update restricted shell to force (–no-kill) option.

docker/entrypoint.sh

@@ -54,12 +54,41 @@ setup_alacritty() {
     echo "Alacritty setup complete"
 }
 
+# Prepare the home directory for the unprivileged `demo` user that sessions
+# run as (see docker/session-shell.sh). Sessions need read access to the
+# socktop profiles and CA certs, which are mounted under /home/socktop — copy
+# them across and rewrite the cert paths, since demo cannot traverse another
+# user's mounts reliably. Root-only: without root there is no demo user split.
+prepare_demo_home() {
+    if [ "$(id -u)" -ne 0 ]; then
+        return
+    fi
+    echo "Preparing /home/demo for session user..."
+    mkdir -p /home/demo/.config/socktop/certs /home/demo/.config/alacritty
+    if [ -f /home/socktop/.config/socktop/profiles.json ]; then
+        cp /home/socktop/.config/socktop/profiles.json /home/demo/.config/socktop/profiles.json
+        sed -i 's|/home/socktop/|/home/demo/|g; s|/var/lib/socktop/|/home/demo/|g' /home/demo/.config/socktop/profiles.json
+    fi
+    cp /home/socktop/.config/socktop/certs/*.pem /home/demo/.config/socktop/certs/ 2>/dev/null || true
+    cp /home/socktop/.config/alacritty/*.toml /home/demo/.config/alacritty/ 2>/dev/null || true
+    chown -R demo:demo /home/demo
+    chmod -R go-w /home/demo
+    echo "  ✓ /home/demo ready"
+}
+
 # Start socktop agent
 start_socktop_agent() {
     echo "Starting socktop-agent on port 3001..."
 
-    # Start socktop-agent in the background on port 3001
-    /usr/bin/socktop_agent --port 3001 > /tmp/socktop-agent.log 2>&1 &
+    # Start socktop-agent in the background on port 3001. When root, drop it
+    # to the socktop user — it only reads /proc and system metrics, and a
+    # separate UID keeps it out of reach of the demo session user.
+    if [ "$(id -u)" -eq 0 ]; then
+        setpriv --reuid socktop --regid socktop --clear-groups --inh-caps -all --no-new-privs \
+            /usr/bin/socktop_agent --port 3001 > /tmp/socktop-agent.log 2>&1 &
+    else
+        /usr/bin/socktop_agent --port 3001 > /tmp/socktop-agent.log 2>&1 &
+    fi
     AGENT_PID=$!
 
     echo "socktop-agent started (PID: $AGENT_PID)"
@@ -85,6 +114,9 @@ main() {
     # Set up Alacritty
     setup_alacritty
 
+    # Home directory for the per-session demo user
+    prepare_demo_home
+
     # Start socktop agent
     start_socktop_agent