jasonwitty 5637dea10b Gate image builds on socktop CLI compatibility; fix agent probe; caps for entrypoint ...

- CI now builds the image locally on the (arm64) runner and runs
  scripts/verify-image-socktop-flags.sh before pushing: every --flag the
  restricted/session shells pass must be documented by the socktop
  binary actually installed in the image. Catches the 0.3.9 failure
  class (cached apt layer shipping a pre-flag socktop) at build time.
- Manifest adds CHOWN/DAC_OVERRIDE/FOWNER alongside SETUID/SETGID:
  with ALL dropped, uid 0 has no implicit file privilege and
  prepare_demo_home crash-looped on the demo-owned 700 home dir.
  Sessions still run with zero capabilities via setpriv.
- Agent liveness probe uses /proc instead of kill -0: without CAP_KILL
  even root gets EPERM signalling the socktop-user agent, so the old
  check false-alarmed in the pod logs.
- 0.3.11

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-24 09:46:27 -07:00

..

test-shell-security.sh

- trim container image size - sanitize socktop inputs

2025-11-28 16:20:18 -08:00

verify-image-socktop-flags.sh

Gate image builds on socktop CLI compatibility; fix agent probe; caps for entrypoint

2026-08-24 09:46:27 -07:00