Skip to content
This repository was archived by the owner on Mar 14, 2026. It is now read-only.

Commit 775c9ae

Browse files
koki-developclaude
andcommitted
Isolate /dev/mqueue per sandbox to prevent cross-execution data leakage
Co-Authored-By: Claude <noreply@anthropic.com>
1 parent bf72307 commit 775c9ae

1 file changed

Lines changed: 1 addition & 0 deletions

File tree

api/src/job.js

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,7 @@ class Job {
164164
`--dir=${this.runtime.pkgdir}`,
165165
`--dir=/etc:noexec`,
166166
`--dir=/dev/shm:tmp`,
167+
`--dir=/dev/mqueue:tmp`,
167168
`--processes=${this.runtime.max_process_count}`,
168169
`--open-files=${this.runtime.max_open_files}`,
169170
`--fsize=${Math.floor(this.runtime.max_file_size / 1000)}`,

0 commit comments

Comments
 (0)