Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5cc088b74e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| // credentials and capability sets are thread-scoped. /proc/self/status | ||
| // describes the thread-group leader, which may be a different Go runtime | ||
| // thread; verify the exact thread that will exec the application instead. | ||
| const applicationKernelStatusPath = "/proc/thread-self/status" |
There was a problem hiding this comment.
On Linux kernels before 3.17, /proc/thread-self does not exist, so every sandboxed persistent or transient workload now fails closed while reading this path instead of launching. The repository supports Linux Docker Engine without declaring a newer kernel floor, and the previous /proc/self/status path worked on these systems; use the current TID via /proc/self/task/<tid>/status as a compatibility fallback while retaining thread-local verification.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
This PR updates the startup sandbox verifier to validate Linux capability/LSM state on the specific execution thread that will exec the workload (instead of the thread-group leader), and adjusts integration-test timeouts plus a changelog fragment to reflect the behavioral fix.
Changes:
- Switch sandbox status verification from
/proc/self/statusto/proc/thread-self/statusto make checks thread-accurate. - Increase Docker integration test timeouts to reduce flakiness in slower environments.
- Add a release-note fragment describing the fix.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| internal/probe/startup_verifier.go | Reads kernel sandbox status from /proc/thread-self/status and documents the thread-scoped rationale. |
| internal/dockerdeploy/private_workload_environment_integration_test.go | Extends integration timeouts from 2m to 4m for Docker evidence runs. |
| .changes/unreleased/+thread-local-sandbox-verification.yaml | Adds a Fixed changelog fragment for thread-local sandbox verification. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| // Sandbox setup is deliberately pinned to one OS thread because Linux | ||
| // credentials and capability sets are thread-scoped. /proc/self/status | ||
| // describes the thread-group leader, which may be a different Go runtime | ||
| // thread; verify the exact thread that will exec the application instead. | ||
| const applicationKernelStatusPath = "/proc/thread-self/status" |
| // Sandbox setup is deliberately pinned to one OS thread because Linux | ||
| // credentials and capability sets are thread-scoped. /proc/self/status | ||
| // describes the thread-group leader, which may be a different Go runtime | ||
| // thread; verify the exact thread that will exec the application instead. | ||
| const applicationKernelStatusPath = "/proc/thread-self/status" |
34922f2 to
3d54e7c
Compare
0f45aee to
b900618
Compare
6beb706 to
9b32613
Compare
4e86774 to
e578958
Compare
26859f9 to
930a1d1
Compare
|
@codex review |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Stack created with Sapling. Best reviewed with ReviewStack.