fix: drop bwrap setuid, unmask /proc for bubblewrap sandbox - #4061

Merged

KATO-Hiro merged 12 commits into

Sep 20, 2026

Commits on Sep 19, 2026

fix: drop bwrap setuid, unmask /proc for bubblewrap sandbox

KATO-Hiro
and
claude
committed
40450ec
docs: consolidate bwrap setuid dev-notes into a single summary

KATO-Hiro
and
claude
committed
a3a1aff
feat: build secret-free devcontainer for Claude/Codex sandboxes

KATO-Hiro
and
claude
committed
6696b60
docs: record devcontainer security review conclusions
KATO-Hiro
committed
10cdbf9
Add devcontainer egress firewall
KATO-Hiro
committed
30b5f20
Remove obsolete devcontainer plan
KATO-Hiro
committed
f15d825
Harden devcontainer DNS and isolate Claude config
KATO-Hiro
committed
e3720d8
Remove devcontainer review verification note
KATO-Hiro
committed
4a28560
Make devcontainer firewall restart safe
KATO-Hiro
committed
19b6815
Remove firewall restart plan
KATO-Hiro
committed
74398fe

Commits on Sep 20, 2026

Narrow devcontainer firewall to required destinations

KATO-Hiro
and
claude
committed
79a0460
Remove devcontainer firewall narrowing plan

KATO-Hiro
and
claude
committed
3835c77