host
17c9debc32
The production worker runs host.py inside a container where /app is mounted read-only, so the default state path /app/host-state.json fails instantly with Read-only file system. The Docker config must set state to /work/host-state.json (the task worktree mount, writable) and sandbox to danger-full-access (host kernel forbids untrusted user namespaces, so Docker itself is the isolation layer). This file was previously host-local only, so PR #9's deploy-clean step deleted it and every Docker task since then has failed in ~1s with the generic 'host execution failed' (stderr was discarded from the task record, so the breakage was invisible to health checks, which only look at the worker heartbeat). Committing it makes deploys restore it. No secrets in this file; the model key stays in the environment.
1 line
806 B
JSON
1 line
806 B
JSON
{"_note":"Docker 执行器专用配置（容器内路径，绝不是宿主路径）：state 必须在 /work（任务 worktree 挂载，可写），绝不能用默认的 /app/host-state.json——/app 在容器里是只读挂载，state 锁一开就报 Read-only file system，任务 1 秒内直接失败。此文件曾因 deploy 清理被删过（不在仓库里），导致 Docker 派发静默全灭，所以它必须进仓库、随部署一起发。sandbox 用 danger-full-access：主机内核禁止不可信 user namespace，Docker + 内层 bwrap 双重沙箱不可行，生产隔离层就是 Docker 本身。API key 绝不放这里，只走环境变量。","approval":"deny","approval_policy":"never","effort":"low","model":"gpt-6.1-sol","sandbox":"danger-full-access","state":"/work/host-state.json"} |