host
5d09af855f
Docker outer layer and bwrap inner layer are mutually exclusive on this host (fresh proc mounts fail with kernel EPERM inside Docker's nested pidns, but work on the host under a userns profile). So tasks that need an inner sandbox run on the host: - Worker --claim-executor-only: strict executor claim (only executor == own type, never NULL). The host worker MUST use it, or it would steal NULL-executor tasks meant for Docker workers (those tasks would lose the Docker outer layer). Default behavior unchanged (NULL claimable by any worker). - host-config-host.json: sandbox workspace-write, state work/host-state-host.json (distinct from Docker tasks' host-state.json), same relay home and test repo as Docker. - deploy/apparmor/codex-host: docker-codex base + userns, mount, pivot_root for bwrap; still denies raw network, ptrace, dangerous capabilities, /proc/sys writes. - deploy/host-worker/codex-host-worker.service: aa-exec -p codex-host, --executor local --claim-executor-only, capacity 2, proxy env 127.0.0.1:8888 so host tasks' relay/git egress also goes through the Tinyproxy allowlist (host direct egress would bypass it). POST /tasks already accepts executor (local/docker/cloud), so no API change was needed for routing. Tests: 4 host-sandbox-routing tests (strict claim incl. CAS, default still takes NULL, config sandbox/state, profile allows bwrap without deny mount). Full suites pass.
1 line
1.4 KiB
JSON
1 line
1.4 KiB
JSON
{"_note":"宿主级沙箱任务专用配置（LocalExecutor，绝不是容器内路径）：codex 在宿主上直接跑，sandbox 用 workspace-write（bwrap 内层沙箱，宿主级已验证 --proc 可用；Docker 容器内因嵌套 pidns 导致 fresh proc mount 内核 EPERM，所以容器任务仍用 danger-full-access + Docker 外层，两者按任务 executor 二选一、绝不叠加）。state 用 work/host-state-host.json——相对配置文件所在目录 /opt/codex-app-server 解析，得到 /opt/codex-app-server/work/host-state-host.json，与 Docker 任务的 host-state.json 区分开，避免状态文件互相干扰。repo 与 codex_home 与 Docker 配置相同（宿主测试仓库与真实 relay home）；API key 绝不放这里，只走环境变量。宿主 worker 必须以 aa-exec -p codex-host 运行（见 deploy/host-worker/codex-host-worker.service），否则 bwrap 因 AppArmor userns/mount 限制失败；同时 worker 进程须带 HTTP(S)_PROXY=http://127.0.0.1:8888，让宿主级任务的 relay/git 出口同样走 Tinyproxy 白名单（宿主直连出口不受白名单约束，不带代理就等于绕过）。","approval":"deny","approval_policy":"never","codex_home":"/var/lib/codex-app-server/codex-home","effort":"low","model":"gpt-6.1-sol","repo":"/var/lib/codex-app-server/test-repo","sandbox":"workspace-write","state":"work/host-state-host.json"} |