --init` (EXECD_INIT=1), so execd becomes the root of the task process tree — orphaned task children are reaped (subreaper) and the entrypoint exit code propagates to the task status. Classic background-and-wait topology is preserved when the switch is off. The K8s Restart recycle contract (kill 1 via pod exec) is confirmed compatible with init-mode execd under the current SIGTERM-forward semantics: execd forwards the signal and exits with the workload status, so the kubelet restarts the container. A note marks the reconciliation required once a trusted out-of-band stop channel replaces signal-driven stop (OSEP-0018 §3). Docs: Pool pod template guidance for running execd as the pod's PID 1.
Record the phased implementation state (phases 1-5 + server switch done), the resolutions of open questions 1-5, and the remaining work (trusted stop channel, Pool pod-level PID 1, 5.10 validation, e2e).
Squashed review-fix series: - CI: Dockerfile stage order (ebpf variant was the default image), license headers on bpf2go output, verify-license skip for generated files, golangci (gci/predeclared/unused), kotlin ktlint - landlock: required-vs-best-effort rule semantics, mount-expanded rules (bind-mounted workspaces), dynamic rule counts, preflight degradation for operator-explicit grants, per-launch fail-closed ruleset - hardening: trusted launcher path first, MFD_CLOEXEC policy memfd, per-request uid/gid folded into the policy, entrypoint keeps bootstrap env but never EXECD_ACCESS_TOKEN, bash-session env snapshot scrub - init: reaper drops reaped pids (bounded map, no stale pgid signalling), SIGTERM/SIGKILL sent under the reaper lock, synchronous signal.Notify before the entrypoint starts - eBPF: sandbox_id in records, cgroup-id under the cgroup v2 mount, requested-hook attach failures degrade, IPv4-mapped event format, cap-only privilege events, argv dropped from exec events - distribution: launcher shipped on docker/k8s paths, pool taskTemplate exec + needs_task_template fix, ebpf image keeps the default layout and builds static - container regression: workdir world-writable (no CAP_DAC_OVERRIDE under hardening), /proc/self read via the entrypoint process (Landlock descendant limitation)
5cd04c8 to
dc1f48f
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dc1f48fb19
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
…ndbox_id) - hardening: per-request credentials now force the launcher's UID_DROP even when execd is not root (a /command uid/gid request previously ran as the image user), and supplementary groups are serialized into the policy so the launcher applies setgroups(groups) instead of clearing them - audit: loaded eBPF objects are retained on the Observer (GC could close the fd and detach the programs) and closed on Close(); ringbuf reader failure now also closes already-attached links; audit write errors are logged instead of dropped - landlock: /opt joins the default read+exec set (bundled code-interpreter entrypoints and runtimes live under /opt) - server: OPENSANDBOX_ID is injected on the Docker, K8s Batch/Agent and pool taskTemplate env paths so eBPF audit records carry the sandbox id
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fa7a494a7a
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Add tests/python/tests/test_execd_init_e2e.py (sync SDK): PID 1 is execd, the workload is its direct child, orphans are reaped, in-namespace kill -9 1 is inert, and /v1/isolated/capabilities reports hardening.init_mode=pid1. Runs against a server with runtime.execd_run_as_init=true. - scripts/python-execd-init-e2e.sh: docker-bridge runner for the new suite; wired as a dedicated real-e2e job (python-execd-init-e2e) - scripts/python-k8s-execd-init-e2e.sh + E2E_EXECD_RUN_AS_INIT in k8s_e2e_write_server_helm_values: Kind/Kubernetes variant; wired as a dedicated kubernetes-nightly-build job (execd-init-e2e)
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d5ac089ade
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b88cd974c7
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: be2dc8a4a2
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
…port, launcher identity, ebpf build tags)
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8ae0b49652
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cba75bca94
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
…sandbox id attribution - ReportHardening keys the non-init topology correction off hardening being enabled instead of cap_drop's state, and only degrades layers that are actually in effect (previously a degraded cap_drop left seccomp/landlock claiming active, and a disabled landlock could be marked degraded) - eBPF Init reports unsupported when OPENSANDBOX_ID is missing, so pool fast-path allocations without a task template cannot silently claim active attribution - batchsandbox_provider logs the pool fast-path limitation (no per-allocation env injection without a task template) - docs/components/execd.md documents the pool path attribution behavior - tests: cover non-init degradation, landlock enabled case, and pool fast path
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0d465854f4
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
…lint goconst - non-Linux: InitHardening/SetEbpfState now record requested layers so the capabilities endpoint reports configured hardening/landlock/ebpf as unsupported instead of disabled (codex review) - hardening_linux.go: hoist repeated "disabled" state string into a const (golangci-lint goconst) - docs: describe the dual-binary default image (execd + execd-ebpf) and the deferred server-side selection; no Dockerfile 'ebpf' target exists
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1f6d23c98b
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
3 participants
Summary
Implements OSEP-0018 "execd as Sandbox Init" — execd becomes the sandbox init (PID 1) and the privilege authorizer for all user code. 10 commits covering phases 1–5:
Cmd.Waiton every launch path (command/bash/PTY/isolated session), signal forwarding (TERM/HUP/USR1/USR2/WINCH), entrypoint-owned container lifecycle (exit-code propagation), subreaper fallback for the Pool path,bootstrap.shEXECD_INITexec branch (default off, classic topology unchanged).opensandbox-launchernative helper applies env strip → KEEPCAPS → bounding-set trim → no_new_privs → identity drop → ambient caps → seccomp (last) → execve;[hardening] enabled/keep_capabilities;[seccomp] denyreused withexecvereserved; everything fail-open and reported on the capabilities endpoint.[landlock] enabledfilesystem allowlist (system paths +/proc/self+ device files + writable dirs), ABI probe with bit trimming; ABI < 1 →unsupported(fail-open).execd-ebpfvariant (CGO + cilium/ebpf): exec/connect/privilege hooks (CO-RE), sandbox-cgroup scoped, rotating JSONL audit; kernel ≥5.10 with BTF; default image unchanged.runtime.execd_run_as_initinjectsEXECD_INIT=1across Docker/K8s Batch/Agent/Pool; Pool taskTemplate runs execd as the task root (reaping + exit-code propagation);kill 1recycle contract confirmed compatible.Contract:
GET /v1/isolated/capabilitiesgains ahardeningobject (init_mode/signal_shield + cap_drop/seccomp/landlock/ebpf layer states); spec, Go/Python/JS/Kotlin/C# SDKs aligned; docs updated.Tests: unit tests for the reaper/lifecycle/hardening/landlock; ebpf event-decode tests; real-container regression (
tests/init_container.sh: PID 1 handoff, zombie reaping,kill -9 1inert, exit-code propagation, SIGTERM graceful shutdown, hardening floor, landlock/proc/1/environdenial, subreaper) wired into the execd CI.Kernel compatibility
unsupportedand skips (fail-open)CONFIG_DEBUG_INFO_BTF; the 5.16 trace-event layout change and the 6.3kernel_cap_tchange are handled via CO-RE discriminatorsKnown limitations (tracked)
kill 1(SIGTERM) still stops the sandbox — same as pre-OSEP bootstrap behavior; the trusted out-of-band stop channel (OSEP §3) is follow-up work