starred/claw-code
1
0
Fork 0
mirror of https://github.com/ultraworkers/claw-code.git synced 2026-08-24 10:05:34 -05:00
Code Issues Packages Projects Releases Wiki Activity

docs(sandbox): document newuidmap/newgidmap dependency for --map-auto fallback

Browse Source 
The fallback candidate relies on the setuid newuidmap/newgidmap helpers
(uidmap package) plus a subuid/subgid range for the current user. Note in
the candidate docs that the startup probe rejects the candidate when those
are missing, so the plain --map-root-user form is used instead.
This commit is contained in:
linkst
2026-08-01 15:21:56 +08:00
parent 277fdda894
commit 9cbe6d9a8c
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rust/crates/runtime/src/sandbox.rs
+6 -2
View File
@@ -290,8 +290,12 @@ fn command_exists(command: &str) -> bool {
/// Most systems accept `--map-root-user` alone. On kernels or containers that
/// block unprivileged writes to `/proc/self/uid_map` (e.g. GitHub Actions,
/// restricted AppArmor profiles), util-linux instead delegates to the setuid
/// `newuidmap`/`newgidmap` helpers when `--map-auto` is also present; that
/// requires the current user to have a range in `/etc/subuid`/`/etc/subgid`.
/// `newuidmap`/`newgidmap` helpers when `--map-auto` is also present.
///
/// That fallback therefore depends on the setuid helpers (the `uidmap`
/// package on Debian/Ubuntu) and on the current user having a range in
/// `/etc/subuid` and `/etc/subgid`. When either is missing, `--map-auto`
/// fails and the startup probe rejects the candidate, keeping the plain form.
const UNSHARE_MAPPING_CANDIDATES: &[&[&str]] = &[
&["--user", "--map-root-user"],
&["--user", "--map-root-user", "--map-auto"],