test: enforce strict replay sandboxing in e2e fixtures

src/instrumentation/libraries/fetch/e2e-tests/cjs-fetch/.tusk/config.yaml

@@ -28,4 +28,6 @@ recording:
   export_spans: false
 
 replay:
+  sandbox:
+    mode: strict
   enable_telemetry: false

src/instrumentation/libraries/fetch/e2e-tests/cjs-fetch/Dockerfile

@@ -10,6 +10,9 @@ COPY src/instrumentation/libraries/fetch/e2e-tests/cjs-fetch/tsconfig.json ./
 ARG CACHEBUST=1
 ARG TUSK_CLI_VERSION=latest
 
+# Required for strict replay sandbox mode.
+RUN apt-get update && apt-get install -y socat bubblewrap && rm -rf /var/lib/apt/lists/*
+
 # Install Tusk Drift CLI
 RUN if [ "$TUSK_CLI_VERSION" = "latest" ]; then \
       curl -fsSL https://raw.githubusercontent.com/Use-Tusk/tusk-drift-cli/main/install.sh | sh; \

src/instrumentation/libraries/fetch/e2e-tests/cjs-fetch/docker-compose.yml

@@ -13,6 +13,11 @@ services:
       args:
         - CACHEBUST=${CACHEBUST:-1}
         - TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
+    cap_add:
+      - SYS_ADMIN
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=unconfined
     environment:
       - PORT=3000
       - TUSK_ANALYTICS_DISABLED=1

src/instrumentation/libraries/fetch/e2e-tests/esm-fetch/.tusk/config.yaml

@@ -28,4 +28,6 @@ recording:
   export_spans: false
 
 replay:
+  sandbox:
+    mode: strict
   enable_telemetry: false

src/instrumentation/libraries/fetch/e2e-tests/esm-fetch/Dockerfile

@@ -10,6 +10,9 @@ COPY src/instrumentation/libraries/fetch/e2e-tests/esm-fetch/tsconfig.json ./
 ARG CACHEBUST=1
 ARG TUSK_CLI_VERSION=latest
 
+# Required for strict replay sandbox mode.
+RUN apt-get update && apt-get install -y socat bubblewrap && rm -rf /var/lib/apt/lists/*
+
 # Install Tusk Drift CLI
 RUN if [ "$TUSK_CLI_VERSION" = "latest" ]; then \
       curl -fsSL https://raw.githubusercontent.com/Use-Tusk/tusk-drift-cli/main/install.sh | sh; \

src/instrumentation/libraries/fetch/e2e-tests/esm-fetch/docker-compose.yml

@@ -13,6 +13,11 @@ services:
       args:
         - CACHEBUST=${CACHEBUST:-1}
         - TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
+    cap_add:
+      - SYS_ADMIN
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=unconfined
     environment:
       - PORT=3000
       - TUSK_ANALYTICS_DISABLED=1

src/instrumentation/libraries/firestore/e2e-tests/cjs-firestore/.tusk/config.yaml

@@ -31,4 +31,6 @@ recording:
   export_spans: false
 
 replay:
+  sandbox:
+    mode: strict
   enable_telemetry: false

src/instrumentation/libraries/firestore/e2e-tests/cjs-firestore/Dockerfile

@@ -10,6 +10,9 @@ COPY src/instrumentation/libraries/firestore/e2e-tests/cjs-firestore/tsconfig.js
 ARG CACHEBUST=1
 ARG TUSK_CLI_VERSION=latest
 
+# Required for strict replay sandbox mode.
+RUN apt-get update && apt-get install -y socat bubblewrap && rm -rf /var/lib/apt/lists/*
+
 # Install Tusk Drift CLI
 RUN if [ "$TUSK_CLI_VERSION" = "latest" ]; then \
       curl -fsSL https://raw.githubusercontent.com/Use-Tusk/tusk-drift-cli/main/install.sh | sh; \

src/instrumentation/libraries/firestore/e2e-tests/cjs-firestore/docker-compose.yml

@@ -6,6 +6,11 @@ services:
       args:
         - CACHEBUST=${CACHEBUST:-1}
         - TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
+    cap_add:
+      - SYS_ADMIN
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=unconfined
     environment:
       - PORT=3000
       - FIREBASE_PROJECT_ID=${FIREBASE_PROJECT_ID}

src/instrumentation/libraries/firestore/e2e-tests/esm-firestore/.tusk/config.yaml

@@ -31,4 +31,6 @@ recording:
   export_spans: false
 
 replay:
+  sandbox:
+    mode: strict
   enable_telemetry: false

src/instrumentation/libraries/firestore/e2e-tests/esm-firestore/Dockerfile

@@ -13,6 +13,9 @@ RUN npm install
 ARG CACHEBUST=1
 ARG TUSK_CLI_VERSION=latest
 
+# Required for strict replay sandbox mode.
+RUN apt-get update && apt-get install -y socat bubblewrap && rm -rf /var/lib/apt/lists/*
+
 # Install Tusk Drift CLI
 RUN if [ "$TUSK_CLI_VERSION" = "latest" ]; then \
       curl -fsSL https://raw.githubusercontent.com/Use-Tusk/tusk-drift-cli/main/install.sh | sh; \

src/instrumentation/libraries/firestore/e2e-tests/esm-firestore/docker-compose.yml

@@ -6,6 +6,11 @@ services:
       args:
         - CACHEBUST=${CACHEBUST:-1}
         - TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
+    cap_add:
+      - SYS_ADMIN
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=unconfined
     environment:
       - PORT=3000
       - FIREBASE_PROJECT_ID=${FIREBASE_PROJECT_ID}

src/instrumentation/libraries/grpc/e2e-tests/cjs-grpc/.tusk/config.yaml

@@ -30,4 +30,6 @@ recording:
   export_spans: false
 
 replay:
+  sandbox:
+    mode: strict
   enable_telemetry: false

src/instrumentation/libraries/grpc/e2e-tests/cjs-grpc/Dockerfile

@@ -10,6 +10,9 @@ COPY src/instrumentation/libraries/grpc/e2e-tests/cjs-grpc/tsconfig.json ./
 ARG CACHEBUST=1
 ARG TUSK_CLI_VERSION=latest
 
+# Required for strict replay sandbox mode.
+RUN apt-get update && apt-get install -y socat bubblewrap && rm -rf /var/lib/apt/lists/*
+
 # Install Tusk Drift CLI
 RUN if [ "$TUSK_CLI_VERSION" = "latest" ]; then \
       curl -fsSL https://raw.githubusercontent.com/Use-Tusk/tusk-drift-cli/main/install.sh | sh; \

src/instrumentation/libraries/grpc/e2e-tests/cjs-grpc/docker-compose.yml

@@ -6,6 +6,11 @@ services:
       args:
         - CACHEBUST=${CACHEBUST:-1}
         - TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
+    cap_add:
+      - SYS_ADMIN
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=unconfined
     environment:
       - BENCHMARKS=${BENCHMARKS:-}
       - BENCHMARK_DURATION=${BENCHMARK_DURATION:-5}

src/instrumentation/libraries/grpc/e2e-tests/esm-grpc/.tusk/config.yaml

@@ -30,4 +30,6 @@ recording:
   export_spans: false
 
 replay:
+  sandbox:
+    mode: strict
   enable_telemetry: false

src/instrumentation/libraries/grpc/e2e-tests/esm-grpc/Dockerfile

@@ -10,6 +10,9 @@ COPY src/instrumentation/libraries/grpc/e2e-tests/esm-grpc/tsconfig.json ./
 ARG CACHEBUST=1
 ARG TUSK_CLI_VERSION=latest
 
+# Required for strict replay sandbox mode.
+RUN apt-get update && apt-get install -y socat bubblewrap && rm -rf /var/lib/apt/lists/*
+
 # Install Tusk Drift CLI
 RUN if [ "$TUSK_CLI_VERSION" = "latest" ]; then \
       curl -fsSL https://raw.githubusercontent.com/Use-Tusk/tusk-drift-cli/main/install.sh | sh; \

src/instrumentation/libraries/grpc/e2e-tests/esm-grpc/docker-compose.yml

@@ -6,6 +6,11 @@ services:
       args:
         - CACHEBUST=${CACHEBUST:-1}
         - TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
+    cap_add:
+      - SYS_ADMIN
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=unconfined
     environment:
       - BENCHMARKS=${BENCHMARKS:-}
       - BENCHMARK_DURATION=${BENCHMARK_DURATION:-5}

src/instrumentation/libraries/http/e2e-tests/cjs-http/.tusk/config.yaml

@@ -28,4 +28,6 @@ recording:
   export_spans: false
 
 replay:
+  sandbox:
+    mode: strict
   enable_telemetry: false

src/instrumentation/libraries/http/e2e-tests/cjs-http/Dockerfile

@@ -17,6 +17,9 @@ RUN mkdir -p /app/.tusk/traces /app/.tusk/logs
 ARG CACHEBUST=1
 ARG TUSK_CLI_VERSION=latest
 
+# Required for strict replay sandbox mode.
+RUN apt-get update && apt-get install -y socat bubblewrap && rm -rf /var/lib/apt/lists/*
+
 # Install Tusk Drift CLI
 RUN if [ "$TUSK_CLI_VERSION" = "latest" ]; then \
       curl -fsSL https://raw.githubusercontent.com/Use-Tusk/tusk-drift-cli/main/install.sh | sh; \

src/instrumentation/libraries/http/e2e-tests/cjs-http/docker-compose.yml

@@ -15,6 +15,11 @@ services:
       args:
         - CACHEBUST=${CACHEBUST:-1}
         - TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
+    cap_add:
+      - SYS_ADMIN
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=unconfined
     environment:
       - PORT=3000
       - TUSK_ANALYTICS_DISABLED=1

src/instrumentation/libraries/http/e2e-tests/esm-http/.tusk/config.yaml

@@ -28,4 +28,6 @@ recording:
   export_spans: false
 
 replay:
+  sandbox:
+    mode: strict
   enable_telemetry: false

src/instrumentation/libraries/http/e2e-tests/esm-http/Dockerfile

@@ -17,6 +17,9 @@ RUN mkdir -p /app/.tusk/traces /app/.tusk/logs
 ARG CACHEBUST=1
 ARG TUSK_CLI_VERSION=latest
 
+# Required for strict replay sandbox mode.
+RUN apt-get update && apt-get install -y socat bubblewrap && rm -rf /var/lib/apt/lists/*
+
 # Install Tusk Drift CLI
 RUN if [ "$TUSK_CLI_VERSION" = "latest" ]; then \
       curl -fsSL https://raw.githubusercontent.com/Use-Tusk/tusk-drift-cli/main/install.sh | sh; \

src/instrumentation/libraries/http/e2e-tests/esm-http/docker-compose.yml

@@ -15,6 +15,11 @@ services:
       args:
         - CACHEBUST=${CACHEBUST:-1}
         - TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
+    cap_add:
+      - SYS_ADMIN
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=unconfined
     environment:
       - PORT=3000
       - TUSK_ANALYTICS_DISABLED=1

src/instrumentation/libraries/ioredis/e2e-tests/cjs-ioredis/.tusk/config.yaml

@@ -27,4 +27,6 @@ recording:
   export_spans: false
 
 replay:
+  sandbox:
+    mode: strict
   enable_telemetry: false

src/instrumentation/libraries/ioredis/e2e-tests/cjs-ioredis/Dockerfile

@@ -10,6 +10,9 @@ COPY src/instrumentation/libraries/ioredis/e2e-tests/cjs-ioredis/tsconfig.json .
 ARG CACHEBUST=1
 ARG TUSK_CLI_VERSION=latest
 
+# Required for strict replay sandbox mode.
+RUN apt-get update && apt-get install -y socat bubblewrap && rm -rf /var/lib/apt/lists/*
+
 # Install Tusk Drift CLI
 RUN if [ "$TUSK_CLI_VERSION" = "latest" ]; then \
       curl -fsSL https://raw.githubusercontent.com/Use-Tusk/tusk-drift-cli/main/install.sh | sh; \

src/instrumentation/libraries/ioredis/e2e-tests/cjs-ioredis/docker-compose.yml

@@ -14,6 +14,11 @@ services:
       args:
         - CACHEBUST=${CACHEBUST:-1}
         - TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
+    cap_add:
+      - SYS_ADMIN
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=unconfined
     environment:
       - PORT=3000
       - REDIS_HOST=redis

src/instrumentation/libraries/ioredis/e2e-tests/esm-ioredis/.tusk/config.yaml

@@ -27,4 +27,6 @@ recording:
   export_spans: false
 
 replay:
+  sandbox:
+    mode: strict
   enable_telemetry: false

src/instrumentation/libraries/ioredis/e2e-tests/esm-ioredis/Dockerfile

@@ -10,6 +10,9 @@ COPY src/instrumentation/libraries/ioredis/e2e-tests/esm-ioredis/tsconfig.json .
 ARG CACHEBUST=1
 ARG TUSK_CLI_VERSION=latest
 
+# Required for strict replay sandbox mode.
+RUN apt-get update && apt-get install -y socat bubblewrap && rm -rf /var/lib/apt/lists/*
+
 # Install Tusk Drift CLI
 RUN if [ "$TUSK_CLI_VERSION" = "latest" ]; then \
       curl -fsSL https://raw.githubusercontent.com/Use-Tusk/tusk-drift-cli/main/install.sh | sh; \

src/instrumentation/libraries/ioredis/e2e-tests/esm-ioredis/docker-compose.yml

@@ -14,6 +14,11 @@ services:
       args:
         - CACHEBUST=${CACHEBUST:-1}
         - TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
+    cap_add:
+      - SYS_ADMIN
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=unconfined
     environment:
       - PORT=3000
       - REDIS_HOST=redis

src/instrumentation/libraries/mongodb/e2e-tests/cjs-mongodb-v4/.tusk/config.yaml

@@ -28,4 +28,6 @@ recording:
   export_spans: false
 
 replay:
+  sandbox:
+    mode: strict
   enable_telemetry: false

src/instrumentation/libraries/mongodb/e2e-tests/cjs-mongodb-v4/Dockerfile

@@ -10,6 +10,9 @@ COPY src/instrumentation/libraries/mongodb/e2e-tests/cjs-mongodb-v4/tsconfig.jso
 ARG CACHEBUST=1
 ARG TUSK_CLI_VERSION=latest
 
+# Required for strict replay sandbox mode.
+RUN apt-get update && apt-get install -y socat bubblewrap && rm -rf /var/lib/apt/lists/*
+
 # Install Tusk Drift CLI
 RUN if [ "$TUSK_CLI_VERSION" = "latest" ]; then \
       curl -fsSL https://raw.githubusercontent.com/Use-Tusk/tusk-drift-cli/main/install.sh | sh; \

src/instrumentation/libraries/mongodb/e2e-tests/cjs-mongodb-v4/docker-compose.yml

@@ -24,6 +24,11 @@ services:
       args:
         - CACHEBUST=${CACHEBUST:-1}
         - TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
+    cap_add:
+      - SYS_ADMIN
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=unconfined
     environment:
       - BENCHMARKS=${BENCHMARKS:-}
       - BENCHMARK_DURATION=${BENCHMARK_DURATION:-5}

src/instrumentation/libraries/mongodb/e2e-tests/cjs-mongodb/.tusk/config.yaml

@@ -28,4 +28,6 @@ recording:
   export_spans: false
 
 replay:
+  sandbox:
+    mode: strict
   enable_telemetry: false

src/instrumentation/libraries/mongodb/e2e-tests/cjs-mongodb/Dockerfile

@@ -10,6 +10,9 @@ COPY src/instrumentation/libraries/mongodb/e2e-tests/cjs-mongodb/tsconfig.json .
 ARG CACHEBUST=1
 ARG TUSK_CLI_VERSION=latest
 
+# Required for strict replay sandbox mode.
+RUN apt-get update && apt-get install -y socat bubblewrap && rm -rf /var/lib/apt/lists/*
+
 # Install Tusk Drift CLI
 RUN if [ "$TUSK_CLI_VERSION" = "latest" ]; then \
       curl -fsSL https://raw.githubusercontent.com/Use-Tusk/tusk-drift-cli/main/install.sh | sh; \

src/instrumentation/libraries/mongodb/e2e-tests/cjs-mongodb/docker-compose.yml

@@ -24,6 +24,11 @@ services:
       args:
         - CACHEBUST=${CACHEBUST:-1}
         - TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
+    cap_add:
+      - SYS_ADMIN
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=unconfined
     environment:
       - BENCHMARKS=${BENCHMARKS:-}
       - BENCHMARK_DURATION=${BENCHMARK_DURATION:-5}

src/instrumentation/libraries/mongodb/e2e-tests/esm-mongodb-v4/.tusk/config.yaml

@@ -28,4 +28,6 @@ recording:
   export_spans: false
 
 replay:
+  sandbox:
+    mode: strict
   enable_telemetry: false

src/instrumentation/libraries/mongodb/e2e-tests/esm-mongodb-v4/Dockerfile

@@ -10,6 +10,9 @@ COPY src/instrumentation/libraries/mongodb/e2e-tests/esm-mongodb-v4/tsconfig.jso
 ARG CACHEBUST=1
 ARG TUSK_CLI_VERSION=latest
 
+# Required for strict replay sandbox mode.
+RUN apt-get update && apt-get install -y socat bubblewrap && rm -rf /var/lib/apt/lists/*
+
 # Install Tusk Drift CLI
 RUN if [ "$TUSK_CLI_VERSION" = "latest" ]; then \
       curl -fsSL https://raw.githubusercontent.com/Use-Tusk/tusk-drift-cli/main/install.sh | sh; \

src/instrumentation/libraries/mongodb/e2e-tests/esm-mongodb-v4/docker-compose.yml

@@ -24,6 +24,11 @@ services:
       args:
         - CACHEBUST=${CACHEBUST:-1}
         - TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
+    cap_add:
+      - SYS_ADMIN
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=unconfined
     environment:
       - BENCHMARKS=${BENCHMARKS:-}
       - BENCHMARK_DURATION=${BENCHMARK_DURATION:-5}

src/instrumentation/libraries/mongodb/e2e-tests/esm-mongodb/.tusk/config.yaml

@@ -28,4 +28,6 @@ recording:
   export_spans: false
 
 replay:
+  sandbox:
+    mode: strict
   enable_telemetry: false

src/instrumentation/libraries/mongodb/e2e-tests/esm-mongodb/Dockerfile

@@ -10,6 +10,9 @@ COPY src/instrumentation/libraries/mongodb/e2e-tests/esm-mongodb/tsconfig.json .
 ARG CACHEBUST=1
 ARG TUSK_CLI_VERSION=latest
 
+# Required for strict replay sandbox mode.
+RUN apt-get update && apt-get install -y socat bubblewrap && rm -rf /var/lib/apt/lists/*
+
 # Install Tusk Drift CLI
 RUN if [ "$TUSK_CLI_VERSION" = "latest" ]; then \
       curl -fsSL https://raw.githubusercontent.com/Use-Tusk/tusk-drift-cli/main/install.sh | sh; \