From 17c9debc325abb7ebdcccb070e8d6bedfe49bed7 Mon Sep 17 00:00:00 2001
From: host <host@test.local>
Date: Mon, 26 Oct 2026 05:34:57 +0800
Subject: [PATCH] Commit host-config-docker.json to the repo (Docker executor
 was silently broken without it)

The production worker runs host.py inside a container where /app
is mounted read-only, so the default state path /app/host-state.json
fails instantly with Read-only file system. The Docker config must
set state to /work/host-state.json (the task worktree mount, writable)
and sandbox to danger-full-access (host kernel forbids untrusted user
namespaces, so Docker itself is the isolation layer). This file was
previously host-local only, so PR #9's deploy-clean step deleted it
and every Docker task since then has failed in ~1s with the generic
'host execution failed' (stderr was discarded from the task record,
so the breakage was invisible to health checks, which only look at
the worker heartbeat). Committing it makes deploys restore it.
No secrets in this file; the model key stays in the environment.
---
 host-config-docker.json | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 host-config-docker.json

diff --git a/host-config-docker.json b/host-config-docker.json
new file mode 100644
index 0000000..ea41ee2
--- /dev/null
+++ b/host-config-docker.json
@@ -0,0 +1 @@
+{"_note":"Docker 执行器专用配置（容器内路径，绝不是宿主路径）：state 必须在 /work（任务 worktree 挂载，可写），绝不能用默认的 /app/host-state.json——/app 在容器里是只读挂载，state 锁一开就报 Read-only file system，任务 1 秒内直接失败。此文件曾因 deploy 清理被删过（不在仓库里），导致 Docker 派发静默全灭，所以它必须进仓库、随部署一起发。sandbox 用 danger-full-access：主机内核禁止不可信 user namespace，Docker + 内层 bwrap 双重沙箱不可行，生产隔离层就是 Docker 本身。API key 绝不放这里，只走环境变量。","approval":"deny","approval_policy":"never","effort":"low","model":"gpt-6.1-sol","sandbox":"danger-full-access","state":"/work/host-state.json"}
\ No newline at end of file