fix(docker): hide credentials at direct home mount in chroot mode#700
fix(docker): hide credentials at direct home mount in chroot mode#700
Conversation
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Claude
AI
changed the title
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 82.34% | 82.33% | 📉 -0.01% |
| Statements | 82.38% | 82.38% | ➡️ +0.00% |
| Functions | 82.14% | 82.14% | ➡️ +0.00% |
| Branches | 74.70% | 74.64% | 📉 -0.06% |
📁 Per-file Coverage Changes (1 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/docker-manager.ts |
83.9% → 83.8% (-0.04%) | 83.3% → 83.3% (-0.04%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
Smoke Test ResultsLast 2 Merged PRs:
Test Results:
Status: PASS
|
Go Build Test Results
Overall: PASS ✅ All Go projects built and tested successfully.
|
Bun Build Test Results
Overall: PASS ✅ All Bun projects built and tested successfully.
|
|
Smoke Test Results Last 2 merged PRs:
✅ GitHub MCP - PASS Overall: PASS 🎉
|
Node.js Build Test Results ✅All Node.js projects built and tested successfully!
Overall: ✅ PASS All dependencies installed without vulnerabilities and all test suites passed.
|
.NET Build Test Results
Overall: PASS ✅ All .NET projects successfully restored dependencies, built, and ran without errors.
|
Deno Build Test Results
Overall: ✅ PASS All Deno tests completed successfully.
|
.NET Build Test Results
Overall: PASS ✅ All .NET projects successfully restored, built, and ran with expected output.
|
Rust Build Test Results
Overall: PASS ✅ All Rust projects built and tested successfully.
|
Build Test: Java - ResultsAll Java projects compiled and tested successfully through AWF firewall with Maven proxy configuration.
Overall: PASS ✅ All Maven dependencies were successfully downloaded through the Squid proxy at
|
🔍 Chroot Version Comparison Test Results
Overall Result: ❌ FAILED - Not all runtime versions match between host and chroot environment. The chroot mode is intended to transparently access host binaries, but version mismatches indicate the container is using its own runtime installations instead of the host's.
|
|
PR titles:
|
Chroot mode is now always enabled, so the enableChroot option was removed from AwfOptions. Update Tests 8-9 to drop the obsolete flag. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
Deno Build Test Results
Overall: ✅ PASS All Deno tests passed successfully.
|
Smoke Test Results - Claude Engine✅ GitHub MCP: #767, #765 Status: PASS
|
Smoke Test ResultsLast 2 Merged PRs:
Test Results:
Overall Status: PASS ✅ cc
|
Build Test: Go - Results
Overall: PASS ✅ All Go projects successfully downloaded dependencies and passed tests.
|
Rust Build Test Results
Overall: PASS ✅ All Rust projects built and tested successfully.
|
Bun Build Test Results
Overall: PASS ✅ All Bun projects installed and tested successfully.
|
.NET Build Test ResultsAll .NET projects built and ran successfully!
Overall: PASS ✅ Project Outputshello-world: Successfully printed "Hello, World!" json-parse: Successfully parsed JSON and displayed structured data
|
Build Test: Node.js - Results
Overall: PASS ✅ All Node.js projects successfully installed dependencies and passed their test suites.
|
Java Build Test Results ✅All Java projects successfully compiled and tested through the firewall.
Overall: PASS Maven successfully downloaded dependencies and ran tests using the AWF proxy configuration at
|
Chroot Mode Runtime Version Comparison
Overall Result: ❌ Tests did not pass (1/3 runtimes matched) The chroot mode is using different versions for Python and Node.js compared to the host system. Only Go versions match.
|
|
fix: replace unanchored regex with string assertions in tests
|
3 participants
Summary
Fixes a credential-exfiltration bypass in chroot mode where the home directory is mounted at two locations (
$HOMEand/host$HOME), but credential-hiding/dev/nulloverlays were only applied to/host$HOMEpaths.else if (!config.enableChroot)condition ingenerateDockerCompose()skipped theeffectiveHome-path credential hiding when chroot was enabled, leaving the direct$HOMEmount unprotectedelseso credential hiding applies in both normal and chroot modes, covering both mount pathsTest plan
pr-titleCI check passes with new semantic title$HOMEpathnpm run buildsucceedsnpm run lintpasses🤖 Generated with Claude Code