update restricted shell to force (–no-kill) option.

docker/entrypoint.sh

@@ -54,12 +54,41 @@ setup_alacritty() {
     echo "Alacritty setup complete"
 }
 
+# Prepare the home directory for the unprivileged `demo` user that sessions
+# run as (see docker/session-shell.sh). Sessions need read access to the
+# socktop profiles and CA certs, which are mounted under /home/socktop — copy
+# them across and rewrite the cert paths, since demo cannot traverse another
+# user's mounts reliably. Root-only: without root there is no demo user split.
+prepare_demo_home() {
+    if [ "$(id -u)" -ne 0 ]; then
+        return
+    fi
+    echo "Preparing /home/demo for session user..."
+    mkdir -p /home/demo/.config/socktop/certs /home/demo/.config/alacritty
+    if [ -f /home/socktop/.config/socktop/profiles.json ]; then
+        cp /home/socktop/.config/socktop/profiles.json /home/demo/.config/socktop/profiles.json
+        sed -i 's|/home/socktop/|/home/demo/|g; s|/var/lib/socktop/|/home/demo/|g' /home/demo/.config/socktop/profiles.json
+    fi
+    cp /home/socktop/.config/socktop/certs/*.pem /home/demo/.config/socktop/certs/ 2>/dev/null || true
+    cp /home/socktop/.config/alacritty/*.toml /home/demo/.config/alacritty/ 2>/dev/null || true
+    chown -R demo:demo /home/demo
+    chmod -R go-w /home/demo
+    echo "  ✓ /home/demo ready"
+}
+
 # Start socktop agent
 start_socktop_agent() {
     echo "Starting socktop-agent on port 3001..."
 
-    # Start socktop-agent in the background on port 3001
-    /usr/bin/socktop_agent --port 3001 > /tmp/socktop-agent.log 2>&1 &
+    # Start socktop-agent in the background on port 3001. When root, drop it
+    # to the socktop user — it only reads /proc and system metrics, and a
+    # separate UID keeps it out of reach of the demo session user.
+    if [ "$(id -u)" -eq 0 ]; then
+        setpriv --reuid socktop --regid socktop --clear-groups --inh-caps -all --no-new-privs \
+            /usr/bin/socktop_agent --port 3001 > /tmp/socktop-agent.log 2>&1 &
+    else
+        /usr/bin/socktop_agent --port 3001 > /tmp/socktop-agent.log 2>&1 &
+    fi
     AGENT_PID=$!
 
     echo "socktop-agent started (PID: $AGENT_PID)"
@@ -85,6 +114,9 @@ main() {
     # Set up Alacritty
     setup_alacritty
 
+    # Home directory for the per-session demo user
+    prepare_demo_home
+
     # Start socktop agent
     start_socktop_agent
 

docker/restricted-shell.sh

@@ -12,7 +12,7 @@ CYAN='\033[0;36m'
 NC='\033[0m' # No Color
 
 # History file
-HISTFILE="/home/socktop/.socktop_history"
+HISTFILE="${HOME:-/tmp}/.socktop_history"
 HISTSIZE=1000
 
 # Load history from file
@@ -135,7 +135,7 @@ main() {
                 # Allow socktop with validated arguments only
                 if [ "$cmd" = "$input" ]; then
                     # No arguments, use default (local profile)
-                    /usr/bin/socktop -P local
+                    /usr/bin/socktop --no-kill -P local
                 else
                     # Validate and sanitize arguments to prevent command injection
                     # Only allow: -P <profile_name> or ws://<url>
@@ -144,11 +144,11 @@ main() {
                     if [[ "$args" =~ ^-P[[:space:]]+[a-zA-Z0-9_-]+$ ]]; then
                         # Extract profile name and validate it
                         profile=$(echo "$args" | sed 's/-P[[:space:]]\+//')
-                        /usr/bin/socktop -P "$profile"
+                        /usr/bin/socktop --no-kill -P "$profile"
                     # Check for websocket URL (ws:// or wss://)
                     elif [[ "$args" =~ ^wss?://[a-zA-Z0-9\.\:/_-]+$ ]]; then
                         # Validate websocket URL format
-                        /usr/bin/socktop "$args"
+                        /usr/bin/socktop --no-kill "$args"
                     else
                         # Reject anything else as potentially dangerous
                         echo -e "${RED}Error:${NC} Invalid arguments for socktop"