update restricted shell to force (–no-kill) option.

Dockerfile

@@ -134,6 +134,11 @@ RUN id -u socktop &>/dev/null || useradd -m -s /bin/bash socktop && \
     mkdir -p /home/socktop/.config/socktop && \
     chown -R socktop:socktop /home/socktop
 
+# Unprivileged user that per-session shells run as (see docker/session-shell.sh).
+# Separate from socktop so a session cannot signal the server, the agent, or
+# anything else that matters — the kernel refuses cross-UID signals.
+RUN useradd -m -s /usr/sbin/nologin demo
+
 # Set working directory
 WORKDIR /app
 
@@ -155,7 +160,8 @@ COPY --from=node-builder /build/node_modules ./node_modules
 COPY docker/entrypoint.sh /entrypoint.sh
 COPY docker/init-config.sh /init-config.sh
 COPY docker/restricted-shell.sh /usr/local/bin/restricted-shell.sh
-RUN chmod +x /entrypoint.sh /init-config.sh /usr/local/bin/restricted-shell.sh
+COPY docker/session-shell.sh /usr/local/bin/session-shell.sh
+RUN chmod +x /entrypoint.sh /init-config.sh /usr/local/bin/restricted-shell.sh /usr/local/bin/session-shell.sh
 
 # Expose ports
 # 8082 - webterm HTTP server
@@ -166,18 +172,15 @@ EXPOSE 8082 3001
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
     CMD curl -f http://localhost:8082/ || exit 1
 
-# Create a wrapper script that detects if running as root or socktop user
-RUN echo '#!/bin/bash\n\
-    if [ "$(id -u)" -eq 0 ]; then\n\
-    # Running as root - use init-config.sh to set up and switch to socktop\n\
-    exec /init-config.sh "$@"\n\
-    else\n\
-    # Running as socktop user - directly execute entrypoint\n\
-    exec /entrypoint.sh "$@"\n\
-    fi' > /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh
+# entrypoint.sh handles both cases itself: as root it prepares /home/demo,
+# runs the agent as the socktop user, and keeps webterm-server as root so it
+# can drop each session to the demo user (CAP_SETUID/CAP_SETGID); as non-root
+# it behaves as before (single-UID, no session drop).
+RUN ln -sf /entrypoint.sh /docker-entrypoint.sh
 
 # Set entrypoint to the wrapper
 ENTRYPOINT ["/docker-entrypoint.sh"]
 
-# Default command - use restricted shell that only allows socktop commands
-CMD ["webterm-server", "--host", "0.0.0.0", "--port", "8082", "--command", "/usr/local/bin/restricted-shell.sh"]
+# Default command - sessions enter via session-shell.sh (per-session privilege
+# drop when root) which execs the restricted shell that only allows socktop
+CMD ["webterm-server", "--host", "0.0.0.0", "--port", "8082", "--command", "/usr/local/bin/session-shell.sh"]