T8 — Seal a none box, vsock included, and keep attach working by minimal-foundry[bot] · Pull Request #1692 · gominimal/minimal

feat(sandbox2): install a socket-family seccomp filter for none boxes

minimal-foundry[bot]

committed

a58a6d6

test(minimald): prove --network none refuses outside sockets and still accepts attach

minimal-foundry[bot]

committed

6d0a096

Merge remote-tracking branch 'origin/main' into agent/1615-seal-a-none-box-vsock-included-and-keep-attach-w

minimal-foundry[bot]

committed

af00595

Merge remote-tracking branch 'origin/main' into agent/1615-seal-a-none-box-vsock-included-and-keep-attach-w

minimal-foundry[bot]

committed

9bea2e9

Merge remote-tracking branch 'origin/main' into agent/1615-seal-a-none-box-vsock-included-and-keep-attach-w

minimal-foundry[bot]

committed

c3e366d

feat(sandbox2,minimald): libc-only seccomp filter for none boxes and injection sealing

minimal-foundry[bot]

committed

776159c

Merge remote-tracking branch 'origin/main' into agent/1615-seal-a-none-box-vsock-included-and-keep-attach-w

minimal-foundry[bot]

committed

850575f

fix(minimald): do not ignore netns none-box root integration tests

minimal-foundry[bot]

committed

c9ad5f7

chore: drop the committed gvproxy binary and gitignore it

norrietaylor

committed

16c9db5

fix(sandbox2): keep MountFallback CS-only on the container chain

norrietaylor

committed

c09fd7f

fix(sandbox2): drop the non-linux socket-filter stubs

norrietaylor

committed

e06a699

fix(sandbox2): kill foreign-ABI and x32 callers in the none-box filter

norrietaylor

committed

4b54416

fix(sandbox2): keep cwd and env across the none-box seccomp closure swap

norrietaylor

committed

36c61aa

refactor(sandbox2): drop dead filter fields and evaluate the none-box program in its test

norrietaylor

committed

85feef0

fix(minimald): resolve the none-box filter before the shim forks

norrietaylor

committed

46b72e4

fix(sandbox2): build the none-box filter prologue with vec! for clippy

norrietaylor

committed

be54b0c

fix(sandbox2): seal only a none plan, not an own-ip plan whose tap arrives later

norrietaylor

committed

ab85458

fix(minimald): seal none-box hook injections like interactive ones

minimal-foundry[bot]

committed

db6baa7

test(sandbox2): prove the none-box filter against the live kernel

minimal-foundry[bot]

committed

6dc73f3

test(minimald): pin the none-box proof to the NoNet provider plan

minimal-foundry[bot]

committed

67909ec

docs(sandbox2): say the none-box filter is process-wide, not leaked

minimal-foundry[bot]

committed

05e3919

test(minimald): pin the none-box launch path, fail a gcc-less host

minimal-foundry[bot]

committed

2e51594

Merge remote-tracking branch 'origin/main' into agent/1615-seal-a-none-box-vsock-included-and-keep-attach-w

minimal-foundry[bot]

committed

cba3765

Navigation Menu

Repository navigation

T8 — Seal a none box, vsock included, and keep attach working - #1692

T8 — Seal a none box, vsock included, and keep attach working#1692
norrietaylor merged 23 commits into
mainfrom
agent/1615-seal-a-none-box-vsock-included-and-keep-attach-w

Commits on Sep 25, 2026

feat(sandbox2): install a socket-family seccomp filter for none boxes

test(minimald): prove --network none refuses outside sockets and still accepts attach

Merge remote-tracking branch 'origin/main' into agent/1615-seal-a-none-box-vsock-included-and-keep-attach-w

Merge remote-tracking branch 'origin/main' into agent/1615-seal-a-none-box-vsock-included-and-keep-attach-w

Merge remote-tracking branch 'origin/main' into agent/1615-seal-a-none-box-vsock-included-and-keep-attach-w

feat(sandbox2,minimald): libc-only seccomp filter for none boxes and injection sealing

Merge remote-tracking branch 'origin/main' into agent/1615-seal-a-none-box-vsock-included-and-keep-attach-w

fix(minimald): do not ignore netns none-box root integration tests

chore: drop the committed gvproxy binary and gitignore it

fix(sandbox2): keep MountFallback CS-only on the container chain

fix(sandbox2): drop the non-linux socket-filter stubs

fix(sandbox2): kill foreign-ABI and x32 callers in the none-box filter

fix(sandbox2): keep cwd and env across the none-box seccomp closure swap

refactor(sandbox2): drop dead filter fields and evaluate the none-box program in its test

fix(minimald): resolve the none-box filter before the shim forks

fix(sandbox2): build the none-box filter prologue with vec! for clippy

fix(sandbox2): seal only a none plan, not an own-ip plan whose tap arrives later

fix(minimald): seal none-box hook injections like interactive ones

test(sandbox2): prove the none-box filter against the live kernel

test(minimald): pin the none-box proof to the NoNet provider plan

docs(sandbox2): say the none-box filter is process-wide, not leaked

test(minimald): pin the none-box launch path, fail a gcc-less host

Merge remote-tracking branch 'origin/main' into agent/1615-seal-a-none-box-vsock-included-and-keep-attach-w