Protect host system trees from runtime binds by omry · Pull Request #13 · omry/reploy

omry · 2026-08-03T11:33:53Z

Reject runtime host sources that resolve to the filesystem root or protected kernel system trees. Use platform-specific filesystem identity to catch aliases while preserving explicit ordinary directory binds with nested special objects.

Document the narrowed direct-bind security contract, close the corresponding backlog item, and add a security changelog fragment.

Stack created with Sapling. Best reviewed with ReviewStack.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 75d08ecf23

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-03T11:38:30Z

 }

+func protectedRuntimeHostTreeV1(hostPath string) (string, error) {
+	resolved, err := filepath.EvalSymlinks(hostPath)


Make protected-source validation race-free

When another process can rename or retarget a configured source symlink, it can change the link from an ordinary path to /, /proc, /dev, or /sys after EvalSymlinks returns but before Docker resolves the original source.HostPath. The validation therefore approves one object while command_execution.go later passes a different, mutable pathname to Docker, bypassing the protection this change adds; preserve and launch from a stable resolved object or otherwise prevent source replacement through container creation.

Useful? React with 👍 / 👎.

Copilot

Pull request overview

This PR hardens runtime host bind validation by rejecting host sources that resolve to the host filesystem root or protected kernel system trees/filesystems, including symlink and filesystem-identity aliases, and updates the design docs/backlog plus adds a security changelog fragment.

Changes:

Add host bind preflight rejection for filesystem-root binds and protected system trees (/proc, /dev, /sys) including symlink aliases.
Add platform-specific filesystem identity detection (Linux/macOS) to reject protected kernel filesystems even when mounted elsewhere.
Update controlled-session design documentation/backlog and add a Security changelog fragment.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
internal/dockerdeploy/runtime_host_preflight.go	Adds protected-host-tree/filesystem detection to runtime host source validation.
internal/dockerdeploy/runtime_host_preflight_test.go	Adds cross-platform tests for rejecting protected host trees and aliases.
internal/dockerdeploy/runtime_host_preflight_unix_test.go	Adds Unix-only test ensuring explicit directory binds with nested special objects remain allowed.
internal/dockerdeploy/runtime_host_filesystem_linux.go	Implements Linux filesystem identity checks (statfs + mountinfo/statx) for protected kernel filesystems.
internal/dockerdeploy/runtime_host_filesystem_linux_test.go	Adds Linux tests for kernel filesystem detection and tmpfs/devtmpfs distinction behavior.
internal/dockerdeploy/runtime_host_filesystem_darwin.go	Implements macOS filesystem identity checks for devfs/procfs.
internal/dockerdeploy/runtime_host_filesystem_other.go	Provides no-op implementation for non-Linux/non-macOS platforms.
docs/CONTROLLED_SESSION_DESIGN.md	Documents narrowed direct-bind security contract and updated root-runtime messaging.
docs/BACKLOG.md	Updates backlog items reflecting completed/shifted security work and future network gateway work.
.changes/unreleased/+protect-host-system-trees.yaml	Adds a Security changelog fragment describing the new bind rejections.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+			return fmt.Errorf(
+				"runtime plan %q mount %q host source resolves to protected host system source %q; ordinary host binds cannot expose the host filesystem root, /proc, /dev, or /sys",
+				planID, mount.Destination, protected,
+			)


omry · 2026-08-06T04:13:50Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2083678b49

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-06T04:17:55Z

+	switch strings.ToLower(scheme) {
+	case "unix", "npipe":
+		return true


Verify the daemon namespace, not just the socket scheme

When Reploy runs in a container with the host Docker socket mounted, or connects through a Unix-socket proxy, this branch accepts the endpoint even though the daemon can use a different mount namespace or machine. Docker resolves bind sources in the daemon namespace while ValidateRuntimeHostSourcesV1 inspected Reploy's namespace, so a path that is benign locally can resolve to /, /proc, /dev, or /sys for the daemon and bypass the new guard. Fresh evidence beyond the earlier remote-endpoint finding is that the newly added check classifies every Unix socket as local; require proof that the daemon shares the validated namespace or reject configurations where that cannot be established.

Useful? React with 👍 / 👎.

omry · 2026-08-06T05:39:55Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2e10d22577

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-06T05:46:09Z

+		if length == bestLength && identity != best {
+			return runtimeHostMountIdentityV1{}, fmt.Errorf("host path %q has ambiguous mountinfo identity", path)
+		}


Resolve the visible mount when mount points are stacked

On Linux kernels that do not expose STATX_MNT_ID, a valid overmount leaves multiple mountinfo records with the same mount point, and this fallback treats those records as ambiguous instead of selecting the currently visible topmost mount. Consequently, any ordinary host bind at or below that mount point fails validation on older kernels. Unlike the earlier missing-mount-ID issue, the new path-based fallback now reaches this error; resolve the visible mount through the mount topology rather than rejecting equal-length matches.

Useful? React with 👍 / 👎.

omry · 2026-08-06T05:57:31Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 617a789293

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-06T06:01:57Z

+	if defaultDockerEndpointCheckV1.checked {
+		return nil


Revalidate the endpoint before later Docker commands

When the active Docker context changes after the first successful executeDockerOutput call—for example, another command runs docker context use remote while the Reploy process remains active—this process-wide checked flag skips all subsequent endpoint inspection even though each Docker CLI invocation rereads the active context. Later image probes, builds, or cleanup commands can therefore run against the newly selected remote daemon despite the new remote-endpoint prohibition; either pin the verified endpoint for every command or revalidate it before execution.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-08-06T06:01:57Z

+		if !pathWithinV1(identity.mountPoint, protectedTree) || identity.device != candidate.device {
+			continue
+		}
+		if pathWithinV1(effective, identity.root) || pathWithinV1(identity.root, effective) {
+			return true, nil


Ignore hidden mounts when matching protected trees

When a bind below /proc, /dev, or /sys is subsequently hidden by an overmount at the same location, /proc/self/mountinfo retains both records, but this loop treats the hidden record as still exposing its backing path through the protected tree. For example, if /secret was bound at /dev/x and /dev/x is then overmounted with another filesystem, an ordinary source of /secret is still rejected even though the only visible /dev/x mount is unrelated; filter these records through the visible-mount topology before testing backing-path overlap.

Useful? React with 👍 / 👎.

omry · 2026-08-06T06:08:02Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7b94f4d1ab

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-06T06:13:20Z

+	if err := requireLocalDockerEndpointV1(ctx, spec, timeout); err != nil {
+		return err


Validate endpoints for bypassed Docker runners

When the installed system service starts, its actual compose up is passed to runCommandWithoutDockerPreflight from installed_service_container.go:101-108, so this endpoint check is never applied to the container-creation command. If the active context changes after the earlier image-reference probe, that command can target a remote daemon after host sources were validated locally, recreating the namespace mismatch this restriction is intended to prevent. Fresh evidence beyond the earlier cached-check finding is that removing the cache still leaves this independent command path bypassing endpoint validation entirely.

Useful? React with 👍 / 👎.

omry · 2026-08-06T06:18:58Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bff9ea2245

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-06T06:22:44Z

 		environment,
 		options,
-		runCommandWithoutDockerPreflight,
+		runCommand,


Preflight absolute Docker paths before service launch

When the installed system service starts with a remote active Docker context, this replacement still bypasses endpoint validation: RunInstalledServiceContainerV1 requires dockerPath to be absolute, while runCommand invokes dockerPreflight only when spec.Name == "docker". The compose up therefore runs against the remote daemon after host sources were validated locally. Fresh evidence beyond the earlier bypass comment is that switching the runner to runCommand does not activate its preflight for the absolute executable path used here; either recognize the configured Docker executable or call endpoint validation explicitly.

Useful? React with 👍 / 👎.

omry · 2026-08-06T06:27:33Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9249110975

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-06T06:32:57Z

+	if kind := protectedRuntimeHostFilesystemKindV1(filesystemMagic); kind != "" {
+		return kind, nil
+	}
+	protectedMount, err := runtimeHostSharesProtectedMountV1(path)


Reject bind sources containing protected submounts

When an otherwise ordinary source such as /safe contains a visible bind mount like /safe/root -> / or /safe/proc -> /proc, this check examines only /safe itself and runtimeHostSharesProtectedMountV1 only correlates mounts located beneath /proc, /dev, or /sys. The runtime renderers do not disable recursive bind behavior (execution_render.go:130-142 and command_execution.go:240-252), and Docker documents that bind mounts are recursive by default, so the protected nested mount is included in the container. Fresh evidence beyond the earlier exact-alias findings is that selecting the alias's parent still exposes the entire protected tree; inspect visible submounts below the selected source and reject any whose effective backing path exposes root or a protected tree.

Useful? React with 👍 / 👎.

omry · 2026-08-06T06:42:38Z

@codex review

chatgpt-codex-connector

💡 Codex Review

reploy/internal/dockerdeploy/compose.go

Lines 64 to 66 in 4fc7f60

    
           // runCommandWithoutDockerPreflight is for follow-up commands in one 
        
           // higher-level Docker operation whose first command already passed preflight. 
        
           // Callers must not use it as the entry point to an independent operation.

Route provider-install starts through endpoint preflight

For Docker-managed and Docker Desktop installs, provider_install_host_commands.go:38-49 builds an independent compose up command using the absolute Docker path, but provider_install_host_execute.go:41-54 still invokes it through this bypass runner. If the active context is remote, or changes after an earlier build probe, installation therefore creates the workload on that daemon while its host paths were validated locally, contrary to the new remote-endpoint restriction in docs/CONTROLLED_SESSION_DESIGN.md:691-698. Fresh evidence beyond the earlier installed-service comments is that this separate provider-install startup path remains unchecked; pass it through runDockerCommand.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-06T06:51:08Z

+		return false, err
+	}
+	current := string(filepath.Separator)
+	for _, component := range strings.Split(strings.TrimPrefix(filepath.Clean(absolute), current), current) {


Inspect symlinks before collapsing parent components

On Linux kernels without openat2, a source such as /safe/jump/.. where jump -> /proc/self/cwd is cleaned to /safe here before Lstat, so the fallback never notices the symlink. EvalSymlinks can then resolve the magic link relative to Reploy's benign working directory, while Docker receives the original path and can resolve it relative to the daemon (commonly exposing /), bypassing the protected-tree check and the documented fail-closed behavior for symlinked sources on older kernels. Walk the original components without lexically eliminating .., or reject such components in this fallback.

Useful? React with 👍 / 👎.

omry · 2026-08-06T06:54:36Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4fc7f6076f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-06T07:01:10Z

+	if dev.Dev == root.Dev {
+		return false, nil


Reject aliases of static rootfs-backed /dev

When /dev is a static directory on the root filesystem and is bind-mounted at an alias such as /safe/dev, this early return disables the device-filesystem comparison. EvalSymlinks cannot collapse the bind alias, Statfs reports the ordinary root filesystem, and mountinfo contains no canonical /dev mount identity to match, so validation accepts the alias and Docker exposes the host device nodes. Fresh evidence beyond the earlier tmpfs-backed /dev report is that the new same-device branch explicitly opts out on rootfs-backed /dev; compare the candidate's effective backing path with /dev even in this configuration.

Useful? React with 👍 / 👎.

Reject runtime host sources that resolve to the filesystem root or protected kernel system trees. Use platform-specific filesystem and mount topology identity to catch direct, aliased, and nested kernel-control filesystems while preserving explicit ordinary directory binds with nested application objects. Reject unsupported remote Docker endpoints before runtime and recovered-container operations, including admission cleanup paths. Document the narrowed direct-bind security contract, close the corresponding backlog item, and add a security changelog fragment.

omry · 2026-08-06T19:58:07Z

@codex review

Please review the exact current head 3cb1e885c476b819a150ebb7bbe32fdad78d36ec, including the amended remote-Docker preflight and protected kernel-filesystem enforcement.

chatgpt-codex-connector · 2026-08-06T20:03:11Z

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: 3cb1e885c4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

omry marked this pull request as ready for review August 3, 2026 11:35

Copilot AI review requested due to automatic review settings August 3, 2026 11:35

chatgpt-codex-connector Bot reviewed Aug 3, 2026

View reviewed changes

Copilot started reviewing on behalf of omry August 3, 2026 11:38 View session

Copilot AI reviewed Aug 3, 2026

View reviewed changes

This was referenced Aug 3, 2026

Run application sandbox integration in CI #20

Open

Preserve base identity in direct installs #21

Open

Verify sandbox state on the execution thread #22

Open

omry force-pushed the pr13 branch from 75d08ec to 3ac6dd6 Compare August 3, 2026 16:42

omry force-pushed the pr13 branch from 3ac6dd6 to ee8c018 Compare August 3, 2026 18:18

omry force-pushed the pr13 branch from ee8c018 to ba7fab0 Compare August 3, 2026 19:26

omry force-pushed the pr13 branch 2 times, most recently from 690e66b to bbcaeea Compare August 3, 2026 21:35

omry force-pushed the pr13 branch from 2778615 to 2083678 Compare August 6, 2026 04:13

chatgpt-codex-connector Bot reviewed Aug 6, 2026

View reviewed changes

omry force-pushed the pr13 branch from 2083678 to 2e10d22 Compare August 6, 2026 05:39

chatgpt-codex-connector Bot reviewed Aug 6, 2026

View reviewed changes

omry force-pushed the pr13 branch from 2e10d22 to 617a789 Compare August 6, 2026 05:57

chatgpt-codex-connector Bot reviewed Aug 6, 2026

View reviewed changes

omry force-pushed the pr13 branch from 617a789 to 7b94f4d Compare August 6, 2026 06:07

chatgpt-codex-connector Bot reviewed Aug 6, 2026

View reviewed changes

omry force-pushed the pr13 branch from 7b94f4d to bff9ea2 Compare August 6, 2026 06:18

chatgpt-codex-connector Bot reviewed Aug 6, 2026

View reviewed changes

omry force-pushed the pr13 branch from bff9ea2 to 9249110 Compare August 6, 2026 06:27

chatgpt-codex-connector Bot reviewed Aug 6, 2026

View reviewed changes

omry force-pushed the pr13 branch from 9249110 to 4fc7f60 Compare August 6, 2026 06:42

chatgpt-codex-connector Bot reviewed Aug 6, 2026

View reviewed changes

omry force-pushed the pr13 branch from 4fc7f60 to 3cb1e88 Compare August 6, 2026 19:57

omry added the approved PR reviewed and approved label Aug 6, 2026 — with ChatGPT Codex Connector

This was referenced Aug 8, 2026

Enforce controlled-session output finalization #23

Open

Add bounded controlled-session PTY draining #24

Open

		if err := requireLocalDockerEndpointV1(ctx, spec, timeout); err != nil {
		return err

	// runCommandWithoutDockerPreflight is for follow-up commands in one
	// higher-level Docker operation whose first command already passed preflight.
	// Callers must not use it as the entry point to an independent operation.

Conversation

omry commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

omry commented Aug 6, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

omry commented Aug 6, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

omry commented Aug 6, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

omry commented Aug 6, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

omry commented Aug 6, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

omry commented Aug 6, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 6, 2026

Choose a reason for hiding this comment

Uh oh!

omry commented Aug 6, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 6, 2026

omry commented Aug 3, 2026 •

edited

Loading