bbs.profullstack/agentbbs
1
0
Fork 0
mirror of https://github.com/profullstack/agentbbs.git synced 2026-08-13 22:37:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

refactor(pods): drop redundant tuneApt apt-sandbox hack (#31)

Browse source 
The rootless-podman default capability set (already on main) lets apt drop
to the _apt user on its own, so disabling the apt download sandbox via
tuneApt is dead code. Removing it; apt now works the proper way.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Anthony Ettinger 2026-06-15 08:23:54 -07:00 • committed by GitHub
parent e0a267e343
commit 337011fa03
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 0 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

20
internal/pods/pods.go
View file

@ -135,7 +135,6 @@ func (m *Manager) ensure(user string) (string, error) {
_ = exec.Command(m.engine, "rm", "-f", name).Run() // fall through to recreate with the bind _ = exec.Command(m.engine, "rm", "-f", name).Run() // fall through to recreate with the bind
} else { } else {
_ = exec.Command(m.engine, "start", name).Run() // no-op if running _ = exec.Command(m.engine, "start", name).Run() // no-op if running
m.tuneApt(name)
return name, nil return name, nil
} }
} }
@ -178,28 +177,9 @@ func (m *Manager) ensure(user string) (string, error) {
if err != nil { if err != nil {
return "", fmt.Errorf("pods: create failed: %v: %s", err, strings.TrimSpace(string(out))) return "", fmt.Errorf("pods: create failed: %v: %s", err, strings.TrimSpace(string(out)))
} }
m.tuneApt(name)
return name, nil return name, nil
} }
// tuneApt makes apt usable inside the hardened pod. apt drops privileges to
// the _apt user for downloads (setgroups/setegid/seteuid), which needs
// CAP_SETUID/CAP_SETGID/CAP_CHOWN — caps we intentionally drop (cap-drop ALL).
// Rather than re-grant those to the whole container, disable apt's download
// sandbox so package management runs as the pod's (rootless-mapped) root.
//
// Only applies to the podman/container-root path; under docker the pod runs as
// uid 1000 and can't write /etc/apt (apt isn't usable there by design). Failure
// is non-fatal: a missing config just means the user sees the old apt errors.
func (m *Manager) tuneApt(name string) {
if m.engine == "docker" {
return
}
_ = exec.Command(m.engine, "exec", "--user", "root", name,
"sh", "-c", `printf 'APT::Sandbox::User "root";\n' > /etc/apt/apt.conf.d/00no-sandbox`,
).Run()
}
// Attach provisions the pod and wires the SSH session to a shell inside it. // Attach provisions the pod and wires the SSH session to a shell inside it.
// Blocks until the shell exits or the session closes. // Blocks until the shell exits or the session closes.
func (m *Manager) Attach(s ssh.Session, user string) error { func (m *Manager) Attach(s ssh.Session, user string) error {