diff --git a/Makefile b/Makefile
index 8d8ee87..11092a7 100644
--- a/Makefile
+++ b/Makefile
@@ -95,9 +95,12 @@ run_sandbox_mode: ## Start sandbox proxy + dev runner (mac-friendly dev loop)
 test_sandbox_mode: ## Run a sample isolated command in the dev loop and verify isolation
 	@$(MAKE) run_sandbox_mode
 	@PROXY_PID=$$(docker inspect --format '{{.State.Pid}}' buildcage-proxy); \
-	  docker compose -f compose.yaml -f run/compose.sandbox-dev.yaml exec sandbox-dev-runner \
-	    run-isolated.sh --proxy-pid $$PROXY_PID --uid 1000 --gid 1000 \
-	    --gateway 172.20.0.1 --dns 172.20.0.1 -- /usr/local/bin/smoke-test.sh
+	  docker compose -f compose.yaml -f run/compose.sandbox-dev.yaml exec sandbox-dev-runner sh -c " \
+	    set -e; \
+	    build-test-bundle.sh --netns-name buildcage-sandbox-dev --script /usr/local/bin/smoke-test.sh --bundle /var/tmp/buildcage/dev-bundle; \
+	    run-isolated.sh --proxy-pid $$PROXY_PID --runc /usr/local/bin/runc --bundle /var/tmp/buildcage/dev-bundle \
+	      --container-id buildcage-sandbox-dev --netns-name buildcage-sandbox-dev --rootfs-bind-dir /var/tmp/buildcage/dev-bundle/rootfs \
+	      --gateway 172.20.0.1 --dns 172.20.0.1 --target-ip 172.20.0.101"
 	@$(MAKE) clean_sandbox_mode
 
 .PHONY: clean_sandbox_mode
@@ -173,6 +176,12 @@ test_sandbox_integration: ## Run the run action's integration tests (needs BUILD
 	@./run/test/integration-test-writable-dir.sh
 	@./run/test/integration-test-writable-disabled.sh
 	@./run/test/integration-test-defaults.sh
+	@./run/test/integration-test-seccomp.sh
+	@./run/test/integration-test-die-with-parent.sh
+	@./run/test/integration-test-fs-escape.sh
+	@./run/test/integration-test-runner-temp.sh
+	@./run/test/integration-test-nested-mount-readonly.sh
+	@./run/test/integration-test-non-runc-default-pseudofs-readonly.sh
 	@./run/test/integration-test-concurrent.sh
 
 .PHONY: test_unit
diff --git a/THIRD_PARTY_LICENSES b/THIRD_PARTY_LICENSES
index dd08a6b..6317eb2 100644
--- a/THIRD_PARTY_LICENSES
+++ b/THIRD_PARTY_LICENSES
@@ -50,6 +50,30 @@ QuickJS
 
 ------------------------------------------------------------------------------
 
+runc (used only by the `run` action's proxy image, docker/Dockerfile)
+  Website : https://github.com/opencontainers/runc
+  License : Apache License 2.0 (Apache-2.0)
+  Source  : https://github.com/opencontainers/runc
+  Note    : Official pre-built release binary, checksum-pinned. Extracted
+            onto the runner host at `run` action startup and used by
+            run-isolated.sh to execute the isolated command.
+
+------------------------------------------------------------------------------
+
+run/scripts/seccomp.json (used only by the `run` action)
+
+  This file is not part of the Docker image; it ships as part of the
+  action's own source and is loaded directly by run/src/lib/isolated-exec.js.
+  It is generated offline (not at image build time) from moby/profiles'
+  default seccomp profile, resolved against an empty capability set with
+  the exported `LoadProfile` function.
+
+  moby/profiles
+    License : Apache License 2.0 (Apache-2.0)
+    Source  : https://github.com/moby/profiles
+
+------------------------------------------------------------------------------
+
 Note on GPL components (HAProxy, dnsmasq):
 
 These components are installed from the Alpine Linux official package
diff --git a/docs/development.md b/docs/development.md
index 06c0959..e913a81 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -51,12 +51,16 @@ make clean
 ### Sandbox Dev Loop (mac-friendly)
 
 The `run` action's own isolation mechanism (`run-isolated.sh`) uses Linux-only primitives
-(`unshare`, `nsenter`, `setpriv`) that can't run natively on macOS. `make run_sandbox_mode` /
+(`ip netns`, `nsenter`, `runc`) that can't run natively on macOS. `make run_sandbox_mode` /
 `make test_sandbox_mode` instead drive it from inside a container with `pid: host` (see
 `run/dev/Dockerfile` and `run/compose.sandbox-dev.yaml`), which can see the proxy
 container's PID/netns via `/proc` — close enough to the real "runner host + separate proxy
 container" arrangement for day-to-day iteration, though it can't validate the container-boundary
-parts of production (see [Run Action Internals](#run-action-internals) below). CI's
+parts of production (see [Run Action Internals](#run-action-internals) below). `runc` and
+`gen-seccomp-profile` are built directly into the dev-loop image (mirroring `run/docker/Dockerfile`)
+rather than `docker cp`-extracted from the proxy image at runtime, so the dev loop doesn't need the
+Docker socket mounted in just to reach a sibling container; `run/dev/build-test-bundle.sh` stands in
+for `isolated-exec.js`'s `buildOciConfig` to build a minimal OCI bundle for the smoke test. CI's
 `test_sandbox_*` e2e jobs run `run-isolated.sh` directly on the runner host instead, matching
 production exactly — treat those as the final word on whether a change actually works, not this
 dev loop.
@@ -121,84 +125,74 @@ behavior — what's enforced, what's visible in the report — see
 
 ## Run Action Internals
 
-This section covers how the `run` action (`run/`) is implemented internally. For the
-user-facing behavior and threat model, see [Run Action](./security.md#run-action) in
-Security Details and the [Reference](./reference.md#run-action) doc.
-
-- `run/docker/` is a stripped-down build of the `transparent` engine's image with `buildkitd`
-  removed entirely — only the bridge (`sandbox0`, not `buildkit0` — there's no BuildKit here to
-  share the name with), iptables `REDIRECT`/`DROP` rules, dnsmasq, and HAProxy remain. Since
-  BuildKit's CNI integration normally creates that bridge, a new `init-cni-bridge` s6 service
-  (`run/docker/files/s6-scripts/init-cni-bridge`) creates it directly via `ip link add ... type
-  bridge` instead. `run/docker/files/s6-scripts/init-iptables` is `setup/docker/transparent`'s
-  script with the bridge name swapped; `init-haproxy-cfg`, `dnsmasq.conf`, and `haproxy.cfg.template`
-  are unmodified copies.
-- `run/action.yml` is a `node24` action (`main` + `post`, mirroring `setup`'s shape). Each
-  invocation is fully self-contained — `run/src/main.js` verifies and pulls the proxy image
-  (same Sigstore flow as `setup`, published under the `-proxy` tag suffix — see
-  `imageTagFromRef` in `core/lib/verify-image.js`), starts a uniquely-named throwaway proxy
-  container, runs the isolated command, appends this step's report section to the Job Summary, and
-  stops the container again, all inside `main`'s own `try`/`finally`. `run/src/post.js` is a
-  fallback only — it reads the container name and Compose project name back from `GITHUB_STATE`
-  (`STATE_container_name`/`STATE_project_name`) and stops it, in case the process was killed before
-  reaching `main`'s own `finally`. If `STATE_project_name` is missing, `post.js` skips cleanup
-  entirely rather than falling back to an unscoped `docker compose down` (see below).
-- Every `docker compose` invocation passes `-p <containerName>` (`lib/container.js`'s
-  `deriveProjectName`, currently the identity function — container names and Compose project names
-  live in separate Docker namespaces, so reusing the same string for both is safe and keeps
-  `docker ps`/`docker network ls` output easy to correlate). This matters once GitHub Actions'
-  `background`/`wait`/`parallel` step keywords let multiple `run` steps in the same job run
-  truly concurrently: without an explicit `-p`, Compose falls back to an implicit,
-  directory-derived project name shared by every invocation, and it identifies "the" container for
-  a service by its project+service label rather than by container name — so one step's `up`/`down`
-  could recreate or tear down another step's still-running proxy container even though their
-  container names never collide.
-- The actual isolation is `run/scripts/run-isolated.sh`, invoked via `sudo -n` since setting up
-  namespaces/veth/iptables requires root:
-  1. `unshare --net --pid --mount --uts --ipc --cgroup --mount-proc --fork -- sleep infinity` creates
-     a placeholder process holding the new namespaces. `unshare --pid` doesn't move the caller
-     itself into the new PID namespace — only the first forked child does — so the script discovers
-     that child's host-visible PID via `/proc/<unshare-pid>/task/<unshare-pid>/children` before it
-     can `nsenter` into it. Immediately after, `mount --make-rprivate /` (recursive) runs inside the
-     placeholder's mount namespace: a cloned mount namespace starts out in the same propagation peer
-     group as the one it was cloned from (typically "shared" under systemd), so without this, every
-     mount change made in the steps below would propagate straight back out to the host's real mount
-     namespace.
-  2. A veth pair is created with one end moved into the placeholder's netns, the other moved
-     directly into the (already-running) proxy container's netns and attached to its `sandbox0`
-     bridge as a bridge port — the same role a BuildKit `RUN` step container's veth plays under
-     `transparent` mode.
-  3. `/etc/resolv.conf` is bind-mounted over inside the placeholder's mount namespace only; a
-     handful of sensitive `/proc` paths are bind-mounted over with `/dev/null` the same way.
-  4. The rest of the filesystem is then restricted to read-only, except `$GITHUB_WORKSPACE`, `$HOME`,
-     `/tmp`, and any paths from the action's `writable` input (`--writable`, repeatable). Each of
-     those is first bind-mounted onto itself, giving it its own mount-table entry, then every
-     *other* existing mount is remounted read-only via `mount -o remount,bind,ro` — the `bind`
-     there is required: a plain `remount,ro` changes the underlying filesystem's shared state
-     (still shared with the host even after step 1's `make-rprivate`, since that only stops
-     mount/unmount *event* propagation, not this kind of flag change), and would leak the read-only
-     flag back to the host, whereas `remount,bind,ro` scopes it to this one mount entry only. A
-     literal `/` among the `writable` paths is a sentinel that skips this whole step instead of
-     bind-mounting "/" itself, since most paths below "/" aren't separate mount points and so
-     wouldn't be covered by protecting "/" alone.
-  5. The command finally executes via `nsenter --target <placeholder-pid> --net --mount --uts --ipc
-     --cgroup --pid -- env -i "${ENV_ASSIGNMENTS[@]}" setpriv --reuid=<uid> --regid=<gid>
-     --clear-groups --bounding-set=-all --no-new-privs -- <script>`. Environment variables are
-     passed through a NUL-separated dump file, read into a bash array with `mapfile -d ''` and
-     re-applied via `env -i`, rather than `sudo -E` (whose availability depends on a non-portable
-     sudoers `SETENV` tag). `mapfile` is used instead of `xargs -0` specifically so the isolated
-     command's real exit code survives: GNU xargs remaps any exit status 1-125 from the command it
-     runs to its own fixed exit status 123.
-  6. A `trap ... EXIT INT TERM` cleanup always removes the proxy-side veth and kills the placeholder
-     — with `kill -9`, specifically: the placeholder is PID 1 of its own new PID namespace, and PID
-     1 ignores the default-terminate action for signals it hasn't installed a handler for, so
-     `SIGTERM` alone leaves it running forever. Only `SIGKILL` (which can't be caught or ignored)
-     reliably tears it down.
-- The report step (`run/src/lib/report.js`) reuses `core/scripts/report.js` and
-  `core/shared/lib/aggregate.js` unmodified via `docker exec <container> qjs -m
-  /opt/buildcage/scripts/report.js` — the proxy always runs the `transparent`
-  engine's HAProxy log format, so there's no `explicit`-engine branch to handle here the way
-  `report/src/main.js` has to.
+This section walks through how the `run` action (`run/`) isolates one `run:` command, in the
+order it actually happens. For the user-facing behavior and threat model, see
+[Run Action](./security.md#run-action) in Security Details and the
+[Reference](./reference.md#run-action) doc.
+
+1. Verify the proxy image's provenance and resolve a digest-pinned image ref (`main.js`).
+   - Sigstore bundle verification against the image published under the `-proxy` tag suffix.
+2. Start a dedicated, throwaway proxy container for this one step (`main.js`).
+   - The container provides network-layer isolation only (bridge, iptables `REDIRECT`/`DROP`
+     rules, dnsmasq, HAProxy) — no build daemon.
+   - Every `docker compose` invocation passes an explicit `-p <containerName>`, so concurrent
+     `run:` steps in the same job (GitHub Actions' `background`/`wait`/`parallel` keywords) never
+     share an implicit, directory-derived Compose project — otherwise one step's `up`/`down` could
+     recreate or tear down another step's still-running container.
+3. Extract `runc` and a seccomp-profile generator onto the runner host (`isolated-exec.js`).
+   - Both ship inside the proxy image and are pulled onto the host via `docker cp`, then run
+     natively there — not `docker exec`'d — since the seccomp profile's content depends on the
+     real host's kernel and architecture.
+   - Extracted fresh into this step's own scratch directory on every invocation (no shared,
+     cross-step/cross-job cache), so each `run:` step is fully independent and everything extracted
+     is torn down with the scratch directory afterward.
+4. Build an OCI runtime bundle (`config.json`) describing the sandbox (`isolated-exec.js`).
+   - Starts from `runc`'s own default spec, then patches in: a root filesystem pointing at a
+     not-yet-created bind-mount directory, made read-only (every real host mount point is forced
+     individually read-only outside workdir/home/tmp/RUNNER_TEMP/writable, since the top-level
+     read-only flag alone doesn't cover separate mount points); a network namespace reference to the
+     netns created in the next step; all Linux capabilities cleared plus no-new-privileges; the
+     step's real environment; and a seccomp filter resolved from Docker's own default profile,
+     applied against an empty capability set to match the sandbox.
+   - The writable exceptions are recursive bind-mounts (so legitimately nested mounts under them
+     stay visible). The `mount --rbind /` rootfs is therefore staged under `/var/tmp/buildcage` —
+     never one of the writable exceptions — so those recursive rbinds don't re-expose it as a
+     second, *writable* copy of the whole host `/` inside the sandbox. A `writable:` input naming
+     that directory (or an ancestor of it) is rejected outright rather than silently accepted. The
+     sandbox's real host view (its own `/` and every nested mount) is untouched and stays read-only
+     outside the writable set.
+5. Stage the sandbox's network and filesystem as root, via `sudo -n` (`run-isolated.sh`).
+   - Re-execs itself into a fresh, private mount namespace before touching anything else, so the
+     mount work below is invisible to every other `run:` step running concurrently on the same
+     host.
+   - Bind-mounts the host's own root filesystem onto a fresh directory to serve as the sandbox's
+     rootfs (a plain `pivot_root` can't target the real root directly). Done before the network
+     setup below, since it has no dependency on it and doing it first minimizes the gap between
+     `listHostMounts()`'s snapshot (which `readonlyPaths` above was computed from) and this
+     actually capturing the host's mount table.
+   - Creates a network namespace and a veth pair, with one end moved into it and the other
+     attached as a bridge port on the proxy container's own network.
+6. Run the sandboxed command via `runc`.
+   - runc creates its own further-nested namespaces per `config.json` and enforces every
+     isolation guarantee declared there — capability drop, seccomp filter, read-only filesystem,
+     network namespace.
+   - A two-hop process-supervision chain ties the sandboxed process's life to the staging step
+     above: the process that starts `runc` and, separately, the sandboxed command itself both
+     die if their immediate parent does, so killing the staging step tears down the whole chain
+     instead of leaving the sandboxed command running as an orphan.
+7. Clean up once the command exits (`run-isolated.sh`).
+   - An exit trap tears the container down, unmounts the rootfs bind-mount, removes the veth, and
+     deletes the network namespace.
+   - As a second layer of defense, anything still mounted under the run's own scratch directory
+     is force-detached before that directory is deleted, in case the trap above didn't run to
+     completion.
+8. Append this step's report to the Job Summary and stop the proxy container (`main.js`).
+   - The report is generated by running a shared script inside the still-running proxy container
+     against its own communication log, then the container is stopped.
+   - If the whole process is killed before reaching this point, a fallback step reads the
+     container's identity back from job state and stops it anyway, and reclaims the step's scratch
+     directory — whose path it reconstructs deterministically from that same identity, then
+     force-detaches any surviving mount before deleting (`post.js`).
 
 ## Local Development
 
@@ -329,16 +323,18 @@ reports for the allowed side.
 │   ├── action.yml            # Action entry (node24 → dist/main.cjs, dist/post.cjs)
 │   ├── src/                  # Source (ESM): start proxy, run isolated command, report, stop
 │   ├── dist/                 # Bundled output (rollup → CommonJS)
-│   ├── scripts/run-isolated.sh  # unshare/veth/setpriv isolation, invoked via `sudo -n`
+│   ├── scripts/run-isolated.sh  # netns/veth/rootfs-bind setup around `runc run`, invoked via
+│   │                         # `sudo -n` (see Run Action Internals)
 │   ├── compose.yaml          # Runtime compose file the action itself uses (verified, digest-pinned
 │   │                         # image ref)
 │   ├── docker/               # run action's proxy image — transparent's bridge/iptables/
-│   │                         # dnsmasq/HAProxy stack with buildkitd removed entirely
-│   ├── test/                 # assert-sandbox*.sh (checks the run action's Job Summary and
-│   │                         # concurrent-execution behavior)
+│   │                         # dnsmasq/HAProxy stack with buildkitd removed entirely, plus a
+│   │                         # checksum-pinned runc binary and the gen-seccomp-profile/ Go tool
+│   ├── test/                 # assert-sandbox*.sh + integration-test-*.sh (capability/filesystem/
+│   │                         # seccomp/die-with-parent checks driving run/dist/main.cjs directly)
 │   ├── compose.sandbox-dev.yaml  # Mac dev-loop overlay for the run action (see dev/)
-│   └── dev/                  # Mac dev-loop-only Dockerfile + smoke-test.sh (see
-│                             # compose.sandbox-dev.yaml) — not used in production or CI
+│   └── dev/                  # Mac dev-loop-only Dockerfile + smoke-test.sh + build-test-bundle.sh
+│                             # (see compose.sandbox-dev.yaml) — not used in production or CI
 ├── core/                     # Code shared across actions
 │   ├── lib/                  # Image verification: Sigstore, OCI registry lookups, image ref
 │   │                         # resolution, local-image test-hook override
diff --git a/docs/reference.md b/docs/reference.md
index 63c6ac8..1b7f7c1 100644
--- a/docs/reference.md
+++ b/docs/reference.md
@@ -236,7 +236,7 @@ during the audited run — mirroring the same example the `report` action genera
 | `allowed_http_rules` | No | empty | HTTP allow rules (wildcard or regex, port required) |
 | `allowed_ip_rules` | No | empty | IP address allow rules (wildcard or regex, port required) |
 | `fail_on_blocked` | No | `true` | Fail the step if blocked connections are detected (restrict mode only; ignored in audit mode) |
-| `writable` | No | empty | Additional writable directories (newline-separated), on top of `$GITHUB_WORKSPACE`, `$HOME`, and `/tmp` — see [Filesystem Access](#filesystem-access) below |
+| `writable` | No | empty | Additional writable directories (newline-separated), on top of `$GITHUB_WORKSPACE`, `$HOME`, `/tmp`, and `$RUNNER_TEMP` — see [Filesystem Access](#filesystem-access) below |
 | `label` | No | empty | Label appended to this step's Job Summary heading, e.g. `npm install` — useful to tell steps apart when `run` is used more than once in the same job |
 
 Rule syntax is identical to `setup`'s — see [Rule Syntax](#rule-syntax) above.
@@ -288,10 +288,10 @@ itself instead of a BuildKit `RUN` step:
 
 ### Filesystem Access
 
-Only `$GITHUB_WORKSPACE`, `$HOME`, and `/tmp` are writable by default — every other path is
-remounted read-only for the duration of the `run` command. This closes off using the filesystem to
-plant a payload for a later, non-sandboxed step in the same job (e.g. rewriting a binary earlier on
-`$PATH`); it doesn't restrict what the command can *read* (see
+Only `$GITHUB_WORKSPACE`, `$HOME`, `/tmp`, and `$RUNNER_TEMP` are writable by default — every other
+path is remounted read-only for the duration of the `run` command. This closes off using the
+filesystem to plant a payload for a later, non-sandboxed step in the same job (e.g. rewriting a
+binary earlier on `$PATH`); it doesn't restrict what the command can *read* (see
 [Known Limitations](./security.md#run-action) in Security Details).
 
 If `run` needs to write somewhere else — a tool-specific cache directory, for example — list it
@@ -314,5 +314,6 @@ To disable the read-only restriction entirely, set `writable` to `/`:
 > [!NOTE]
 > `run` runs `run-isolated.sh` directly on the runner host (via `sudo -n`), so it requires a
 > Linux runner with passwordless `sudo` — this is the default on GitHub-hosted `ubuntu-*` runners.
-> It does not currently apply a seccomp profile, AppArmor/SELinux profile, or Landlock rules; see
-> [Security Details](./security.md#run-action) for the full threat model and known limitations.
+> It applies a seccomp filter derived from Docker's own default profile; it does not apply an
+> AppArmor/SELinux profile or Landlock rules. See [Security Details](./security.md#run-action) for
+> the full threat model and known limitations.
diff --git a/docs/security.md b/docs/security.md
index 6607c90..107c6df 100644
--- a/docs/security.md
+++ b/docs/security.md
@@ -207,23 +207,50 @@ the Actions runner itself (rather than inside a BuildKit-managed OCI container),
 unable to reach outside its sandbox by other means (escalating privileges, reaching the Docker
 socket, or reading another process's memory).
 
+The core design goal is to let you bolt network egress control onto an existing workflow step
+without changing how the rest of that workflow already works. A step that configures AWS
+credentials, an npm/yarn cache directory, or any other action keeps running exactly as it did
+before `run` was introduced — `run` only wraps the specific command whose network access you want
+restricted, rather than requiring the surrounding job to move into a differently-configured
+environment. This is why UID/GID and `$HOME` are preserved rather than switched to a dedicated
+sandbox account (see UID/GID preserved below): tools and caches that assume the runner's own
+identity keep working unmodified.
+
 ### Isolation Mechanisms
 
+The isolated command runs as an [OCI](https://github.com/opencontainers/runtime-spec) container
+under [runc](https://github.com/opencontainers/runc) — the same reference container runtime
+`explicit`/`transparent` already trust indirectly via `moby/buildkit` — rather than being wrapped
+directly by `unshare`/`setpriv` on the runner host. `run-isolated.sh` only sets up what runc cannot:
+wiring a veth pair into the proxy container's bridge, and bind-mounting the host's own `/` for
+runc's rootfs (`pivot_root` can't target `/` itself). Everything else below is declared in an OCI
+`config.json` and enforced by runc natively.
+
 - **Network namespace**: the isolated command runs in its own network namespace, connected to the
   proxy container's bridge via a veth pair — the same enforcement `transparent` mode
-  applies to Docker `RUN` steps (iptables `REDIRECT`/`DROP`, DNS redirect, SNI/Host allowlist).
-- **Capability bounding set**: fully cleared (`setpriv --bounding-set=-all`) before the command
-  executes. This is what actually makes privilege escalation impossible — even if the command
-  invokes `sudo` or a setuid binary, there is no `CAP_NET_ADMIN`/`CAP_SYS_ADMIN`/etc. left in the
-  bounding set for it to acquire, regardless of the resulting effective UID.
+  applies to Docker `RUN` steps (iptables `REDIRECT`/`DROP`, DNS redirect, SNI/Host allowlist). runc
+  joins this namespace itself, driven by the OCI spec's `linux.namespaces` path — no wrapper needed.
+- **Seccomp filter**: derived from Docker's own default seccomp profile (allowlist-based;
+  `moby/profiles`), resolved against an empty capability set to match the capability drop below —
+  so any syscall Docker's default profile only conditionally allows for a *held* capability is
+  excluded outright. This directly closes the gap historical `io_uring` and unprivileged
+  user-namespace-creation CVEs relied on: `unshare(2)`/`clone(2)` with `CLONE_NEWUSER` and the
+  `io_uring_*` syscall family are not in the resulting allowlist at all. Generated at `run` action
+  startup (not baked into the image at build time), since a handful of the profile's rules are
+  gated on the actual kernel version — see `run/docker/gen-seccomp-profile/main.go`.
+- **Capability bounding set**: fully cleared (all five capability sets emptied in `config.json`)
+  before the command executes. This is what actually makes privilege escalation impossible — even
+  if the command invokes `sudo` or a setuid binary, there is no `CAP_NET_ADMIN`/`CAP_SYS_ADMIN`/etc.
+  left for it to acquire, regardless of the resulting effective UID.
 - **`no_new_privileges`**: set as defense-in-depth alongside the capability drop, so setuid/setgid
-  binaries and file capabilities can't grant anything even in edge cases the bounding-set drop
+  binaries and file capabilities can't grant anything even in edge cases the capability drop
   doesn't cover on its own.
 - **Supplementary groups cleared**: `docker` and any other supplementary group membership is
-  dropped (`setpriv --clear-groups`). Runner users are typically members of the `docker` group,
-  which is equivalent to root — the Docker daemon will happily mount `/` into a new privileged
-  container for anyone who can reach its socket, regardless of that user's own capabilities. Group
-  membership is what gates that reach, not capabilities, so it has to be cleared independently.
+  dropped (the OCI spec's `process.user` carries no `additionalGids`). Runner users are typically
+  members of the `docker` group, which is equivalent to root — the Docker daemon will happily mount
+  `/` into a new privileged container for anyone who can reach its socket, regardless of that user's
+  own capabilities. Group membership is what gates that reach, not capabilities, so it has to be
+  cleared independently.
 - **PID namespace**: the isolated command runs in its own PID namespace. This isn't just about
   hiding other processes from `ps` — the Linux kernel structurally forbids a process from tracing
   (`ptrace`) or reading `/proc/<pid>/mem` for any process outside its own PID namespace's lineage,
@@ -234,32 +261,52 @@ socket, or reading another process's memory).
   choice: `actions/setup-node`-installed toolchains, `$GITHUB_WORKSPACE` file ownership, and
   `$HOME`-based caches (`~/.npm`, `~/.cache`, etc.) all assume the runner's own UID, and switching
   UID would break them. Isolation here comes entirely from the capability/group/namespace
-  mechanisms above, not from UID separation.
+  mechanisms above, not from UID separation. No user namespace is created for this either — that
+  would let the isolated command re-acquire a (namespace-local) root identity via the very
+  unprivileged-`CLONE_NEWUSER` primitive the seccomp filter above is specifically closing off.
 - **Sensitive `/proc` paths masked**: `/proc/kcore`, `/proc/kallsyms`, `/proc/kmsg`,
   `/proc/sysrq-trigger`, `/proc/timer_list`, and `/proc/keys` are bind-mounted over with `/dev/null`
-  inside the isolated mount namespace, closing off kernel-memory-adjacent information disclosure
-  paths that aren't already covered by the capability drop.
-- **Filesystem read-only outside the workspace/home/tmp**: `$GITHUB_WORKSPACE`, `$HOME`, and `/tmp`
-  are bind-mounted onto themselves and kept writable; every other existing mount is remounted
-  read-only inside the isolated mount namespace. This closes off tampering with anything outside
-  those three paths — e.g. rewriting a binary earlier on `$PATH` to plant a payload for a later,
-  non-sandboxed step in the same job. The read-only remount is enforced, not best-effort: a
-  pseudo-filesystem that legitimately rejects a read-only remount (`proc`, `sysfs`, `cgroup2`,
-  etc.) is tolerated, but if any *real* filesystem cannot be made read-only the step fails closed
-  rather than running with it silently left writable. The `writable` input adds further paths to
-  the writable set for tools that need to write elsewhere (e.g. a cache directory); setting it to
-  `/` disables this restriction entirely — see
+  (the OCI spec's `linux.maskedPaths`, extending runc's own sensible defaults), closing off
+  kernel-memory-adjacent information disclosure paths that aren't already covered by the capability
+  drop.
+- **Filesystem read-only outside the workspace/home/tmp**: `$GITHUB_WORKSPACE`, `$HOME`, `/tmp`, and
+  `$RUNNER_TEMP` are bind-mounted as writable exceptions on top of a read-only root (`root.readonly`
+  in `config.json`, applied by runc itself). This closes off tampering with anything outside those
+  paths — e.g. rewriting a binary earlier on `$PATH` to plant a payload for a later, non-sandboxed
+  step in the same job. The rest of the host filesystem, including nested mounts, stays fully
+  *visible* (read-only) so existing tools keep working; only writes are restricted. The writable
+  exceptions are recursive bind-mounts (preserving any legitimately nested mounts under them); the
+  sandbox's own `mount --rbind /` rootfs is staged under `/var/tmp/buildcage`, which is never one of
+  those writable exceptions, so that recursion doesn't re-expose it as a second, writable copy of
+  the whole host `/`. A `writable:` input naming that directory (or an ancestor of it) is rejected
+  outright — see [Known Limitations](#known-limitations-1) below. The `writable` input adds further
+  paths to the writable set for tools that need to write elsewhere (e.g. a cache directory); setting
+  it to `/` disables this restriction entirely — see
   [Filesystem Access](./reference.md#filesystem-access) in Reference.
+- **Die-with-parent**: the isolated command's life is tied to `run-isolated.sh`'s own via a two-hop
+  `setpriv --pdeathsig=KILL` chain (`run-isolated.sh` → `runc run` → the isolated command — `runc
+  run`'s own process sits between the two, so a single-hop guard wouldn't be enough). If
+  `run-isolated.sh` is killed outright (e.g. an out-of-memory kill lands on it specifically), the
+  whole sandboxed process tree is killed with it rather than surviving as an orphan.
 
 ### Known Limitations
 
-- **No seccomp profile**: a seccomp-bpf filter would add defense-in-depth against kernel bugs
-  reachable via syscalls that don't require any capability at all (e.g. historical `io_uring` or
-  unprivileged user-namespace-creation CVEs) — this is tracked as future work, not yet implemented.
 - **No AppArmor/SELinux/Landlock policy**: these would add path-level MAC restrictions on top of
   the capability-based model above. Not applied today; the isolation mechanisms above already
   close off the specific escape routes considered (privilege escalation, Docker-socket access,
   cross-namespace ptrace/memory access).
+- **`writable:` cannot name the sandbox's own scratch directory**: a `run:` step's `writable:` input
+  listing `/var/tmp/buildcage` (or an ancestor of it, e.g. `/var/tmp` or `/`) is rejected outright —
+  that directory holds the run's own `mount --rbind /` rootfs, and the writable exceptions are
+  recursive bind-mounts, so allowing it would recursively re-expose the whole host `/` inside the
+  sandbox as a second, writable copy. This is a misconfiguration guard against an operator-supplied
+  `writable:` value, not a defense against the isolated command itself (see
+  [Filesystem Access](./reference.md#filesystem-access) in Reference).
+- **Docker cannot be used inside the isolated command**: supplementary groups (including `docker`)
+  are cleared before the command runs, so even where the Docker socket is visible through the
+  read-only host filesystem, the isolated command has no permission to use it. A `run:` step that
+  itself needs to invoke `docker` (build an image, run a container, etc.) cannot be wrapped by
+  `run`.
 - **Credential retrieval is intentionally not blocked**: `run` restricts *where* the isolated
   command can send network traffic and, since the filesystem is read-only outside
   `$GITHUB_WORKSPACE`/`$HOME`/`/tmp`, *where* it can persist a payload — but not what it reads. A
diff --git a/renovate.json b/renovate.json
index 809bb58..f36b549 100644
--- a/renovate.json
+++ b/renovate.json
@@ -15,6 +15,14 @@
       ],
       "matchStrings": ["# renovate: datasource=(?<datasource>[^\\s]+) depName=(?<depName>[^\\s]+)\\nARG CNI_VERSION=(?<currentValue>v[\\d.]+)"]
     },
+    {
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^run/docker/Dockerfile$/",
+        "/^run/dev/Dockerfile$/"
+      ],
+      "matchStrings": ["# renovate: datasource=(?<datasource>[^\\s]+) depName=(?<depName>[^\\s]+)\\nARG RUNC_VERSION=(?<currentValue>v[\\d.]+)"]
+    },
     {
       "customType": "regex",
       "managerFilePatterns": ["/\\.md$/"],
diff --git a/rollup.config.js b/rollup.config.js
index b427853..373e938 100644
--- a/rollup.config.js
+++ b/rollup.config.js
@@ -42,7 +42,7 @@ const configs = [
     plugins: mainPlugins,
     inlineDynamicImports: true,
   },
-  { input: "run/src/post.js", file: "run/dist/post.cjs", plugins: [] },
+  { input: "run/src/post.js", file: "run/dist/post.cjs", plugins: [json()] },
 ];
 
 export default configs.map(
diff --git a/run/compose.sandbox-dev.yaml b/run/compose.sandbox-dev.yaml
index fd80d70..a48e5e0 100644
--- a/run/compose.sandbox-dev.yaml
+++ b/run/compose.sandbox-dev.yaml
@@ -16,9 +16,19 @@ services:
     security_opt:
       - seccomp=unconfined
       - apparmor=unconfined
+    # runc needs to create/manage a cgroup for the sandboxed process, which
+    # needs a writable /sys/fs/cgroup -- read-only by default in a
+    # non-privileged container, same reasoning as the "builder" service in
+    # ../../compose.yaml. Not needed on the real GitHub Actions runner host
+    # this dev loop stands in for (root already has full cgroup access
+    # there without this).
+    cgroup: host
     volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
       - ./run/scripts/run-isolated.sh:/usr/local/bin/run-isolated.sh:ro
+      - ./run/scripts/extra-masked-proc-paths.json:/etc/buildcage/extra-masked-proc-paths.json:ro
       - ./run/dev/smoke-test.sh:/usr/local/bin/smoke-test.sh:ro
+      - ./run/dev/build-test-bundle.sh:/usr/local/bin/build-test-bundle.sh:ro
     depends_on:
       proxy:
         condition: service_started
diff --git a/run/dev/Dockerfile b/run/dev/Dockerfile
index 6f8a04b..f2307f6 100644
--- a/run/dev/Dockerfile
+++ b/run/dev/Dockerfile
@@ -9,8 +9,44 @@
 # used in production or in CI's test_sandbox job (see
 # docs/development.md) — those run run-isolated.sh directly on the runner
 # host, matching what actually happens when a user's workflow executes.
+#
+# runc and gen-seccomp-profile are built directly into this image (mirroring
+# ../docker/Dockerfile's own stages) rather than `docker cp`-extracted from
+# the proxy image at runtime, so this dev loop doesn't need the Docker
+# socket mounted in just to reach a sibling container — it stays scoped to
+# testing run-isolated.sh itself.
+# renovate: datasource=github-releases depName=opencontainers/runc
+ARG RUNC_VERSION=v1.5.1
+ARG RUNC_SHA256_AMD64=177df879d50c913eb205e898d5c1c05a18f574053c0ce5524c471208eaf06f6f
+ARG RUNC_SHA256_ARM64=ca70e7dbd6616ca782a59b5d3ac86909123fdaa9fa3f89dcf29051c70eee7ce9
+
+FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS deps
+ARG RUNC_VERSION
+ARG RUNC_SHA256_AMD64
+ARG RUNC_SHA256_ARM64
+RUN apk add --no-cache curl && \
+    mkdir -p /opt/buildcage/bin && \
+    ARCH=$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/') && \
+    EXPECTED_SHA256=$([ "$ARCH" = "amd64" ] && echo "$RUNC_SHA256_AMD64" || echo "$RUNC_SHA256_ARM64") && \
+    curl -fsSL "https://github.com/opencontainers/runc/releases/download/${RUNC_VERSION}/runc.${ARCH}" \
+      -o /opt/buildcage/bin/runc && \
+    echo "${EXPECTED_SHA256}  /opt/buildcage/bin/runc" | sha256sum -c && \
+    chmod +x /opt/buildcage/bin/runc
+
+FROM --platform=$BUILDPLATFORM golang:1.25-alpine@sha256:523c3effe300580ed375e43f43b1c9b091b68e935a7c3a92bfcc4e7ed55b18c2 AS gen-seccomp-profile-build
+ARG TARGETOS
+ARG TARGETARCH
+WORKDIR /src
+COPY docker/gen-seccomp-profile/go.mod docker/gen-seccomp-profile/go.sum ./
+RUN go mod download
+COPY docker/gen-seccomp-profile/main.go ./
+RUN CGO_ENABLED=0 GOOS="${TARGETOS}" GOARCH="${TARGETARCH}" go build -trimpath -ldflags="-s -w" -o /out/gen-seccomp-profile .
+
 FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
-RUN apk add --no-cache bash util-linux iproute2 findutils
+RUN apk add --no-cache bash util-linux iproute2 findutils jq
+
+COPY --from=deps /opt/buildcage/bin/runc /usr/local/bin/runc
+COPY --from=gen-seccomp-profile-build /out/gen-seccomp-profile /usr/local/bin/gen-seccomp-profile
 
 CMD ["sleep", "infinity"]
diff --git a/run/dev/build-test-bundle.sh b/run/dev/build-test-bundle.sh
new file mode 100755
index 0000000..74ea5ef
--- /dev/null
+++ b/run/dev/build-test-bundle.sh
@@ -0,0 +1,59 @@
+#!/bin/bash
+# build-test-bundle.sh — dev-only stand-in for isolated-exec.js's
+# buildOciConfig, used by `make test_sandbox_mode` to build just enough of
+# an OCI bundle to exercise run-isolated.sh directly (see
+# ../compose.sandbox-dev.yaml and ../dev/Dockerfile for why this dev loop
+# doesn't run the real run/dist/main.cjs, and so needs a minimal
+# hand-built substitute for the config.json JS would normally produce).
+#
+# Not a full reimplementation: no writable-path/writable-/ handling, no
+# read env passthrough beyond PATH -- just enough to run the smoke test
+# with the same namespaces/capabilities/seccomp policy production uses.
+set -euo pipefail
+
+NETNS_NAME=""
+SCRIPT_PATH=""
+BUNDLE_DIR=""
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --netns-name) NETNS_NAME="$2"; shift 2 ;;
+    --script) SCRIPT_PATH="$2"; shift 2 ;;
+    --bundle) BUNDLE_DIR="$2"; shift 2 ;;
+    *) echo "ERROR: unknown argument: $1" >&2; exit 1 ;;
+  esac
+done
+[ -z "$NETNS_NAME" ] && { echo "ERROR: --netns-name is required" >&2; exit 1; }
+[ -z "$SCRIPT_PATH" ] && { echo "ERROR: --script is required" >&2; exit 1; }
+[ -z "$BUNDLE_DIR" ] && { echo "ERROR: --bundle is required" >&2; exit 1; }
+
+mkdir -p "$BUNDLE_DIR"
+(cd "$BUNDLE_DIR" && runc spec)
+gen-seccomp-profile > "$BUNDLE_DIR/seccomp.json"
+
+printf 'nameserver 172.20.0.1\n' > "$BUNDLE_DIR/resolv.conf"
+
+jq \
+  --arg netnsPath "/var/run/netns/${NETNS_NAME}" \
+  --arg rootfsBindDir "${BUNDLE_DIR}/rootfs" \
+  --arg resolvConf "${BUNDLE_DIR}/resolv.conf" \
+  --arg scriptPath "$SCRIPT_PATH" \
+  --slurpfile seccomp "$BUNDLE_DIR/seccomp.json" \
+  --slurpfile extraMasked /etc/buildcage/extra-masked-proc-paths.json \
+  '
+  .root.path = $rootfsBindDir | .root.readonly = true |
+  .mounts += [
+    {"destination":"/etc/resolv.conf","type":"none","source":$resolvConf,"options":["rbind","ro"]},
+    {"destination":"/tmp","type":"none","source":"/tmp","options":["rbind","rw"]}
+  ] |
+  .linux.namespaces = (.linux.namespaces | map(if .type == "network" then . + {"path": $netnsPath} else . end)) |
+  .linux.seccomp = $seccomp[0] |
+  .linux.maskedPaths += $extraMasked[0] |
+  .linux.readonlyPaths -= $extraMasked[0] |
+  .process.terminal = false |
+  .process.user = {"uid": 1000, "gid": 1000} |
+  .process.args = ["setpriv", "--pdeathsig=KILL", "--", $scriptPath] |
+  .process.capabilities = {"bounding":[],"effective":[],"permitted":[],"inheritable":[],"ambient":[]} |
+  .process.noNewPrivileges = true
+  ' "$BUNDLE_DIR/config.json" > "$BUNDLE_DIR/config.json.new"
+mv "$BUNDLE_DIR/config.json.new" "$BUNDLE_DIR/config.json"
diff --git a/run/dev/smoke-test.sh b/run/dev/smoke-test.sh
index a86c03c..ff0614b 100755
--- a/run/dev/smoke-test.sh
+++ b/run/dev/smoke-test.sh
@@ -4,7 +4,53 @@
 set -e
 
 echo "=== capability / privilege-escalation checks ==="
-grep -E 'CapEff|NoNewPrivs' /proc/self/status
+if grep -q '^CapEff:[[:space:]]*0000000000000000$' /proc/self/status; then
+  echo "OK: CapEff is fully cleared"
+else
+  echo "UNEXPECTED: CapEff is not fully cleared"
+  grep 'CapEff' /proc/self/status
+  exit 1
+fi
+if grep -q '^NoNewPrivs:[[:space:]]*1$' /proc/self/status; then
+  echo "OK: NoNewPrivs is set"
+else
+  echo "UNEXPECTED: NoNewPrivs is not set"
+  grep 'NoNewPrivs' /proc/self/status
+  exit 1
+fi
+
+echo "=== filesystem policy: /tmp writable, root read-only elsewhere ==="
+if echo x >> /tmp/.buildcage-smoke-writable-test; then
+  echo "OK: /tmp is writable"
+else
+  echo "UNEXPECTED: /tmp was not writable"
+  exit 1
+fi
+if touch /etc/.buildcage-smoke-should-fail 2>/dev/null; then
+  echo "UNEXPECTED: /etc was writable"
+  exit 1
+else
+  echo "OK: /etc is read-only"
+fi
+
+echo "=== sandbox escape: host / must not be re-exposed via the rootfs bind ==="
+# The `mount --rbind /` rootfs lives under the bundle dir at
+# /var/tmp/buildcage/dev-bundle/rootfs. Because /var/tmp is not one of the writable
+# exceptions (only /tmp is bound writable), the writable rbinds don't
+# recursively re-expose it, so this path stays empty inside the sandbox.
+if [ -e /var/tmp/buildcage/dev-bundle/rootfs/etc ] || [ -e /var/tmp/buildcage/dev-bundle/rootfs/bin ]; then
+  echo "UNEXPECTED: host / reachable via /var/tmp/buildcage/dev-bundle/rootfs (sandbox escape!)"
+  ls -la /var/tmp/buildcage/dev-bundle/rootfs 2>/dev/null
+  exit 1
+else
+  echo "OK: /var/tmp/buildcage/dev-bundle/rootfs is empty (host / not re-exposed)"
+fi
+if echo x > /var/tmp/buildcage/dev-bundle/rootfs/etc/.buildcage-escape 2>/dev/null; then
+  echo "UNEXPECTED: wrote to host / via /var/tmp/buildcage/dev-bundle/rootfs (sandbox escape!)"
+  exit 1
+else
+  echo "OK: cannot write host / via /var/tmp/buildcage/dev-bundle/rootfs"
+fi
 
 echo "=== allowlisted host must be reachable ==="
 wget -q -T 5 -O /dev/null http://example.com/ && echo "OK: example.com reachable"
diff --git a/run/dist/main.cjs b/run/dist/main.cjs
index 2c9264b..75f5e52 100644
--- a/run/dist/main.cjs
+++ b/run/dist/main.cjs
@@ -7265,6 +7265,10 @@ class SandboxError extends Error {
   }
 }
 
+function buildDockerCpArgs({containerName: containerName, containerPath: containerPath, hostPath: hostPath}) {
+  return [ "cp", `${containerName}:${containerPath}`, hostPath ];
+}
+
 function buildComposeUpArgs({composeFile: composeFile, projectName: projectName, pullPolicy: pullPolicy}) {
   return [ "compose", "-f", composeFile, "-p", projectName, "up", "-d", "--pull", pullPolicy, "--no-build", "--wait", "--quiet-pull" ];
 }
@@ -7273,24 +7277,166 @@ function buildComposeDownArgs({composeFile: composeFile, projectName: projectNam
   return [ "compose", "-f", composeFile, "-p", projectName, "down" ];
 }
 
+var EXTRA_MASKED_PROC_PATHS = [ "/proc/kallsyms", "/proc/kmsg", "/proc/sysrq-trigger" ];
+
 const __dirname$2 = path.dirname(node_url.fileURLToPath("undefined" == typeof document ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && "SCRIPT" === _documentCurrentScript.tagName.toUpperCase() && _documentCurrentScript.src || new URL("main.cjs", document.baseURI).href));
 
-function runIsolated({scriptPath: scriptPath, proxyPid: proxyPid, workdir: workdir, home: home, writablePaths: writablePaths = [], env: env, runScriptDir: runScriptDir}) {
-  const runIsolatedShPath = path.join(__dirname$2, "..", "scripts", "run-isolated.sh"), envFilePath = function(env, dir) {
-    const envFilePath = path.join(dir, "env-dump.bin"), buf = Buffer.concat(Object.entries(env).filter(([, v]) => void 0 !== v).map(([k, v]) => Buffer.from(`${k}=${v}\0`, "utf8")));
-    return node_fs.writeFileSync(envFilePath, buf, {
-      mode: 384
-    }), envFilePath;
-  }(env, runScriptDir), args = [ "-n", "--", runIsolatedShPath, "--proxy-pid", String(proxyPid), "--uid", String(process.getuid()), "--gid", String(process.getgid()), "--env-file", envFilePath ];
-  workdir && args.push("--workdir", workdir), home && args.push("--home", home);
-  for (const p of writablePaths) args.push("--writable", p);
-  args.push("--", scriptPath);
+function extractRuncBootstrap({containerName: containerName, destDir: destDir}) {
+  const runcPath = path.join(destDir, "runc"), genSeccompProfilePath = path.join(destDir, "gen-seccomp-profile");
+  node_child_process.execFileSync("docker", buildDockerCpArgs({
+    containerName: containerName,
+    containerPath: "/opt/buildcage/bin/runc",
+    hostPath: runcPath
+  })), node_child_process.execFileSync("docker", buildDockerCpArgs({
+    containerName: containerName,
+    containerPath: "/opt/buildcage/bin/gen-seccomp-profile",
+    hostPath: genSeccompProfilePath
+  })), node_fs.chmodSync(runcPath, 493), node_fs.chmodSync(genSeccompProfilePath, 493);
+  const seccompProfile = JSON.parse(node_child_process.execFileSync(genSeccompProfilePath, {
+    encoding: "utf8"
+  })), baseSpec = function(runcPath, bundleDir) {
+    return node_child_process.execFileSync(runcPath, [ "spec" ], {
+      cwd: bundleDir
+    }), JSON.parse(node_fs.readFileSync(path.join(bundleDir, "config.json"), "utf8"));
+  }(runcPath, destDir);
+  return node_fs.rmSync(genSeccompProfilePath), {
+    runcPath: runcPath,
+    seccompProfile: seccompProfile,
+    baseSpec: baseSpec
+  };
+}
+
+function parseMountinfo(mountinfoContent) {
+  return mountinfoContent.split("\n").filter(Boolean).map(line => {
+    const fields = line.split(" "), dashIndex = fields.indexOf("-");
+    return {
+      mountPoint: fields[4],
+      fsType: fields[dashIndex + 1]
+    };
+  });
+}
+
+function computeReadonlyHostMounts(hostMounts, protectedPaths, freshMountDestinations) {
+  return hostMounts.filter(({mountPoint: mountPoint}) => "/" !== mountPoint && !freshMountDestinations.has(mountPoint) && !protectedPaths.has(mountPoint)).map(({mountPoint: mountPoint}) => mountPoint);
+}
+
+function freshMountDestinationsFrom(baseSpec) {
+  return new Set(baseSpec.mounts.map(m => m.destination));
+}
+
+const SETPRIV_CANDIDATE_PATHS = [ "/usr/bin/setpriv", "/bin/setpriv", "/usr/sbin/setpriv", "/sbin/setpriv" ];
+
+function buildOciConfig(baseSpec, {uid: uid, gid: gid, workdir: workdir, home: home, runnerTemp: runnerTemp, writablePaths: writablePaths = [], env: env, netnsPath: netnsPath, rootfsBindDir: rootfsBindDir, resolvConfPath: resolvConfPath, seccompProfile: seccompProfile, scriptPath: scriptPath, hostMounts: hostMounts = []}) {
+  const disableReadonly = writablePaths.includes("/"), mounts = [ ...baseSpec.mounts, {
+    destination: "/etc/resolv.conf",
+    type: "none",
+    source: resolvConfPath,
+    options: [ "rbind", "ro" ]
+  } ], writableDirs = [ ...new Set([ workdir, home, "/tmp", runnerTemp, ...writablePaths ].filter(Boolean)) ], protectedPaths = new Set(writableDirs);
+  if (!disableReadonly) {
+    !function(writableDirs) {
+      const overlapping = writableDirs.find(p => function(a, b) {
+        if (a === b) return !0;
+        const withSlash = p => p.endsWith("/") ? p : `${p}/`;
+        return a.startsWith(withSlash(b)) || b.startsWith(withSlash(a));
+      }(p, "/var/tmp/buildcage"));
+      if (overlapping) throw new Error(`writable path ${JSON.stringify(overlapping)} overlaps the sandbox's own scratch directory (/var/tmp/buildcage); this would re-expose the sandboxed host filesystem read-write inside the sandbox itself. Choose a writable path outside /var/tmp/buildcage.`);
+    }(writableDirs);
+    for (const p of writableDirs) mounts.push({
+      destination: p,
+      type: "none",
+      source: p,
+      options: [ "rbind", "rw" ]
+    });
+  }
+  const maskedPaths = [ ...baseSpec.linux.maskedPaths ?? [], ...EXTRA_MASKED_PROC_PATHS ], baseReadonlyPaths = (baseSpec.linux.readonlyPaths ?? []).filter(p => !EXTRA_MASKED_PROC_PATHS.includes(p)), readonlyPaths = disableReadonly ? baseReadonlyPaths : Array.from(new Set([ ...baseReadonlyPaths, ...computeReadonlyHostMounts(hostMounts, protectedPaths, freshMountDestinationsFrom(baseSpec)) ])), namespaces = baseSpec.linux.namespaces.map(ns => "network" === ns.type ? {
+    ...ns,
+    path: netnsPath
+  } : ns);
+  return {
+    ...baseSpec,
+    root: {
+      path: rootfsBindDir,
+      readonly: !disableReadonly
+    },
+    mounts: mounts,
+    process: {
+      ...baseSpec.process,
+      terminal: !1,
+      user: {
+        uid: uid,
+        gid: gid
+      },
+      args: [ SETPRIV_CANDIDATE_PATHS.find(p => node_fs.existsSync(p)) ?? "setpriv", "--pdeathsig=KILL", "--", scriptPath ],
+      env: Object.entries(env).filter(([, v]) => void 0 !== v).map(([k, v]) => `${k}=${v}`),
+      cwd: workdir || "/",
+      capabilities: {
+        bounding: [],
+        effective: [],
+        permitted: [],
+        inheritable: [],
+        ambient: []
+      },
+      noNewPrivileges: !0
+    },
+    linux: {
+      ...baseSpec.linux,
+      namespaces: namespaces,
+      seccomp: seccompProfile,
+      maskedPaths: maskedPaths,
+      readonlyPaths: readonlyPaths
+    }
+  };
+}
+
+function unmountAllUnder(dir) {
+  let mountPoints;
   try {
-    return node_child_process.execFileSync("sudo", args, {
-      stdio: "inherit"
-    }), 0;
+    mountPoints = function(mountinfoContent, dir) {
+      const prefix = dir.endsWith("/") ? dir : `${dir}/`;
+      return parseMountinfo(mountinfoContent).map(({mountPoint: mountPoint}) => mountPoint).filter(mountPoint => mountPoint === dir || mountPoint.startsWith(prefix)).sort((a, b) => b.length - a.length);
+    }(node_fs.readFileSync("/proc/self/mountinfo", "utf8"), dir);
+  } catch {
+    return;
+  }
+  for (const mountPoint of mountPoints) try {
+    node_child_process.execFileSync("sudo", [ "umount", "-R", "-l", mountPoint ], {
+      stdio: [ "ignore", "ignore", "pipe" ]
+    });
   } catch (e) {
-    return "number" == typeof e.status ? e.status : 1;
+    console.log(`::warning::Failed to unmount ${mountPoint} before cleanup: ${e.message}`);
+  }
+}
+
+function cleanupScratchDir(dir) {
+  unmountAllUnder(dir), function(dir) {
+    for (let attempt = 1; attempt <= 5; attempt++) try {
+      return void node_fs.rmSync(dir, {
+        recursive: !0,
+        force: !0
+      });
+    } catch (e) {
+      if ("EBUSY" !== e.code || 5 === attempt) throw e;
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 200);
+    }
+  }(dir);
+}
+
+function withScratchDir(fn, containerName) {
+  let dir;
+  node_fs.mkdirSync("/var/tmp/buildcage", {
+    recursive: !0,
+    mode: 493
+  }), containerName ? (dir = function(containerName) {
+    return path.join("/var/tmp/buildcage", containerName.replace(/^buildcage-proxy-/, "sandbox-"));
+  }(containerName), cleanupScratchDir(dir), node_fs.mkdirSync(dir, {
+    recursive: !0,
+    mode: 448
+  })) : dir = node_fs.mkdtempSync(path.join("/var/tmp/buildcage", "sandbox-"));
+  try {
+    return fn(dir);
+  } finally {
+    cleanupScratchDir(dir);
   }
 }
 
@@ -7482,33 +7628,75 @@ process.argv[1] === node_url.fileURLToPath("undefined" == typeof document ? requ
       }
     }(containerName);
     if (null === proxyPid) throw new SandboxError(`Sandbox proxy container ${containerName} is not running.`, "PROXY_NOT_RUNNING");
-    exitCode = function(fn) {
-      const dir = node_fs.mkdtempSync(path.join(os.tmpdir(), "buildcage-sandbox-"));
+    const gateway = "172.20.0.1", dns = "172.20.0.1", targetIp = "172.20.0.101";
+    exitCode = withScratchDir(dir => {
+      let runcPath, seccompProfile, baseSpec;
       try {
-        return fn(dir);
-      } finally {
-        node_fs.rmSync(dir, {
-          recursive: !0,
-          force: !0
+        ({runcPath: runcPath, seccompProfile: seccompProfile, baseSpec: baseSpec} = extractRuncBootstrap({
+          containerName: containerName,
+          destDir: dir
+        }));
+      } catch (e) {
+        throw new SandboxError(`Failed to extract runc/gen-seccomp-profile from the proxy image: ${e.message}`, "RUNC_EXTRACT_FAILED");
+      }
+      const workdir = env.GITHUB_WORKSPACE || "", home = env.HOME || "", netnsName = containerName.replace(/^buildcage-proxy-/, "buildcage-sandbox-"), rootfsBindDir = path.join(dir, "rootfs");
+      let config;
+      try {
+        const resolvConfPath = function(dns, dir) {
+          const resolvConfPath = path.join(dir, "resolv.conf");
+          return node_fs.writeFileSync(resolvConfPath, `nameserver ${dns}\n`, {
+            mode: 420
+          }), resolvConfPath;
+        }(dns, dir), scriptPath = function(runInput, dir) {
+          const scriptPath = path.join(dir, "run-script.sh"), content = runInput.startsWith("#!") ? runInput : `#!/bin/sh\nset -e\n${runInput}\n`;
+          return node_fs.writeFileSync(scriptPath, content, {
+            mode: 448
+          }), scriptPath;
+        }(runInput, dir), hostMounts = parseMountinfo(node_fs.readFileSync("/proc/self/mountinfo", "utf8"));
+        config = buildOciConfig(baseSpec, {
+          uid: process.getuid(),
+          gid: process.getgid(),
+          workdir: workdir,
+          home: home,
+          runnerTemp: env.RUNNER_TEMP || "",
+          writablePaths: writablePaths,
+          env: env,
+          netnsPath: `/var/run/netns/${netnsName}`,
+          rootfsBindDir: rootfsBindDir,
+          resolvConfPath: resolvConfPath,
+          seccompProfile: seccompProfile,
+          scriptPath: scriptPath,
+          hostMounts: hostMounts
         });
+      } catch (e) {
+        throw new SandboxError(`Failed to build the sandbox's OCI bundle: ${e.message}`, "OCI_CONFIG_BUILD_FAILED");
       }
-    }(dir => {
-      const scriptPath = function(runInput, dir) {
-        const scriptPath = path.join(dir, "run-script.sh"), content = runInput.startsWith("#!") ? runInput : `#!/bin/sh\nset -e\n${runInput}\n`;
-        return node_fs.writeFileSync(scriptPath, content, {
-          mode: 448
-        }), scriptPath;
-      }(runInput, dir);
-      return runIsolated({
-        scriptPath: scriptPath,
+      return function(config, bundleDir) {
+        const configPath = path.join(bundleDir, "config.json");
+        node_fs.writeFileSync(configPath, JSON.stringify(config), {
+          mode: 384
+        });
+      }(config, dir), function({runcPath: runcPath, proxyPid: proxyPid, bundleDir: bundleDir, containerId: containerId, netnsName: netnsName, rootfsBindDir: rootfsBindDir, gateway: gateway, dns: dns, targetIp: targetIp}) {
+        const args = [ "-n", "--", path.join(__dirname$2, "..", "scripts", "run-isolated.sh"), "--proxy-pid", String(proxyPid), "--runc", runcPath, "--bundle", bundleDir, "--container-id", containerId, "--netns-name", netnsName, "--rootfs-bind-dir", rootfsBindDir, "--gateway", gateway, "--dns", dns, "--target-ip", targetIp ];
+        try {
+          return node_child_process.execFileSync("sudo", args, {
+            stdio: "inherit"
+          }), 0;
+        } catch (e) {
+          return "number" == typeof e.status ? e.status : 1;
+        }
+      }({
+        runcPath: runcPath,
         proxyPid: proxyPid,
-        workdir: env.GITHUB_WORKSPACE || "",
-        home: env.HOME || "",
-        writablePaths: writablePaths,
-        env: env,
-        runScriptDir: dir
+        bundleDir: dir,
+        containerId: containerName,
+        netnsName: netnsName,
+        rootfsBindDir: rootfsBindDir,
+        gateway: gateway,
+        dns: dns,
+        targetIp: targetIp
       });
-    });
+    }, containerName);
   } finally {
     try {
       const report = function(containerName) {
diff --git a/run/dist/post.cjs b/run/dist/post.cjs
index 6d1a84c..aeee644 100644
--- a/run/dist/post.cjs
+++ b/run/dist/post.cjs
@@ -1,9 +1,63 @@
 "use strict";
 
-var node_child_process = require("node:child_process"), node_path = require("node:path"), node_url = require("node:url"), _documentCurrentScript = "undefined" != typeof document ? document.currentScript : null;
+var node_child_process = require("node:child_process"), node_fs = require("node:fs"), node_path = require("node:path"), node_url = require("node:url");
+
+require("node:crypto");
+
+var _documentCurrentScript = "undefined" != typeof document ? document.currentScript : null;
+
+node_path.dirname(node_url.fileURLToPath("undefined" == typeof document ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && "SCRIPT" === _documentCurrentScript.tagName.toUpperCase() && _documentCurrentScript.src || new URL("post.cjs", document.baseURI).href));
+
+function parseMountsUnder(mountinfoContent, dir) {
+  const prefix = dir.endsWith("/") ? dir : `${dir}/`;
+  return function(mountinfoContent) {
+    return mountinfoContent.split("\n").filter(Boolean).map(line => {
+      const fields = line.split(" "), dashIndex = fields.indexOf("-");
+      return {
+        mountPoint: fields[4],
+        fsType: fields[dashIndex + 1]
+      };
+    });
+  }(mountinfoContent).map(({mountPoint: mountPoint}) => mountPoint).filter(mountPoint => mountPoint === dir || mountPoint.startsWith(prefix)).sort((a, b) => b.length - a.length);
+}
 
 const __dirname$1 = node_path.dirname(node_url.fileURLToPath("undefined" == typeof document ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && "SCRIPT" === _documentCurrentScript.tagName.toUpperCase() && _documentCurrentScript.src || new URL("post.cjs", document.baseURI).href)), containerName = process.env.STATE_container_name, projectName = process.env.STATE_project_name;
 
+if (containerName?.startsWith("buildcage-proxy-")) try {
+  const scratchDir = function(containerName) {
+    return node_path.join("/var/tmp/buildcage", containerName.replace(/^buildcage-proxy-/, "sandbox-"));
+  }(containerName);
+  node_fs.existsSync(scratchDir) && (function(dir) {
+    let mountPoints;
+    try {
+      mountPoints = parseMountsUnder(node_fs.readFileSync("/proc/self/mountinfo", "utf8"), dir);
+    } catch {
+      return;
+    }
+    for (const mountPoint of mountPoints) try {
+      node_child_process.execFileSync("sudo", [ "umount", "-R", "-l", mountPoint ], {
+        stdio: [ "ignore", "ignore", "pipe" ]
+      });
+    } catch (e) {
+      console.log(`::warning::Failed to unmount ${mountPoint} before cleanup: ${e.message}`);
+    }
+  }(dir = scratchDir), function(dir) {
+    for (let attempt = 1; attempt <= 5; attempt++) try {
+      return void node_fs.rmSync(dir, {
+        recursive: !0,
+        force: !0
+      });
+    } catch (e) {
+      if ("EBUSY" !== e.code || 5 === attempt) throw e;
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 200);
+    }
+  }(dir));
+} catch (e) {
+  console.log(`::warning::run post-cleanup: failed to remove sandbox scratch dir: ${e.message}`);
+}
+
+var dir;
+
 containerName && projectName ? node_child_process.execFileSync("docker", function({composeFile: composeFile, projectName: projectName}) {
   return [ "compose", "-f", composeFile, "-p", projectName, "down" ];
 }({
diff --git a/run/docker/Dockerfile b/run/docker/Dockerfile
index 4f957a6..31cc3ae 100644
--- a/run/docker/Dockerfile
+++ b/run/docker/Dockerfile
@@ -1,9 +1,45 @@
+# renovate: datasource=github-releases depName=opencontainers/runc
+ARG RUNC_VERSION=v1.5.1
+ARG RUNC_SHA256_AMD64=177df879d50c913eb205e898d5c1c05a18f574053c0ce5524c471208eaf06f6f
+ARG RUNC_SHA256_ARM64=ca70e7dbd6616ca782a59b5d3ac86909123fdaa9fa3f89dcf29051c70eee7ce9
+
+# Prepare dependencies — runc's official release binaries are already
+# statically linked (including libseccomp), so no compilation is needed,
+# only a checksum-pinned download (see docs/development.md).
+FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS deps
+ARG RUNC_VERSION
+ARG RUNC_SHA256_AMD64
+ARG RUNC_SHA256_ARM64
+RUN apk add --no-cache curl && \
+    mkdir -p /opt/buildcage/bin && \
+    ARCH=$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/') && \
+    EXPECTED_SHA256=$([ "$ARCH" = "amd64" ] && echo "$RUNC_SHA256_AMD64" || echo "$RUNC_SHA256_ARM64") && \
+    curl -fsSL "https://github.com/opencontainers/runc/releases/download/${RUNC_VERSION}/runc.${ARCH}" \
+      -o /opt/buildcage/bin/runc && \
+    echo "${EXPECTED_SHA256}  /opt/buildcage/bin/runc" | sha256sum -c && \
+    chmod +x /opt/buildcage/bin/runc
+
+# Building gen-seccomp-profile here only compiles the binary — it's
+# extracted onto the runner host and run natively there, not at image
+# build time; see gen-seccomp-profile/main.go for why. Pure Go
+# (CGO_ENABLED=0), so this cross-compiles natively via BUILDPLATFORM
+# without needing QEMU, same as buildkit-proxy-build in
+# setup/docker/explicit/Dockerfile.
+FROM --platform=$BUILDPLATFORM golang:1.25-alpine@sha256:523c3effe300580ed375e43f43b1c9b091b68e935a7c3a92bfcc4e7ed55b18c2 AS gen-seccomp-profile-build
+ARG TARGETOS
+ARG TARGETARCH
+WORKDIR /src
+COPY run/docker/gen-seccomp-profile/go.mod run/docker/gen-seccomp-profile/go.sum ./
+RUN go mod download
+COPY run/docker/gen-seccomp-profile/main.go ./
+RUN CGO_ENABLED=0 GOOS="${TARGETOS}" GOARCH="${TARGETARCH}" go build -trimpath -ldflags="-s -w" -o /out/gen-seccomp-profile .
+
 # Final image
 FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 LABEL org.opencontainers.image.title="buildcage-proxy" \
       org.opencontainers.image.description="Network-isolated proxy for arbitrary GitHub Actions commands" \
-      org.opencontainers.image.licenses="MIT AND GPL-2.0-or-later" \
+      org.opencontainers.image.licenses="MIT AND GPL-2.0-or-later AND Apache-2.0" \
       org.opencontainers.image.source="https://github.com/dash14/buildcage"
 
 RUN apk add --no-cache \
@@ -31,6 +67,15 @@ COPY run/docker/files/haproxy.cfg.template /etc/haproxy/haproxy.cfg.template
 COPY core/scripts/ /opt/buildcage/scripts/
 COPY core/shared/  /opt/buildcage/shared/
 
+# runc — extracted onto the runner host at `run` action startup and used by
+# run-isolated.sh to execute the isolated command (see docs/development.md)
+COPY --from=deps /opt/buildcage/bin/runc /opt/buildcage/bin/runc
+
+# gen-seccomp-profile — extracted onto the runner host and run natively
+# there (not inside this container) to produce the seccomp filter embedded
+# in runc's config.json; see the build stage comment above for why.
+COPY --from=gen-seccomp-profile-build /out/gen-seccomp-profile /opt/buildcage/bin/gen-seccomp-profile
+
 # License
 COPY run/docker/files/THIRD_PARTY_LICENSES /opt/buildcage/THIRD_PARTY_LICENSES
 
diff --git a/run/docker/files/THIRD_PARTY_LICENSES b/run/docker/files/THIRD_PARTY_LICENSES
index 25561dc..dc75e24 100644
--- a/run/docker/files/THIRD_PARTY_LICENSES
+++ b/run/docker/files/THIRD_PARTY_LICENSES
@@ -36,6 +36,16 @@ QuickJS
 
 ------------------------------------------------------------------------------
 
+runc
+  Website : https://github.com/opencontainers/runc
+  License : Apache License 2.0 (Apache-2.0)
+  Source  : https://github.com/opencontainers/runc
+  Note    : Official pre-built release binary, checksum-pinned in
+            run/docker/Dockerfile. Extracted onto the runner host at `run`
+            action startup and used by run-isolated.sh.
+
+------------------------------------------------------------------------------
+
 Note on GPL components (HAProxy, dnsmasq):
 
 These components are installed from the Alpine Linux official package
diff --git a/run/docker/gen-seccomp-profile/go.mod b/run/docker/gen-seccomp-profile/go.mod
new file mode 100644
index 0000000..c027de8
--- /dev/null
+++ b/run/docker/gen-seccomp-profile/go.mod
@@ -0,0 +1,10 @@
+module github.com/dash14/buildcage/gen-seccomp-profile
+
+go 1.25
+
+require (
+	github.com/moby/profiles/seccomp v0.2.3
+	github.com/opencontainers/runtime-spec v1.3.0
+)
+
+require golang.org/x/sys v0.33.0 // indirect
diff --git a/run/docker/gen-seccomp-profile/go.sum b/run/docker/gen-seccomp-profile/go.sum
new file mode 100644
index 0000000..aff7c01
--- /dev/null
+++ b/run/docker/gen-seccomp-profile/go.sum
@@ -0,0 +1,6 @@
+github.com/moby/profiles/seccomp v0.2.3 h1:nrHNSiECQQvq4WjgceCUgJXIXUJBIswVQ133k4Do2mA=
+github.com/moby/profiles/seccomp v0.2.3/go.mod h1:8m3qkkWZXrRsMqlUUN2zyccnYmBf3EAdQYPMVJ3NBhk=
+github.com/opencontainers/runtime-spec v1.3.0 h1:YZupQUdctfhpZy3TM39nN9Ika5CBWT5diQ8ibYCRkxg=
+github.com/opencontainers/runtime-spec v1.3.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
diff --git a/run/docker/gen-seccomp-profile/main.go b/run/docker/gen-seccomp-profile/main.go
new file mode 100644
index 0000000..3eb7cb9
--- /dev/null
+++ b/run/docker/gen-seccomp-profile/main.go
@@ -0,0 +1,55 @@
+// gen-seccomp-profile resolves moby/profiles' Docker default seccomp
+// profile into the OCI Runtime Spec form runc's config.json expects,
+// against a synthetic spec with an empty capability set (matching the
+// sandboxed process, which always runs with its capability bounding set
+// fully cleared). Writes the result to stdout as JSON.
+//
+// This binary is compiled at buildcage's own image-build time but is not
+// meant to be *run* then: its output depends on the architecture and the
+// actual kernel of whatever machine runs it (a handful of syscalls in the
+// profile are gated by a real uname(2) call via a minKernel condition), so
+// it must be run on the real target — extracted from the proxy image onto
+// the GitHub Actions runner host (docker cp, same mechanism used for
+// runc) and invoked natively there, before any namespace isolation is set
+// up for the sandboxed command. See docs/development.md.
+//
+// If the kernel it happens to run on doesn't match the actual runner
+// exactly (not expected in normal operation, since it's the same host),
+// the risk is asymmetric and low-severity either way: a syscall wrongly
+// included just fails with ENOSYS on a kernel that lacks it (not a
+// security issue), and a syscall wrongly excluded only breaks a tool that
+// needed it (a compatibility issue, not a widened attack surface) — it can
+// never result in a *more* permissive filter than intended.
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+
+	"github.com/moby/profiles/seccomp"
+	specs "github.com/opencontainers/runtime-spec/specs-go"
+)
+
+func main() {
+	rs := &specs.Spec{
+		Process: &specs.Process{
+			Capabilities: &specs.LinuxCapabilities{
+				Bounding: []string{},
+			},
+		},
+	}
+
+	linuxSeccomp, err := seccomp.GetDefaultProfile(rs)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "gen-seccomp-profile:", err)
+		os.Exit(1)
+	}
+
+	// Machine-readable only (isolated-exec.js's getOrPopulateBootstrapCache
+	// JSON.parses this straight off stdout) -- no pretty-printing needed.
+	if err := json.NewEncoder(os.Stdout).Encode(linuxSeccomp); err != nil {
+		fmt.Fprintln(os.Stderr, "gen-seccomp-profile:", err)
+		os.Exit(1)
+	}
+}
diff --git a/run/scripts/extra-masked-proc-paths.json b/run/scripts/extra-masked-proc-paths.json
new file mode 100644
index 0000000..3203f29
--- /dev/null
+++ b/run/scripts/extra-masked-proc-paths.json
@@ -0,0 +1,5 @@
+[
+  "/proc/kallsyms",
+  "/proc/kmsg",
+  "/proc/sysrq-trigger"
+]
diff --git a/run/scripts/run-isolated.sh b/run/scripts/run-isolated.sh
index 6c90feb..aed6426 100755
--- a/run/scripts/run-isolated.sh
+++ b/run/scripts/run-isolated.sh
@@ -1,132 +1,151 @@
 #!/bin/bash
-# run-isolated.sh — run a command in a network-isolated sandbox.
+# run-isolated.sh — run a command in a network-isolated sandbox via runc.
 #
-# Creates a throwaway network/pid/mount/uts/ipc/cgroup namespace, wires a
-# veth pair into the buildcage-proxy container's "sandbox0" bridge,
-# strips all capabilities and privilege-escalation paths from the target
-# process, and execs the given script inside it.
+# Creates a network namespace, wires a veth pair into the buildcage-proxy
+# container's "sandbox0" bridge, bind-mounts the host's own "/" so it can
+# be handed to runc as a read-only rootfs, and execs `runc run` against an
+# OCI bundle (config.json) that isolated-exec.js has already fully built --
+# namespaces, capabilities, mounts, uid/gid, and the seccomp filter are all
+# declared there. This script only sets up what runc itself cannot: the
+# network namespace's veth wiring into the proxy's bridge, and the rootfs
+# bind-mount runc needs as its root.path (pivot_root can't target "/"
+# itself).
 #
 # Must be run as root (invoked via `sudo -n` from the run action).
 set -euo pipefail
 
+# Re-exec into a fresh, private mount namespace before doing anything else.
+# Every concurrently running `run:` step's own scratch dir lives under the
+# same /tmp, so without this, the `mount --rbind /` staging below (and `ip
+# netns add`'s own bind-mount of /run/netns) would run in the one mount
+# namespace shared by every step on the host -- unavoidably nesting a copy
+# of each concurrently running step's rootfs tree inside every other's
+# snapshot, which races their unmount/rmdir cleanup against each other.
+# With this, everything this script mounts is invisible to (and
+# unaffected by) every other concurrent invocation from the moment it's
+# created. `--propagation private` is `unshare`'s shortcut for "unshare +
+# recursively make every mount private" in one step. No `--fork`, so this
+# and the subsequent exec replace the current process in place -- this
+# script's PID (and /proc/self/cmdline, matched by
+# integration-test-die-with-parent.sh's pgrep) stays the same across the
+# re-exec.
+if [ -z "${BUILDCAGE_UNSHARED:-}" ]; then
+  command -v unshare >/dev/null 2>&1 || { echo "ERROR: required command not found: unshare" >&2; exit 1; }
+  export BUILDCAGE_UNSHARED=1
+  exec unshare --mount --propagation private -- "$0" "$@"
+fi
+
 PROXY_PID=""
-TARGET_UID=""
-TARGET_GID=""
-GATEWAY="172.20.0.1"
-DNS="172.20.0.1"
-TARGET_IP="172.20.0.101"
-WORKDIR=""
-HOME_DIR=""
-ENV_FILE=""
-SCRIPT_PATH=""
-WRITABLE_PATHS=()
+RUNC_PATH=""
+BUNDLE_DIR=""
+CONTAINER_ID=""
+NETNS_NAME=""
+ROOTFS_BIND_DIR=""
+GATEWAY=""
+DNS=""
+TARGET_IP=""
 
 usage() {
   cat >&2 <<'EOF'
-Usage: run-isolated.sh --proxy-pid <PID> --uid <UID> --gid <GID>
-         [--gateway <IP>] [--dns <IP>] [--target-ip <IP>]
-         [--workdir <PATH>] [--home <PATH>] [--writable <PATH>]...
-         [--env-file <PATH>] -- <script-path>
+Usage: run-isolated.sh --proxy-pid <PID> --runc <PATH> --bundle <DIR>
+         --container-id <ID> --netns-name <NAME> --rootfs-bind-dir <DIR>
+         --gateway <IP> --dns <IP> --target-ip <IP>
 EOF
 }
 
 while [ $# -gt 0 ]; do
   case "$1" in
     --proxy-pid) PROXY_PID="$2"; shift 2 ;;
-    --uid) TARGET_UID="$2"; shift 2 ;;
-    --gid) TARGET_GID="$2"; shift 2 ;;
+    --runc) RUNC_PATH="$2"; shift 2 ;;
+    --bundle) BUNDLE_DIR="$2"; shift 2 ;;
+    --container-id) CONTAINER_ID="$2"; shift 2 ;;
+    --netns-name) NETNS_NAME="$2"; shift 2 ;;
+    --rootfs-bind-dir) ROOTFS_BIND_DIR="$2"; shift 2 ;;
     --gateway) GATEWAY="$2"; shift 2 ;;
     --dns) DNS="$2"; shift 2 ;;
     --target-ip) TARGET_IP="$2"; shift 2 ;;
-    --workdir) WORKDIR="$2"; shift 2 ;;
-    --home) HOME_DIR="$2"; shift 2 ;;
-    --writable) WRITABLE_PATHS+=("$2"); shift 2 ;;
-    --env-file) ENV_FILE="$2"; shift 2 ;;
-    --) shift; SCRIPT_PATH="${1:-}"; shift || true; break ;;
     -h|--help) usage; exit 0 ;;
     *) echo "ERROR: unknown argument: $1" >&2; usage; exit 1 ;;
   esac
 done
 
 [ -z "$PROXY_PID" ] && { echo "ERROR: --proxy-pid is required" >&2; usage; exit 1; }
-[ -z "$TARGET_UID" ] && { echo "ERROR: --uid is required" >&2; usage; exit 1; }
-[ -z "$TARGET_GID" ] && { echo "ERROR: --gid is required" >&2; usage; exit 1; }
-[ -z "$SCRIPT_PATH" ] && { echo "ERROR: script path is required after --" >&2; usage; exit 1; }
+[ -z "$RUNC_PATH" ] && { echo "ERROR: --runc is required" >&2; usage; exit 1; }
+[ -z "$BUNDLE_DIR" ] && { echo "ERROR: --bundle is required" >&2; usage; exit 1; }
+[ -z "$CONTAINER_ID" ] && { echo "ERROR: --container-id is required" >&2; usage; exit 1; }
+[ -z "$NETNS_NAME" ] && { echo "ERROR: --netns-name is required" >&2; usage; exit 1; }
+[ -z "$ROOTFS_BIND_DIR" ] && { echo "ERROR: --rootfs-bind-dir is required" >&2; usage; exit 1; }
+[ -z "$GATEWAY" ] && { echo "ERROR: --gateway is required" >&2; usage; exit 1; }
+[ -z "$DNS" ] && { echo "ERROR: --dns is required" >&2; usage; exit 1; }
+[ -z "$TARGET_IP" ] && { echo "ERROR: --target-ip is required" >&2; usage; exit 1; }
 
 if [ "$(id -u)" != "0" ]; then
   echo "ERROR: run-isolated.sh must be run as root (via sudo)" >&2
   exit 1
 fi
-for cmd in unshare nsenter setpriv ip env; do
+for cmd in nsenter ip mount setpriv; do
   command -v "$cmd" >/dev/null 2>&1 || { echo "ERROR: required command not found: $cmd" >&2; exit 1; }
 done
 [ -e "/proc/${PROXY_PID}/ns/net" ] || { echo "ERROR: proxy netns not found for pid ${PROXY_PID}" >&2; exit 1; }
-[ -x "$SCRIPT_PATH" ] || { echo "ERROR: script not found or not executable: ${SCRIPT_PATH}" >&2; exit 1; }
+[ -x "$RUNC_PATH" ] || { echo "ERROR: runc not found or not executable: ${RUNC_PATH}" >&2; exit 1; }
+[ -f "${BUNDLE_DIR}/config.json" ] || { echo "ERROR: OCI bundle config not found: ${BUNDLE_DIR}/config.json" >&2; exit 1; }
 
 RAND_ID=$(od -An -tx1 -N4 /dev/urandom 2>/dev/null | tr -d ' \n')
 [ -z "$RAND_ID" ] && RAND_ID=$(printf '%08x' "$$")
 VETH_T="sbxt${RAND_ID}"
 VETH_P="sbxp${RAND_ID}"
 
-PLACEHOLDER_UNSHARE_PID=""
-PLACEHOLDER_PID=""
 CODE=1
 
 cleanup() {
   set +e
-  if [ -n "$PLACEHOLDER_PID" ]; then
-    # The proxy-side veth lives in the long-lived proxy container's netns,
-    # so it must be explicitly removed; the target-side end disappears
-    # automatically when the placeholder namespace is torn down below.
-    nsenter --net="/proc/${PROXY_PID}/ns/net" -- ip link del "$VETH_P" >/dev/null 2>&1
-  fi
-  # The placeholder ("sleep infinity") is pid 1 inside its own new pid
-  # namespace, and pid 1 ignores signals with a default action of
-  # terminate unless it installed a handler -- SIGTERM will not touch it.
-  # SIGKILL cannot be caught or ignored, so it always tears the namespace
-  # down.
-  [ -n "$PLACEHOLDER_PID" ] && kill -9 "$PLACEHOLDER_PID" >/dev/null 2>&1
-  [ -n "$PLACEHOLDER_UNSHARE_PID" ] && kill -9 "$PLACEHOLDER_UNSHARE_PID" >/dev/null 2>&1
-  wait >/dev/null 2>&1
+  # -f/--force also kills the container's process tree if it's still
+  # running (e.g. this trap fired from INT/TERM mid-run), so it must run
+  # before the network/mount resources below are torn out from under it.
+  "$RUNC_PATH" delete -f "$CONTAINER_ID" >/dev/null 2>&1
+  # Not silenced: a failed unmount here (e.g. EBUSY from a lingering
+  # process) leaves ROOTFS_BIND_DIR -- a bind-mount of the entire host
+  # filesystem -- still live, so it's worth surfacing even though
+  # isolated-exec.js's withScratchDir has its own safety net before it
+  # recursively deletes this directory.
+  UMOUNT_ERR_FILE="/tmp/.buildcage-umount-err.$$"
+  umount -R "$ROOTFS_BIND_DIR" >/dev/null 2>"$UMOUNT_ERR_FILE" || {
+    echo "WARNING: failed to unmount ${ROOTFS_BIND_DIR}: $(cat "$UMOUNT_ERR_FILE" 2>/dev/null)" >&2
+  }
+  rm -f "$UMOUNT_ERR_FILE"
+  # The proxy-side veth lives in the long-lived proxy container's netns, so
+  # it must be explicitly removed -- unlike the target-side end (torn down
+  # for free when the sandbox netns below is deleted), a still-alive
+  # namespace doesn't lose its interfaces just because its veth peer's
+  # namespace went away.
+  nsenter --net="/proc/${PROXY_PID}/ns/net" -- ip link del "$VETH_P" >/dev/null 2>&1
+  ip netns del "$NETNS_NAME" >/dev/null 2>&1
   exit "$CODE"
 }
 trap cleanup EXIT INT TERM
 
-echo "run-isolated: creating placeholder namespace..." >&2
-unshare --net --pid --mount --uts --ipc --cgroup --mount-proc --fork -- sh -c 'exec sleep infinity' &
-PLACEHOLDER_UNSHARE_PID=$!
-
-# unshare --pid does not move the calling (unshare) process itself into the
-# new pid namespace -- only the first forked child does, and *that* child's
-# host-visible PID is what nsenter needs. Discover it via procfs.
-i=0
-while [ "$i" -lt 200 ]; do
-  CHILD=$(cat "/proc/${PLACEHOLDER_UNSHARE_PID}/task/${PLACEHOLDER_UNSHARE_PID}/children" 2>/dev/null | awk '{print $1}')
-  if [ -n "$CHILD" ] && [ -e "/proc/${CHILD}/ns/net" ]; then
-    PLACEHOLDER_PID="$CHILD"
-    break
-  fi
-  i=$((i + 1))
-  sleep 0.02
-done
-[ -z "$PLACEHOLDER_PID" ] && { echo "ERROR: timed out waiting for placeholder namespace" >&2; exit 1; }
-echo "run-isolated: placeholder pid=${PLACEHOLDER_PID}" >&2
-
-# The placeholder's mount namespace starts out as a clone of the host's, and
-# a cloned mount keeps the same propagation type (typically "shared" under
-# systemd) as its origin -- meaning every bind-mount/remount below would
-# otherwise propagate straight back out to the host's real mount namespace.
-# `--make-rprivate` (recursive) detaches the whole tree from that peer group
-# before anything else touches it.
-nsenter --mount="/proc/${PLACEHOLDER_PID}/ns/mnt" -- mount --make-rprivate /
+# Bind-mounted first, before any of the network setup below: it has no
+# dependency on the netns/veth work that follows, and doing it first
+# minimizes the gap between isolated-exec.js's listHostMounts() snapshot
+# (which config.json's readonlyPaths was computed from) and this rbind
+# actually capturing the host's mount table.
+echo "run-isolated: bind-mounting host root for runc's rootfs..." >&2
+mkdir -p "$ROOTFS_BIND_DIR"
+mount --rbind / "$ROOTFS_BIND_DIR"
+# No separate `mount --make-rprivate` needed here: the whole-namespace
+# `--propagation private` set up above already makes every mount created
+# under it private by default, including this one.
+
+echo "run-isolated: creating sandbox network namespace..." >&2
+ip netns add "$NETNS_NAME"
 
 echo "run-isolated: creating veth pair ${VETH_T} <-> ${VETH_P}..." >&2
 ip link add "$VETH_T" type veth peer name "$VETH_P"
-ip link set "$VETH_T" netns "$PLACEHOLDER_PID"
+ip link set "$VETH_T" netns "$NETNS_NAME"
 ip link set "$VETH_P" netns "$PROXY_PID"
 
-echo "run-isolated: configuring target namespace network..." >&2
-nsenter --net="/proc/${PLACEHOLDER_PID}/ns/net" -- sh -c "
+echo "run-isolated: configuring sandbox namespace network..." >&2
+ip netns exec "$NETNS_NAME" sh -c "
   set -e
   ip link set '${VETH_T}' name eth0
   ip addr add '${TARGET_IP}/24' dev eth0
@@ -135,95 +154,6 @@ nsenter --net="/proc/${PLACEHOLDER_PID}/ns/net" -- sh -c "
   ip route add default via '${GATEWAY}'
 "
 
-echo "run-isolated: rewriting resolv.conf inside target mount namespace..." >&2
-nsenter --mount="/proc/${PLACEHOLDER_PID}/ns/mnt" --net="/proc/${PLACEHOLDER_PID}/ns/net" -- sh -c "
-  set -e
-  printf 'nameserver %s\n' '${DNS}' > /tmp/.buildcage-resolv.conf
-  mount --bind /tmp/.buildcage-resolv.conf /etc/resolv.conf
-"
-
-echo "run-isolated: masking sensitive /proc paths..." >&2
-nsenter --mount="/proc/${PLACEHOLDER_PID}/ns/mnt" -- sh -c '
-  for p in /proc/kcore /proc/kallsyms /proc/kmsg /proc/sysrq-trigger /proc/timer_list /proc/keys; do
-    [ -e "$p" ] && mount --bind /dev/null "$p" 2>/dev/null
-  done
-  true
-'
-
-# Paths that stay writable: workdir/home/tmp plus whatever --writable added.
-# "/" among the extras is a sentinel meaning "disable this restriction
-# entirely" (see usage()) rather than literally protecting just the "/"
-# mount entry, since most of the filesystem below "/" isn't a separate
-# mount point and so wouldn't be covered by protecting "/" alone.
-PROTECTED_PATHS=("$WORKDIR" "$HOME_DIR" /tmp)
-[ ${#WRITABLE_PATHS[@]} -gt 0 ] && PROTECTED_PATHS+=("${WRITABLE_PATHS[@]}")
-DISABLE_READONLY=false
-for p in "${WRITABLE_PATHS[@]}"; do
-  [ "$p" = "/" ] && DISABLE_READONLY=true
-done
-
-if [ "$DISABLE_READONLY" = "true" ]; then
-  echo "run-isolated: 'writable: /' given -- leaving the filesystem fully writable" >&2
-else
-  echo "run-isolated: restricting filesystem to read-only (except workdir/home/tmp/writable)..." >&2
-  # --target (not just --mount=) is required here: /proc/self/mountinfo only
-  # resolves "self" correctly when this process is actually a member of the
-  # pid namespace that the target's /proc instance was mounted for.
-  nsenter --target "$PLACEHOLDER_PID" --mount --pid -- sh -c '
-    set -e
-    # Bind-mounting a path onto itself gives it its own mount-table entry, so
-    # remounting everything else read-only below does not affect it.
-    for d in "$@"; do
-      [ -n "$d" ] && [ -d "$d" ] && mount --bind "$d" "$d"
-    done
-    # Walk existing mounts and remount each read-only in place, skipping the
-    # paths just made writable above. "bind" is required: a plain
-    # "remount,ro" changes the underlying superblock, which is shared with
-    # the mount this was cloned from (i.e. the real host mount namespace)
-    # even after make-rprivate -- only "remount,bind,ro" scopes the
-    # read-only flag to this one mount entry.
-    #
-    # A failed remount is NOT silently ignored: pseudo-filesystems that
-    # legitimately reject a read-only remount are tolerated (their
-    # writability is not a payload-planting surface for a later step), but
-    # any *real* filesystem left writable fails the run closed, so a silent
-    # remount failure can never quietly weaken the read-only guarantee
-    # documented in docs/security.md. In each mountinfo line the 6th field
-    # holds the per-mount options, and the field immediately after the
-    # " - " separator is the filesystem type.
-    tac /proc/self/mountinfo | while read -r _ _ _ _ mnt_point mnt_opts rest; do
-      skip=0
-      for p in "$@"; do
-        [ "$mnt_point" = "$p" ] && skip=1 && break
-      done
-      [ "$skip" = 1 ] && continue
-      # Already read-only per mountinfo -- no remount needed.
-      case ",${mnt_opts}," in
-        *,ro,*) continue ;;
-      esac
-      mount -o remount,bind,ro "$mnt_point" 2>/dev/null && continue
-      # Retry once, re-bound onto itself: a mount that predates this
-      # namespace (e.g. a Docker maskedPath tmpfs re-parented under
-      # --mount-proc, seen on /proc/scsi and /proc/interrupts) can reject an
-      # otherwise-safe remount until re-bound gives it a fresh mount entry.
-      mount --bind "$mnt_point" "$mnt_point" 2>/dev/null &&
-        mount -o remount,bind,ro "$mnt_point" 2>/dev/null && continue
-      fstype=${rest#*- }
-      fstype=${fstype%% *}
-      case "$fstype" in
-        proc|procfs|sysfs|cgroup|cgroup2|devpts|mqueue|debugfs|tracefs|securityfs|\
-pstore|bpf|configfs|fusectl|hugetlbfs|binfmt_misc|autofs|efivarfs|nsfs|rpc_pipefs)
-          echo "run-isolated: note: pseudo-fs ${mnt_point} (${fstype}) rejected read-only remount; tolerated" >&2
-          ;;
-        *)
-          echo "ERROR: failed to remount ${mnt_point} (${fstype:-unknown}) read-only; refusing to run with it left writable" >&2
-          exit 1
-          ;;
-      esac
-    done
-  ' sh "${PROTECTED_PATHS[@]}"
-fi
-
 echo "run-isolated: attaching proxy-side veth to sandbox0 bridge..." >&2
 nsenter --net="/proc/${PROXY_PID}/ns/net" -- sh -c "
   set -e
@@ -231,33 +161,29 @@ nsenter --net="/proc/${PROXY_PID}/ns/net" -- sh -c "
   ip link set '${VETH_P}' up
 "
 
-echo "run-isolated: executing isolated command..." >&2
+echo "run-isolated: executing isolated command via runc..." >&2
 set +e
-NSENTER_ARGS=(--target "$PLACEHOLDER_PID" --net --mount --uts --ipc --cgroup --pid)
-[ -n "$WORKDIR" ] && NSENTER_ARGS+=(--wd="$WORKDIR")
-
-if [ -n "$ENV_FILE" ]; then
-  # Read the NUL-separated KEY=VALUE dump directly into an array rather than
-  # piping it through `xargs -0`: GNU xargs maps *any* exit status 1-125 from
-  # the command it runs to its own fixed exit status 123 (255 becomes 124),
-  # which would make it impossible for this script to report the isolated
-  # command's actual exit code.
-  # No "--" before setpriv: env treats the first non-NAME=VALUE token as
-  # the command to run on its own.
-  mapfile -d '' -t ENV_ASSIGNMENTS < "$ENV_FILE"
-  nsenter "${NSENTER_ARGS[@]}" -- \
-    env -i "${ENV_ASSIGNMENTS[@]}" \
-    setpriv --reuid="$TARGET_UID" --regid="$TARGET_GID" --clear-groups \
-      --bounding-set=-all --no-new-privs -- \
-    "$SCRIPT_PATH"
-  CODE=$?
-else
-  nsenter "${NSENTER_ARGS[@]}" -- \
-    setpriv --reuid="$TARGET_UID" --regid="$TARGET_GID" --clear-groups \
-      --bounding-set=-all --no-new-privs -- \
-    "$SCRIPT_PATH"
-  CODE=$?
-fi
+# No nsenter wrapper needed here: config.json's linux.namespaces network
+# entry already points at /var/run/netns/${NETNS_NAME}, so runc joins it
+# itself as part of its own container setup.
+#
+# setpriv --pdeathsig here (targeting this script's own life) is the first
+# half of a two-hop die-with-parent chain: `runc run`'s own process, not
+# the container process it starts, is this script's direct child, so a
+# guard on just the *sandboxed* process (config.json's process.args, see
+# buildOciConfig) would only protect against `runc run` itself dying --
+# without this outer hop, SIGKILL-ing this script would leave `runc run`
+# (and the sandboxed process under it) as a still-alive orphan.
+#
+# Known residual gap: on distros with the common `Defaults use_pty`
+# sudoers setting, `sudo -n` forks a separate monitor process ahead of
+# this script -- killing *that* specific process in isolation wouldn't
+# trigger this chain, since this script would merely become its orphan,
+# still alive. Low-severity (an orphaned but still-fully-sandboxed
+# process, not a security boundary issue -- see docs/security.md), and
+# not addressed here.
+setpriv --pdeathsig=KILL -- "$RUNC_PATH" run --bundle "$BUNDLE_DIR" "$CONTAINER_ID"
+CODE=$?
 set -e
 
 echo "run-isolated: command exited with code ${CODE}" >&2
diff --git a/run/src/lib/container.js b/run/src/lib/container.js
index 1f718de..fadb7fe 100644
--- a/run/src/lib/container.js
+++ b/run/src/lib/container.js
@@ -34,6 +34,16 @@ export function deriveProjectName(containerName) {
   return containerName;
 }
 
+/**
+ * Build the `docker cp` argv for extracting a single file from a running
+ * container onto the host filesystem — used to pull runc and
+ * gen-seccomp-profile out of the proxy image before run-isolated.sh runs
+ * (see lib/isolated-exec.js).
+ */
+export function buildDockerCpArgs({ containerName, containerPath, hostPath }) {
+  return ["cp", `${containerName}:${containerPath}`, hostPath];
+}
+
 /**
  * Returns the container's PID (as seen from the Docker host's PID
  * namespace), or null if the container doesn't exist / isn't running.
diff --git a/run/src/lib/container.test.js b/run/src/lib/container.test.js
index 49bfb2e..e885460 100644
--- a/run/src/lib/container.test.js
+++ b/run/src/lib/container.test.js
@@ -1,7 +1,7 @@
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
 
-import { generateContainerName, getContainerPid, deriveProjectName } from "./container.js";
+import { generateContainerName, getContainerPid, deriveProjectName, buildDockerCpArgs } from "./container.js";
 
 describe("generateContainerName", () => {
   it("always starts with the buildcage-proxy- prefix", () => {
@@ -20,6 +20,15 @@ describe("getContainerPid", () => {
   });
 });
 
+describe("buildDockerCpArgs", () => {
+  it("builds a `docker cp <container>:<containerPath> <hostPath>` argv", () => {
+    assert.deepEqual(
+      buildDockerCpArgs({ containerName: "buildcage-proxy-abcd1234", containerPath: "/opt/buildcage/bin/runc", hostPath: "/tmp/x/runc" }),
+      ["cp", "buildcage-proxy-abcd1234:/opt/buildcage/bin/runc", "/tmp/x/runc"],
+    );
+  });
+});
+
 describe("deriveProjectName", () => {
   it("returns the container name unchanged", () => {
     assert.equal(deriveProjectName("buildcage-proxy-abcd1234"), "buildcage-proxy-abcd1234");
diff --git a/run/src/lib/errors.js b/run/src/lib/errors.js
index 718fbf5..cf363f1 100644
--- a/run/src/lib/errors.js
+++ b/run/src/lib/errors.js
@@ -14,6 +14,8 @@
  *   INVALID_RULES    – ACL rule syntax error
  *   MISSING_RUN      – required `run` input was empty
  *   PROXY_NOT_RUNNING – sandbox proxy container isn't running after `docker compose up`
+ *   RUNC_EXTRACT_FAILED – failed to `docker cp` runc/gen-seccomp-profile out of the proxy image
+ *   OCI_CONFIG_BUILD_FAILED – failed to run gen-seccomp-profile/runc spec or assemble config.json
  */
 export class SandboxError extends Error {
   constructor(message, code) {
diff --git a/run/src/lib/isolated-exec.js b/run/src/lib/isolated-exec.js
index e68d8e6..7456a42 100644
--- a/run/src/lib/isolated-exec.js
+++ b/run/src/lib/isolated-exec.js
@@ -1,13 +1,38 @@
 import { execFileSync } from "node:child_process";
-import { writeFileSync, mkdtempSync, rmSync } from "node:fs";
+import { writeFileSync, mkdtempSync, rmSync, readFileSync, mkdirSync, chmodSync, existsSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { tmpdir } from "node:os";
+import { buildDockerCpArgs } from "./container.js";
+// Sensitive /proc paths masked with /dev/null. runc's own `runc spec`
+// default already masks /proc/kcore, /proc/keys, and /proc/timer_list
+// (among others) and leaves /proc/sysrq-trigger merely read-only —
+// buildOciConfig upgrades sysrq-trigger to fully masked (moving it out of
+// readonlyPaths) and adds kallsyms/kmsg, which runc's default doesn't
+// cover at all.
+//
+// Imported from a shared JSON file (rather than a JS literal) so run/dev's
+// build-test-bundle.sh — a bash/jq stand-in for this same function, used
+// by the Mac dev loop — has a single source of truth to read the same
+// list from instead of hand-duplicating it.
+import EXTRA_MASKED_PROC_PATHS from "../../scripts/extra-masked-proc-paths.json" with { type: "json" };
 
 // rollup's cjs output doesn't convert import.meta.dirname (it silently
 // becomes undefined), so use this form instead.
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
+// Base directory for each run's scratch dir (OCI bundle + the host-`/`
+// rootfs bind-mount). Deliberately under /var/tmp rather than os.tmpdir():
+// the rootfs bind must live somewhere that is never one of the sandbox's
+// writable exceptions (workdir/home/tmp/RUNNER_TEMP/writablePaths),
+// otherwise the recursive writable rbind of that path would re-expose the
+// whole host `/` as a second, writable copy inside the sandbox. /var/tmp
+// itself is 1777 (writable by the non-root runner user) and execable, so
+// this own subdirectory inherits that without needing root to create it.
+// buildOciConfig fails closed if a step's `writable:` input tries to list
+// this directory (or an ancestor of it) as writable — see
+// assertScratchBaseNotWritable.
+const SANDBOX_SCRATCH_BASE = "/var/tmp/buildcage";
+
 /**
  * Write the user-supplied `run:` input to an executable script file.
  * Routing through a file (rather than passing the command inline to a
@@ -21,40 +46,300 @@ export function writeRunScript(runInput, dir) {
 }
 
 /**
- * Dump the current process environment to a NUL-separated KEY=VALUE file,
- * for run-isolated.sh to re-apply inside the isolated namespace via
- * `env -i`. sudo resets the environment by default (env_reset) and we
- * deliberately don't use `sudo -E` (its availability depends on a sudoers
- * SETENV tag, which isn't portable) — this file is the explicit channel
- * instead.
+ * Generate runc's own default OCI bundle config via `runc spec` (run in
+ * `bundleDir`, which is where it writes `config.json`). Used as the
+ * starting point for buildOciConfig rather than hand-writing the full
+ * spec from scratch, so the baseline mounts/masked-paths/rlimits stay
+ * exactly what runc itself considers a sane default for its own version,
+ * and buildOciConfig only needs to override/extend the handful of fields
+ * this sandbox actually cares about.
+ */
+export function generateBaseOciSpec(runcPath, bundleDir) {
+  execFileSync(runcPath, ["spec"], { cwd: bundleDir });
+  return JSON.parse(readFileSync(join(bundleDir, "config.json"), "utf8"));
+}
+
+/**
+ * Extract runc and gen-seccomp-profile from the proxy image into this run's
+ * own `destDir` (its per-step scratch dir), then resolve the base OCI spec
+ * and the seccomp profile from them. Run once per `run:` step; each
+ * invocation is independent, and everything written here is torn down with
+ * the scratch dir (see withScratchDir / cleanupScratchDir).
  *
- * Written 0600: this dump contains the whole process environment, including
- * any secrets passed to the step via `env:`. The scratch dir is already
- * 0700 (see withScratchDir), but restricting the file itself keeps the
- * secrets unreadable to other local users even if the dir's mode is ever
- * loosened, matching writeRunScript's own explicit mode.
- */
-export function writeEnvDump(env, dir) {
-  const envFilePath = join(dir, "env-dump.bin");
-  const buf = Buffer.concat(
-    Object.entries(env)
-      .filter(([, v]) => v !== undefined)
-      .map(([k, v]) => Buffer.from(`${k}=${v}\0`, "utf8")),
+ * Both binaries ship inside the proxy image and are pulled onto the host via
+ * `docker cp`, then run natively there (not `docker exec`) since the seccomp
+ * profile's content depends on the real host kernel/arch -- see
+ * gen-seccomp-profile/main.go. gen-seccomp-profile is only needed transiently
+ * to resolve the profile, so it's removed once read; runc stays for `runc run`.
+ */
+export function extractRuncBootstrap({ containerName, destDir }) {
+  const runcPath = join(destDir, "runc");
+  const genSeccompProfilePath = join(destDir, "gen-seccomp-profile");
+  execFileSync("docker", buildDockerCpArgs({ containerName, containerPath: "/opt/buildcage/bin/runc", hostPath: runcPath }));
+  execFileSync(
+    "docker",
+    buildDockerCpArgs({ containerName, containerPath: "/opt/buildcage/bin/gen-seccomp-profile", hostPath: genSeccompProfilePath }),
   );
-  writeFileSync(envFilePath, buf, { mode: 0o600 });
-  return envFilePath;
+  chmodSync(runcPath, 0o755);
+  chmodSync(genSeccompProfilePath, 0o755);
+  const seccompProfile = JSON.parse(execFileSync(genSeccompProfilePath, { encoding: "utf8" }));
+  const baseSpec = generateBaseOciSpec(runcPath, destDir); // writes config.json into destDir (overwritten later by writeOciConfig)
+  rmSync(genSeccompProfilePath); // only needed to resolve seccompProfile above
+
+  return { runcPath, seccompProfile, baseSpec };
+}
+
+/**
+ * Pure: extract {mountPoint, fsType} for every line of raw
+ * /proc/self/mountinfo content. Format (space-separated fields):
+ *   ID PARENT-ID MAJOR:MINOR ROOT MOUNT-POINT OPTIONS [OPT-FIELDS...] - FSTYPE SOURCE SUPER-OPTIONS
+ * The mount point is always field 5 (index 4); the filesystem type is
+ * always the field right after the literal "-" separator, regardless of
+ * how many optional fields precede it.
+ */
+export function parseMountinfo(mountinfoContent) {
+  return mountinfoContent
+    .split("\n")
+    .filter(Boolean)
+    .map((line) => {
+      const fields = line.split(" ");
+      const dashIndex = fields.indexOf("-");
+      return { mountPoint: fields[4], fsType: fields[dashIndex + 1] };
+    });
+}
+
+/**
+ * Reads the real host mount table. Node runs directly on the runner host,
+ * not inside any namespace, so this is exactly the mount table
+ * run-isolated.sh's `mount --rbind /` will duplicate into rootfsBindDir a
+ * moment later (see buildOciConfig's readonlyPaths handling for why this
+ * matters).
+ */
+export function listHostMounts() {
+  return parseMountinfo(readFileSync("/proc/self/mountinfo", "utf8"));
+}
+
+/**
+ * Pure: given the host's real mount table, the set of paths that must stay
+ * writable, and the destinations runc's own base spec already declares a
+ * fresh mount for (see freshMountDestinationsFrom), return the host mount
+ * points that need to be explicitly forced read-only. This exists because
+ * `root.readonly` in OCI/runc only remounts the top-level rootfs mount
+ * point — it does *not* recursively apply to separate mount points that
+ * `mount --rbind /` duplicates into the sandbox's rootfs. A host mount
+ * point is skipped only when it exactly matches one of
+ * `freshMountDestinations`: runc will mount fresh content there when it
+ * sets up the sandbox's own further-nested namespaces, shadowing whatever
+ * the rbind copy swept in from the host at that path, so forcing that
+ * (about-to-be-overridden) copy read-only would be pointless -- and some
+ * pseudo-filesystems reject a read-only remount outright. Any other real
+ * host mount point not covered would otherwise remain fully writable
+ * despite the sandbox's documented read-only-outside-workdir/home/tmp/
+ * writable guarantee. "/" itself is excluded since root.readonly already
+ * covers it directly.
+ */
+export function computeReadonlyHostMounts(hostMounts, protectedPaths, freshMountDestinations) {
+  return hostMounts
+    .filter(({ mountPoint }) => mountPoint !== "/" && !freshMountDestinations.has(mountPoint) && !protectedPaths.has(mountPoint))
+    .map(({ mountPoint }) => mountPoint);
+}
+
+/**
+ * Pure: the set of destination paths `baseSpec.mounts` already declares a
+ * mount for. Derived directly from the actual `runc spec` output already
+ * being used to build config.json (see generateBaseOciSpec), rather than a
+ * hardcoded list of filesystem types -- this stays correct automatically
+ * if a future runc version changes its own default mounts, and sidesteps
+ * fstype ambiguity (e.g. runc's default spec declares a `cgroup`-type
+ * mount at /sys/fs/cgroup that transparently resolves to the host's real
+ * cgroup v1 or v2 hierarchy, so matching by destination path covers both
+ * without needing to special-case a literal "cgroup2" fstype name).
+ */
+export function freshMountDestinationsFrom(baseSpec) {
+  return new Set(baseSpec.mounts.map((m) => m.destination));
+}
+
+// runc resolves process.args[0] against the *sandbox's* PATH (the step's own
+// env, which a user could override to omit /usr/bin), so resolve setpriv to an
+// absolute path up front instead of relying on that lookup. The sandbox rootfs
+// is a bind-mount of the host's own `/`, so a path that exists on the host
+// resolves to the same binary inside. Falls back to bare "setpriv" (PATH
+// lookup) only if none of the usual locations exist -- run-isolated.sh has
+// already verified setpriv is on root's PATH before we get here.
+const SETPRIV_CANDIDATE_PATHS = ["/usr/bin/setpriv", "/bin/setpriv", "/usr/sbin/setpriv", "/sbin/setpriv"];
+function resolveSetprivPath() {
+  return SETPRIV_CANDIDATE_PATHS.find((p) => existsSync(p)) ?? "setpriv";
+}
+
+/**
+ * True if `a` and `b` are the same path, or one is an ancestor directory of
+ * the other (path-component-wise, not a bare string prefix -- "/var/tmp/bu"
+ * must not count as overlapping "/var/tmp/buildcage").
+ */
+function pathsOverlap(a, b) {
+  if (a === b) return true;
+  const withSlash = (p) => (p.endsWith("/") ? p : `${p}/`);
+  return a.startsWith(withSlash(b)) || b.startsWith(withSlash(a));
+}
+
+/**
+ * Fail closed if any writable-exception directory is, or contains, or is
+ * contained in, SANDBOX_SCRATCH_BASE. That directory holds the run's own
+ * `mount --rbind /` rootfs (see rootfsBindDir in main.js); the writable
+ * exceptions are recursive bind-mounts, so any overlap would recursively
+ * re-expose that rootfs inside the sandbox as a second, *writable* copy of
+ * the whole host `/` -- the exact escape SANDBOX_SCRATCH_BASE's placement
+ * (outside the default writable set) exists to avoid. Only reachable via an
+ * explicit `writable:` input naming /var/tmp/buildcage or an ancestor of it
+ * (workdir/home/tmp/RUNNER_TEMP are operator/runner-controlled, not
+ * attacker-controlled), so this is a misconfiguration guard, not a
+ * hardening measure against a hostile isolated command.
+ */
+function assertScratchBaseNotWritable(writableDirs) {
+  const overlapping = writableDirs.find((p) => pathsOverlap(p, SANDBOX_SCRATCH_BASE));
+  if (overlapping) {
+    throw new Error(
+      `writable path ${JSON.stringify(overlapping)} overlaps the sandbox's own scratch directory (${SANDBOX_SCRATCH_BASE}); ` +
+        `this would re-expose the sandboxed host filesystem read-write inside the sandbox itself. Choose a writable path outside ${SANDBOX_SCRATCH_BASE}.`,
+    );
+  }
+}
+
+/**
+ * Build the final OCI Runtime Spec (config.json) for the isolated command,
+ * starting from runc's own `baseSpec` (see generateBaseOciSpec) and
+ * overriding only what this sandbox needs to control:
+ *
+ * - root: a bind-mounted copy of the host's own `/` (rootfsBindDir, set up
+ *   by run-isolated.sh before invoking runc — pivot_root can't target `/`
+ *   itself), made read-only via `root.readonly` plus an explicit
+ *   `linux.readonlyPaths` entry per real host mount point `--rbind`
+ *   duplicated in (see computeReadonlyHostMounts — root.readonly alone
+ *   only covers the top-level mount), except workdir/home/tmp/runnerTemp/
+ *   writablePaths. rootfsBindDir itself lives under SANDBOX_SCRATCH_BASE,
+ *   which is never one of those writable exceptions, so the recursive
+ *   writable rbinds don't re-expose the host-`/` rootfs as a second, writable
+ *   copy inside the sandbox (see assertScratchBaseNotWritable, which fails
+ *   closed if a `writable:` input would break that invariant).
+ * - linux.namespaces: same six namespace types runc's own default spec
+ *   already requests (no user namespace — see docs/security.md's
+ *   rationale for preserving the real UID/GID), just adding `path` to the
+ *   network entry so it joins the netns run-isolated.sh already wired a
+ *   veth into, instead of creating a fresh, unconnected one.
+ * - process.capabilities: fully cleared (all five sets empty) plus
+ *   noNewPrivileges — runc applies this natively, no setpriv needed.
+ * - process.env: the step's real environment, replacing runc spec's
+ *   invented PATH/TERM defaults.
+ * - linux.seccomp: the Docker-default-profile-derived filter (see
+ *   gen-seccomp-profile), resolved against this same empty capability
+ *   set.
+ *
+ * `writablePaths` containing "/" is a sentinel meaning "disable the
+ * read-only restriction entirely" (see docs/reference.md's `writable`
+ * input).
+ */
+export function buildOciConfig(
+  baseSpec,
+  { uid, gid, workdir, home, runnerTemp, writablePaths = [], env, netnsPath, rootfsBindDir, resolvConfPath, seccompProfile, scriptPath, hostMounts = [] },
+) {
+  const disableReadonly = writablePaths.includes("/");
+
+  const mounts = [...baseSpec.mounts, { destination: "/etc/resolv.conf", type: "none", source: resolvConfPath, options: ["rbind", "ro"] }];
+  // Paths kept writable on top of the read-only root. RUNNER_TEMP is included
+  // because many actions/tools write there and it isn't always under $HOME
+  // (self-hosted runners can place it elsewhere), so the $HOME exception
+  // wouldn't otherwise cover it. Deduped so an overlapping entry (RUNNER_TEMP
+  // nested under $HOME, or a writablePaths duplicate) isn't bind-mounted twice.
+  const writableDirs = [...new Set([workdir, home, "/tmp", runnerTemp, ...writablePaths].filter(Boolean))];
+  const protectedPaths = new Set(writableDirs);
+  if (!disableReadonly) {
+    // `writable: /` (disableReadonly) is an intentional, documented full
+    // opt-out of the read-only restriction, so it's exempt from this guard.
+    assertScratchBaseNotWritable(writableDirs);
+    for (const p of writableDirs) mounts.push({ destination: p, type: "none", source: p, options: ["rbind", "rw"] });
+  }
+
+  const maskedPaths = [...(baseSpec.linux.maskedPaths ?? []), ...EXTRA_MASKED_PROC_PATHS];
+  const baseReadonlyPaths = (baseSpec.linux.readonlyPaths ?? []).filter((p) => !EXTRA_MASKED_PROC_PATHS.includes(p));
+  const readonlyPaths = disableReadonly
+    ? baseReadonlyPaths
+    : Array.from(
+        new Set([...baseReadonlyPaths, ...computeReadonlyHostMounts(hostMounts, protectedPaths, freshMountDestinationsFrom(baseSpec))]),
+      );
+
+  const namespaces = baseSpec.linux.namespaces.map((ns) => (ns.type === "network" ? { ...ns, path: netnsPath } : ns));
+
+  return {
+    ...baseSpec,
+    root: { path: rootfsBindDir, readonly: !disableReadonly },
+    mounts,
+    process: {
+      ...baseSpec.process,
+      terminal: false,
+      user: { uid, gid },
+      // setpriv --pdeathsig ties this process's life to its direct
+      // parent's -- the `runc run` process, not run-isolated.sh itself
+      // (runc's own process sits in between). This is the second hop of a
+      // two-hop chain: run-isolated.sh also wraps its own `runc run`
+      // invocation in `setpriv --pdeathsig=KILL` (targeting itself), so if
+      // run-isolated.sh is SIGKILL'd, `runc run` dies too, which then
+      // kills this process in turn -- without the outer hop, `runc run`
+      // would merely become an orphan (still alive) and this process,
+      // whose parent never actually died, would never receive anything.
+      // No other setpriv flags are needed here -- uid/gid, capabilities,
+      // and no_new_privs are already applied by runc itself (above/below)
+      // before this execs.
+      args: [resolveSetprivPath(), "--pdeathsig=KILL", "--", scriptPath],
+      env: Object.entries(env)
+        .filter(([, v]) => v !== undefined)
+        .map(([k, v]) => `${k}=${v}`),
+      cwd: workdir || "/",
+      capabilities: { bounding: [], effective: [], permitted: [], inheritable: [], ambient: [] },
+      noNewPrivileges: true,
+    },
+    linux: {
+      ...baseSpec.linux,
+      namespaces,
+      seccomp: seccompProfile,
+      maskedPaths,
+      readonlyPaths,
+    },
+  };
+}
+
+/**
+ * Write the final OCI config to `bundleDir/config.json` (overwriting the
+ * `runc spec` placeholder generateBaseOciSpec left there). Mode 0600:
+ * `process.env` embeds the whole step environment, including any secrets
+ * passed via `env:`.
+ */
+export function writeOciConfig(config, bundleDir) {
+  const configPath = join(bundleDir, "config.json");
+  writeFileSync(configPath, JSON.stringify(config), { mode: 0o600 });
+  return configPath;
+}
+
+/** Write the resolv.conf bind-mount source referenced by buildOciConfig. */
+export function writeResolvConf(dns, dir) {
+  const resolvConfPath = join(dir, "resolv.conf");
+  writeFileSync(resolvConfPath, `nameserver ${dns}\n`, { mode: 0o644 });
+  return resolvConfPath;
 }
 
 /**
  * Run the user's command inside the isolated sandbox via run-isolated.sh
- * (invoked with `sudo -n`, since setting up the namespaces/veth/iptables
- * requires root). Returns the exit code of the isolated command — never
- * throws for a non-zero exit, since that's the user's command failing,
- * not this function.
+ * (invoked with `sudo -n`, since setting up namespaces/veth/iptables/the
+ * rootfs bind-mount requires root). Returns the exit code of the isolated
+ * command — never throws for a non-zero exit, since that's the user's
+ * command failing, not this function.
+ *
+ * uid/gid, capabilities, mounts, and env are entirely described by
+ * `config.json` (see buildOciConfig) — run-isolated.sh only needs enough
+ * to set up networking and the rootfs bind-mount before handing off to
+ * `runc run`.
  */
-export function runIsolated({ scriptPath, proxyPid, workdir, home, writablePaths = [], env, runScriptDir }) {
+export function runIsolated({ runcPath, proxyPid, bundleDir, containerId, netnsName, rootfsBindDir, gateway, dns, targetIp }) {
   const runIsolatedShPath = join(__dirname, "..", "scripts", "run-isolated.sh");
-  const envFilePath = writeEnvDump(env, runScriptDir);
 
   const args = [
     "-n",
@@ -62,17 +347,23 @@ export function runIsolated({ scriptPath, proxyPid, workdir, home, writablePaths
     runIsolatedShPath,
     "--proxy-pid",
     String(proxyPid),
-    "--uid",
-    String(process.getuid()),
-    "--gid",
-    String(process.getgid()),
-    "--env-file",
-    envFilePath,
+    "--runc",
+    runcPath,
+    "--bundle",
+    bundleDir,
+    "--container-id",
+    containerId,
+    "--netns-name",
+    netnsName,
+    "--rootfs-bind-dir",
+    rootfsBindDir,
+    "--gateway",
+    gateway,
+    "--dns",
+    dns,
+    "--target-ip",
+    targetIp,
   ];
-  if (workdir) args.push("--workdir", workdir);
-  if (home) args.push("--home", home);
-  for (const p of writablePaths) args.push("--writable", p);
-  args.push("--", scriptPath);
 
   try {
     execFileSync("sudo", args, { stdio: "inherit" });
@@ -85,12 +376,113 @@ export function runIsolated({ scriptPath, proxyPid, workdir, home, writablePaths
   }
 }
 
-/** Create/remove a scratch directory for this step's run-script + env-dump. */
-export function withScratchDir(fn) {
-  const dir = mkdtempSync(join(tmpdir(), "buildcage-sandbox-"));
+/**
+ * Pure: mount points from raw /proc/self/mountinfo content that are
+ * nested under `dir` (including `dir` itself), deepest-path-first so a
+ * caller can safely unmount children before their parents.
+ */
+export function parseMountsUnder(mountinfoContent, dir) {
+  const prefix = dir.endsWith("/") ? dir : `${dir}/`;
+  return parseMountinfo(mountinfoContent)
+    .map(({ mountPoint }) => mountPoint)
+    .filter((mountPoint) => mountPoint === dir || mountPoint.startsWith(prefix))
+    .sort((a, b) => b.length - a.length);
+}
+
+/**
+ * Force-detaches any mount points still nested under `dir` before it's
+ * recursively deleted. This is the safety net for rootfsBindDir (a
+ * `mount --rbind /` of the entire host filesystem — see main.js) surviving
+ * past run-isolated.sh's own cleanup trap: if that trap never runs (e.g.
+ * run-isolated.sh itself is SIGKILL'd, which bypasses traps entirely) or
+ * its `umount -R` fails (EBUSY), a plain recursive delete of `dir` would
+ * otherwise walk straight through the still-live bind-mount and delete
+ * the real files on the host it points at, not a sandboxed copy. `-l`
+ * (lazy) detaches each mount from the namespace immediately regardless of
+ * busy references, so this step itself can't hang or fail the way a
+ * normal (non-lazy) unmount could.
+ */
+function unmountAllUnder(dir) {
+  let mountPoints;
+  try {
+    mountPoints = parseMountsUnder(readFileSync("/proc/self/mountinfo", "utf8"), dir);
+  } catch {
+    return;
+  }
+  for (const mountPoint of mountPoints) {
+    try {
+      execFileSync("sudo", ["umount", "-R", "-l", mountPoint], { stdio: ["ignore", "ignore", "pipe"] });
+    } catch (e) {
+      console.log(`::warning::Failed to unmount ${mountPoint} before cleanup: ${e.message}`);
+    }
+  }
+}
+
+/**
+ * Removes the scratch dir, retrying on EBUSY. A lazy unmount (see
+ * unmountAllUnder) detaches a mount from the path-resolution tree
+ * immediately -- it stops appearing in /proc/self/mountinfo right away --
+ * but the kernel's underlying teardown of that now-orphaned mount can
+ * still lag behind by a short, bounded window, which can make a
+ * directory rmSync is about to delete spuriously report EBUSY even
+ * though it's no longer listed as a mountpoint at all. Resolves on the
+ * very next attempt after a brief wait.
+ */
+function removeScratchDir(dir) {
+  const maxAttempts = 5;
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    try {
+      rmSync(dir, { recursive: true, force: true });
+      return;
+    } catch (e) {
+      if (e.code !== "EBUSY" || attempt === maxAttempts) throw e;
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 200);
+    }
+  }
+}
+
+/**
+ * Force-detach anything still mounted under `dir` (the rootfs bind-mount
+ * safety net — see unmountAllUnder) and then recursively remove it. Exported
+ * so post.js can reclaim a scratch dir orphaned by a hard kill that bypassed
+ * withScratchDir's own finally. No-ops safely when `dir` doesn't exist.
+ */
+export function cleanupScratchDir(dir) {
+  unmountAllUnder(dir);
+  removeScratchDir(dir);
+}
+
+/**
+ * Absolute path of the scratch dir for a given proxy container, derived
+ * deterministically from `containerName` (the `buildcage-proxy-` prefix
+ * swapped for `sandbox-`, under SANDBOX_SCRATCH_BASE). Lets the post step
+ * reconstruct and reclaim the exact same directory from `STATE_container_name`
+ * alone.
+ */
+export function scratchDirFor(containerName) {
+  return join(SANDBOX_SCRATCH_BASE, containerName.replace(/^buildcage-proxy-/, "sandbox-"));
+}
+
+/**
+ * Create/remove a scratch directory for this step's OCI bundle + run-script.
+ * With `containerName` the dir is named deterministically (scratchDirFor) so
+ * post.js can reclaim it after a hard kill; without it a random mkdtemp name
+ * is used (unit tests). Cleaned up on every exit path that unwinds — a
+ * SIGKILL bypasses this finally, which is exactly what post.js covers.
+ */
+export function withScratchDir(fn, containerName) {
+  let dir;
+  mkdirSync(SANDBOX_SCRATCH_BASE, { recursive: true, mode: 0o755 });
+  if (containerName) {
+    dir = scratchDirFor(containerName);
+    cleanupScratchDir(dir); // clear any stale remnant at this deterministic path (unmount-safe)
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+  } else {
+    dir = mkdtempSync(join(SANDBOX_SCRATCH_BASE, "sandbox-"));
+  }
   try {
     return fn(dir);
   } finally {
-    rmSync(dir, { recursive: true, force: true });
+    cleanupScratchDir(dir);
   }
 }
diff --git a/run/src/lib/isolated-exec.test.js b/run/src/lib/isolated-exec.test.js
index ace5fc8..ae403b1 100644
--- a/run/src/lib/isolated-exec.test.js
+++ b/run/src/lib/isolated-exec.test.js
@@ -3,7 +3,18 @@ import assert from "node:assert/strict";
 import { readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 
-import { writeRunScript, writeEnvDump, withScratchDir } from "./isolated-exec.js";
+import {
+  writeRunScript,
+  writeResolvConf,
+  buildOciConfig,
+  writeOciConfig,
+  withScratchDir,
+  scratchDirFor,
+  parseMountinfo,
+  computeReadonlyHostMounts,
+  freshMountDestinationsFrom,
+  parseMountsUnder,
+} from "./isolated-exec.js";
 
 describe("writeRunScript", () => {
   it("wraps plain commands in a #!/bin/sh + set -e preamble", () => {
@@ -31,25 +42,331 @@ describe("writeRunScript", () => {
   });
 });
 
-describe("writeEnvDump", () => {
-  it("writes NUL-separated KEY=VALUE pairs", () => {
+describe("scratchDirFor", () => {
+  it("derives a path under /var/tmp/buildcage from the container name (not under a writable exception)", () => {
+    const dir = scratchDirFor("buildcage-proxy-abcd1234");
+    assert.equal(dir, "/var/tmp/buildcage/sandbox-abcd1234");
+  });
+
+  it("is deterministic for the same container name (so post.js can reconstruct it)", () => {
+    assert.equal(scratchDirFor("buildcage-proxy-xyz"), scratchDirFor("buildcage-proxy-xyz"));
+  });
+});
+
+describe("writeResolvConf", () => {
+  it("writes a single nameserver line", () => {
     withScratchDir((dir) => {
-      const path = writeEnvDump({ FOO: "bar", BAZ: "qux" }, dir);
-      const content = readFileSync(path, "utf8");
-      assert.equal(content, "FOO=bar\0BAZ=qux\0");
+      const path = writeResolvConf("172.20.0.1", dir);
+      assert.equal(readFileSync(path, "utf8"), "nameserver 172.20.0.1\n");
     });
   });
+});
+
+// Realistic /proc/self/mountinfo lines (see parseMountinfo's doc comment
+// for the field layout). Each has one optional field ("shared:N") before
+// the "-" separator, matching what a systemd-managed host typically shows.
+const SAMPLE_MOUNTINFO = [
+  "1 0 0:1 / / rw,relatime shared:1 - ext4 /dev/root rw",
+  "2 1 0:2 / /proc rw,relatime shared:2 - proc proc rw",
+  "3 1 0:3 / /run rw,nosuid,relatime shared:3 - tmpfs tmpfs rw,size=100k",
+  "4 3 0:4 / /run/user/1000 rw,nosuid,relatime shared:4 - tmpfs tmpfs rw",
+  "5 1 0:5 / /mnt rw,relatime shared:5 - ext4 /dev/sdb1 rw",
+].join("\n");
+
+describe("parseMountinfo", () => {
+  it("extracts the mount point and filesystem type of every line", () => {
+    assert.deepEqual(parseMountinfo(SAMPLE_MOUNTINFO), [
+      { mountPoint: "/", fsType: "ext4" },
+      { mountPoint: "/proc", fsType: "proc" },
+      { mountPoint: "/run", fsType: "tmpfs" },
+      { mountPoint: "/run/user/1000", fsType: "tmpfs" },
+      { mountPoint: "/mnt", fsType: "ext4" },
+    ]);
+  });
+
+  it("ignores trailing/blank lines", () => {
+    assert.deepEqual(parseMountinfo(`${SAMPLE_MOUNTINFO}\n\n`).length, 5);
+  });
+});
+
+describe("computeReadonlyHostMounts", () => {
+  const hostMounts = parseMountinfo(SAMPLE_MOUNTINFO);
+  const freshMountDestinations = new Set(["/proc"]);
+
+  it("excludes '/' itself (already covered by root.readonly)", () => {
+    const result = computeReadonlyHostMounts(hostMounts, new Set(), freshMountDestinations);
+    assert.ok(!result.includes("/"));
+  });
+
+  it("excludes paths runc's own base spec already mounts fresh", () => {
+    const result = computeReadonlyHostMounts(hostMounts, new Set(), freshMountDestinations);
+    assert.ok(!result.includes("/proc"));
+  });
+
+  it("excludes explicitly protected (writable) paths", () => {
+    const result = computeReadonlyHostMounts(hostMounts, new Set(["/run"]), freshMountDestinations);
+    assert.ok(!result.includes("/run"));
+    assert.ok(result.includes("/run/user/1000"), "a nested mount under a protected path is still its own separate mount point");
+  });
+
+  it("includes real, non-pseudo, non-protected host mounts (e.g. a separate disk at /mnt)", () => {
+    const result = computeReadonlyHostMounts(hostMounts, new Set(), freshMountDestinations);
+    assert.ok(result.includes("/mnt"));
+    assert.ok(result.includes("/run"));
+    assert.ok(result.includes("/run/user/1000"));
+  });
+
+  it("includes a pseudo-filesystem-like mount whose path isn't one of runc's own fresh destinations", () => {
+    // e.g. securityfs at /sys/kernel/security: it looks like the same
+    // "kernel pseudo-fs" class as /proc, but runc's default spec never
+    // declares a mount for it, so the host-swept copy must be forced
+    // read-only just like any other real mount point.
+    const withSecurityfs = [...hostMounts, { mountPoint: "/sys/kernel/security", fsType: "securityfs" }];
+    const result = computeReadonlyHostMounts(withSecurityfs, new Set(), freshMountDestinations);
+    assert.ok(result.includes("/sys/kernel/security"));
+  });
+});
+
+describe("freshMountDestinationsFrom", () => {
+  it("collects every mounts[].destination from the base spec", () => {
+    const baseSpec = { mounts: [{ destination: "/proc" }, { destination: "/sys" }, { destination: "/dev/pts" }] };
+    assert.deepEqual(freshMountDestinationsFrom(baseSpec), new Set(["/proc", "/sys", "/dev/pts"]));
+  });
+});
+
+describe("parseMountsUnder", () => {
+  const mountinfo = [
+    "1 0 0:1 / / rw,relatime shared:1 - ext4 /dev/root rw",
+    "2 1 0:2 / /tmp/buildcage-sandbox-abc rw,relatime shared:2 - tmpfs tmpfs rw",
+    "3 2 0:3 / /tmp/buildcage-sandbox-abc/rootfs rw,relatime shared:3 - ext4 /dev/root rw",
+    "4 1 0:4 / /tmp/other-dir rw,relatime shared:4 - tmpfs tmpfs rw",
+  ].join("\n");
+
+  it("finds only mount points nested under the given directory", () => {
+    const result = parseMountsUnder(mountinfo, "/tmp/buildcage-sandbox-abc");
+    assert.deepEqual(result.sort(), ["/tmp/buildcage-sandbox-abc", "/tmp/buildcage-sandbox-abc/rootfs"].sort());
+  });
+
+  it("orders deepest paths first, so children are unmounted before their parents", () => {
+    const result = parseMountsUnder(mountinfo, "/tmp/buildcage-sandbox-abc");
+    assert.deepEqual(result, ["/tmp/buildcage-sandbox-abc/rootfs", "/tmp/buildcage-sandbox-abc"]);
+  });
+
+  it("does not match a sibling directory with a similar prefix", () => {
+    const result = parseMountsUnder(mountinfo, "/tmp/buildcage-sandbox-ab");
+    assert.deepEqual(result, []);
+  });
+});
+
+// A minimal stand-in for what `runc spec` actually produces (see
+// isolated-exec.js's generateBaseOciSpec) — only the fields buildOciConfig
+// reads/overrides are included.
+function fakeBaseSpec() {
+  return {
+    ociVersion: "1.0.2",
+    root: { path: "rootfs", readonly: true },
+    mounts: [
+      { destination: "/proc", type: "proc", source: "proc" },
+      { destination: "/sys", type: "none", source: "/sys", options: ["rbind", "ro"] },
+    ],
+    process: {
+      terminal: true,
+      user: { uid: 0, gid: 0 },
+      args: ["sh"],
+      env: ["PATH=/usr/local/sbin:/usr/local/bin", "TERM=xterm"],
+      cwd: "/",
+      capabilities: {
+        bounding: ["CAP_AUDIT_WRITE", "CAP_KILL", "CAP_NET_BIND_SERVICE"],
+        effective: ["CAP_AUDIT_WRITE", "CAP_KILL", "CAP_NET_BIND_SERVICE"],
+        permitted: ["CAP_AUDIT_WRITE", "CAP_KILL", "CAP_NET_BIND_SERVICE"],
+        inheritable: [],
+        ambient: [],
+      },
+    },
+    linux: {
+      namespaces: [{ type: "pid" }, { type: "network" }, { type: "ipc" }, { type: "uts" }, { type: "mount" }, { type: "cgroup" }],
+      maskedPaths: ["/proc/acpi", "/proc/kcore", "/proc/keys", "/proc/timer_list"],
+      readonlyPaths: ["/proc/bus", "/proc/sysrq-trigger"],
+    },
+  };
+}
+
+describe("buildOciConfig", () => {
+  const baseArgs = {
+    uid: 1000,
+    gid: 1000,
+    workdir: "/home/runner/work/repo/repo",
+    home: "/home/runner",
+    env: { FOO: "bar", UNSET: undefined },
+    netnsPath: "/var/run/netns/buildcage-sandbox-abcd1234",
+    rootfsBindDir: "/tmp/buildcage-sandbox-xyz/rootfs",
+    resolvConfPath: "/tmp/buildcage-sandbox-xyz/resolv.conf",
+    seccompProfile: { defaultAction: "SCMP_ACT_ERRNO" },
+    scriptPath: "/tmp/buildcage-sandbox-xyz/run-script.sh",
+  };
+
+  it("clears all five capability sets and sets noNewPrivileges", () => {
+    const config = buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: [] });
+    assert.deepEqual(config.process.capabilities, { bounding: [], effective: [], permitted: [], inheritable: [], ambient: [] });
+    assert.equal(config.process.noNewPrivileges, true);
+  });
+
+  it("sets uid/gid and cwd from the given options", () => {
+    const config = buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: [] });
+    assert.deepEqual(config.process.user, { uid: 1000, gid: 1000 });
+    assert.equal(config.process.cwd, baseArgs.workdir);
+  });
+
+  it("wraps the script in `setpriv --pdeathsig=KILL` (die-with-parent, see run-isolated.sh)", () => {
+    const config = buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: [] });
+    // args[0] is setpriv resolved to an absolute path where it exists (e.g.
+    // /usr/bin/setpriv on Linux), falling back to bare "setpriv" otherwise.
+    assert.match(config.process.args[0], /(^|\/)setpriv$/);
+    assert.deepEqual(config.process.args.slice(1), ["--pdeathsig=KILL", "--", baseArgs.scriptPath]);
+  });
+
+  it("replaces process.env with the given env, dropping undefined values", () => {
+    const config = buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: [] });
+    assert.deepEqual(config.process.env, ["FOO=bar"]);
+  });
+
+  it("adds `path` to the network namespace entry, leaving other namespace types untouched", () => {
+    const config = buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: [] });
+    const netNs = config.linux.namespaces.find((ns) => ns.type === "network");
+    assert.equal(netNs.path, baseArgs.netnsPath);
+    assert.equal(config.linux.namespaces.length, 6);
+  });
+
+  it("extends maskedPaths with kallsyms/kmsg/sysrq-trigger and moves sysrq-trigger out of readonlyPaths", () => {
+    const config = buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: [] });
+    for (const p of ["/proc/kallsyms", "/proc/kmsg", "/proc/sysrq-trigger", "/proc/kcore", "/proc/keys", "/proc/timer_list"]) {
+      assert.ok(config.linux.maskedPaths.includes(p), `expected maskedPaths to include ${p}`);
+    }
+    assert.ok(!config.linux.readonlyPaths.includes("/proc/sysrq-trigger"));
+    assert.ok(config.linux.readonlyPaths.includes("/proc/bus"));
+  });
+
+  it("embeds the seccomp profile as-is", () => {
+    const config = buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: [] });
+    assert.deepEqual(config.linux.seccomp, baseArgs.seccompProfile);
+  });
+
+  it("makes root read-only and binds workdir/home/tmp/writablePaths as writable exceptions", () => {
+    const config = buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: ["/opt/cache"] });
+    assert.equal(config.root.readonly, true);
+    assert.equal(config.root.path, baseArgs.rootfsBindDir);
+    const rw = config.mounts.filter((m) => m.options?.includes("rw")).map((m) => m.destination);
+    assert.deepEqual(rw.sort(), ["/opt/cache", "/tmp", baseArgs.home, baseArgs.workdir].sort());
+  });
+
+  it("does not mount anything over rootfsBindDir (it lives under /var/tmp/buildcage, so nothing re-exposes it)", () => {
+    const config = buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: ["/opt/cache"] });
+    assert.ok(!config.mounts.some((m) => m.destination === baseArgs.rootfsBindDir));
+  });
+
+  it("fails closed when writable: lists the scratch base itself", () => {
+    assert.throws(
+      () => buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: ["/var/tmp/buildcage"] }),
+      /overlaps the sandbox's own scratch directory/,
+    );
+  });
+
+  it("fails closed when writable: lists an ancestor of the scratch base", () => {
+    assert.throws(() => buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: ["/var/tmp"] }), /overlaps/);
+  });
+
+  it("fails closed when writable: lists a descendant of the scratch base", () => {
+    assert.throws(() => buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: ["/var/tmp/buildcage/some-other-run"] }), /overlaps/);
+  });
+
+  it("fails closed when $HOME or RUNNER_TEMP itself overlaps the scratch base", () => {
+    assert.throws(() => buildOciConfig(fakeBaseSpec(), { ...baseArgs, home: "/var/tmp/buildcage", writablePaths: [] }), /overlaps/);
+  });
+
+  it("does not fail closed for an unrelated sibling under /var/tmp", () => {
+    assert.doesNotThrow(() => buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: ["/var/tmp/some-other-tool"] }));
+  });
+
+  it("`writable: /` is exempt from the scratch-base guard (documented full opt-out)", () => {
+    assert.doesNotThrow(() => buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: ["/"] }));
+  });
+
+  it("keeps RUNNER_TEMP writable (rw bind) and out of readonlyPaths", () => {
+    const runnerTemp = "/opt/actions-runner/_work/_temp"; // self-hosted: outside $HOME
+    const hostMounts = [
+      { mountPoint: "/", fsType: "ext4" },
+      { mountPoint: runnerTemp, fsType: "ext4" },
+    ];
+    const config = buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: [], runnerTemp, hostMounts });
+    const rw = config.mounts.filter((m) => m.options?.includes("rw")).map((m) => m.destination);
+    assert.ok(rw.includes(runnerTemp), "RUNNER_TEMP must be bind-mounted writable");
+    assert.ok(!config.linux.readonlyPaths.includes(runnerTemp), "RUNNER_TEMP must not be forced read-only");
+  });
+
+  it("does not double-mount RUNNER_TEMP when it duplicates another writable path", () => {
+    const config = buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: [], runnerTemp: "/tmp" });
+    const tmpMounts = config.mounts.filter((m) => m.destination === "/tmp" && m.options?.includes("rw"));
+    assert.equal(tmpMounts.length, 1);
+  });
+
+  it("adds a read-only resolv.conf bind mount", () => {
+    const config = buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: [] });
+    const resolv = config.mounts.find((m) => m.destination === "/etc/resolv.conf");
+    assert.deepEqual(resolv, { destination: "/etc/resolv.conf", type: "none", source: baseArgs.resolvConfPath, options: ["rbind", "ro"] });
+  });
+
+  it("`writable: /` disables the read-only root and skips the individual writable-path mounts", () => {
+    const config = buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: ["/"] });
+    assert.equal(config.root.readonly, false);
+    const rw = config.mounts.filter((m) => m.options?.includes("rw"));
+    assert.equal(rw.length, 0);
+  });
+
+  it("forces real host mount points not already writable into readonlyPaths (root.readonly alone doesn't cover them)", () => {
+    const hostMounts = [
+      { mountPoint: "/", fsType: "ext4" },
+      { mountPoint: "/proc", fsType: "proc" },
+      { mountPoint: "/mnt", fsType: "ext4" },
+      { mountPoint: baseArgs.workdir, fsType: "ext4" },
+    ];
+    const config = buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: [], hostMounts });
+    assert.ok(config.linux.readonlyPaths.includes("/mnt"), "a real, separate host mount not covered by root.readonly must be listed explicitly");
+    assert.ok(!config.linux.readonlyPaths.includes("/"), "'/' itself is already covered by root.readonly");
+    assert.ok(!config.linux.readonlyPaths.includes("/proc"), "pseudo-filesystems get their own fresh mount, not a readonly remount of the host copy");
+    assert.ok(!config.linux.readonlyPaths.includes(baseArgs.workdir), "workdir must stay writable, not be added to readonlyPaths");
+  });
+
+  it("`writable: /` skips the host-mount readonly pass entirely", () => {
+    const hostMounts = [{ mountPoint: "/mnt", fsType: "ext4" }];
+    const config = buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: ["/"], hostMounts });
+    assert.ok(!config.linux.readonlyPaths.includes("/mnt"));
+  });
+
+  it("forces a kernel pseudo-fs into readonlyPaths when runc's own base spec doesn't mount it fresh", () => {
+    // Regression guard: a fixed allowlist of "pseudo-fs" filesystem types
+    // previously tolerated anything that merely looked like proc/sysfs/etc,
+    // even when runc's own base spec (fakeBaseSpec here only declares
+    // /proc and /sys) never actually gives it a fresh, isolated mount --
+    // e.g. securityfs at /sys/kernel/security, which is commonly mounted
+    // read-write on AppArmor-enabled hosts.
+    const hostMounts = [{ mountPoint: "/sys/kernel/security", fsType: "securityfs" }];
+    const config = buildOciConfig(fakeBaseSpec(), { ...baseArgs, writablePaths: [], hostMounts });
+    assert.ok(config.linux.readonlyPaths.includes("/sys/kernel/security"));
+  });
+});
 
-  it("skips undefined values", () => {
+describe("writeOciConfig", () => {
+  it("writes valid JSON matching the given config", () => {
     withScratchDir((dir) => {
-      const path = writeEnvDump({ FOO: "bar", SKIP: undefined }, dir);
-      assert.equal(readFileSync(path, "utf8"), "FOO=bar\0");
+      const config = { ociVersion: "1.0.2", process: { args: ["/bin/true"] } };
+      const path = writeOciConfig(config, dir);
+      assert.deepEqual(JSON.parse(readFileSync(path, "utf8")), config);
     });
   });
 
-  it("writes the env dump 0600 (it can hold secrets from the step's env:)", () => {
+  it("writes config.json 0600 (process.env can hold secrets from the step's env:)", () => {
     withScratchDir((dir) => {
-      const path = writeEnvDump({ SECRET: "s3cr3t" }, dir);
+      const path = writeOciConfig({ process: { env: ["SECRET=s3cr3t"] } }, dir);
       const mode = statSync(path).mode & 0o777;
       assert.equal(mode, 0o600);
     });
diff --git a/run/src/main.js b/run/src/main.js
index 56ac4d3..0753e17 100644
--- a/run/src/main.js
+++ b/run/src/main.js
@@ -9,7 +9,16 @@ import { verifyImageDigest } from "../../core/lib/verify-image.js";
 import { SandboxError } from "./lib/errors.js";
 import { generateContainerName, getContainerPid, deriveProjectName } from "./lib/container.js";
 import { buildComposeUpArgs, buildComposeDownArgs } from "./lib/compose-args.js";
-import { writeRunScript, runIsolated, withScratchDir } from "./lib/isolated-exec.js";
+import {
+  writeRunScript,
+  writeResolvConf,
+  extractRuncBootstrap,
+  buildOciConfig,
+  writeOciConfig,
+  runIsolated,
+  withScratchDir,
+  listHostMounts,
+} from "./lib/isolated-exec.js";
 import { fetchReport, writeReport } from "./lib/report.js";
 
 export { buildComposeUpArgs, buildComposeDownArgs };
@@ -160,18 +169,76 @@ async function main() {
       throw new SandboxError(`Sandbox proxy container ${containerName} is not running.`, "PROXY_NOT_RUNNING");
     }
 
+    // Fixed addressing on the proxy's sandbox0 bridge.
+    const gateway = "172.20.0.1";
+    const dns = "172.20.0.1";
+    const targetIp = "172.20.0.101";
+
     exitCode = withScratchDir((dir) => {
-      const scriptPath = writeRunScript(runInput, dir);
+      let runcPath, seccompProfile, baseSpec;
+      try {
+        // Extracted into this run's own scratch dir — see extractRuncBootstrap.
+        // Run natively on the runner host (not `docker exec`, which would
+        // resolve against the container's kernel/arch instead of the real
+        // one) — see gen-seccomp-profile/main.go.
+        ({ runcPath, seccompProfile, baseSpec } = extractRuncBootstrap({ containerName, destDir: dir }));
+      } catch (e) {
+        throw new SandboxError(`Failed to extract runc/gen-seccomp-profile from the proxy image: ${e.message}`, "RUNC_EXTRACT_FAILED");
+      }
+
+      const workdir = env.GITHUB_WORKSPACE || "";
+      const home = env.HOME || "";
+      // Distinct from the Docker container name/Compose project name
+      // (different ID namespace — `ip netns`/runc container IDs), but
+      // derived from it to keep `ip netns`/`docker ps` output correlated
+      // per step, same reasoning as deriveProjectName.
+      const netnsName = containerName.replace(/^buildcage-proxy-/, "buildcage-sandbox-");
+      const rootfsBindDir = join(dir, "rootfs");
+
+      let config;
+      try {
+        const resolvConfPath = writeResolvConf(dns, dir);
+        const scriptPath = writeRunScript(runInput, dir);
+        // Real host mount table, read now (before run-isolated.sh's `mount
+        // --rbind /` duplicates it into rootfsBindDir) so buildOciConfig can
+        // force every real submount read-only individually -- root.readonly
+        // alone only covers the top-level rootfs mount (see
+        // computeReadonlyHostMounts).
+        const hostMounts = listHostMounts();
+        config = buildOciConfig(baseSpec, {
+          uid: process.getuid(),
+          gid: process.getgid(),
+          workdir,
+          home,
+          // Standard writable runner scratch; not always under $HOME on
+          // self-hosted runners, so covered explicitly (see buildOciConfig).
+          runnerTemp: env.RUNNER_TEMP || "",
+          writablePaths,
+          env,
+          netnsPath: `/var/run/netns/${netnsName}`,
+          rootfsBindDir,
+          resolvConfPath,
+          seccompProfile,
+          scriptPath,
+          hostMounts,
+        });
+      } catch (e) {
+        throw new SandboxError(`Failed to build the sandbox's OCI bundle: ${e.message}`, "OCI_CONFIG_BUILD_FAILED");
+      }
+      writeOciConfig(config, dir);
+
       return runIsolated({
-        scriptPath,
+        runcPath,
         proxyPid,
-        workdir: env.GITHUB_WORKSPACE || "",
-        home: env.HOME || "",
-        writablePaths,
-        env,
-        runScriptDir: dir,
+        bundleDir: dir,
+        containerId: containerName,
+        netnsName,
+        rootfsBindDir,
+        gateway,
+        dns,
+        targetIp,
       });
-    });
+    }, containerName);
   } finally {
     try {
       const report = fetchReport(containerName);
diff --git a/run/src/post.js b/run/src/post.js
index e136fa3..fe35b7f 100644
--- a/run/src/post.js
+++ b/run/src/post.js
@@ -1,8 +1,10 @@
 import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { buildComposeDownArgs } from "./lib/compose-args.js";
+import { cleanupScratchDir, scratchDirFor } from "./lib/isolated-exec.js";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
@@ -16,6 +18,21 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const containerName = process.env.STATE_container_name;
 const projectName = process.env.STATE_project_name;
 
+// Reclaim this step's sandbox scratch dir if a hard kill bypassed main.js's
+// own withScratchDir finally. Its path is derived deterministically from
+// containerName (scratchDirFor), so no separately recorded path is needed.
+// cleanupScratchDir force-detaches the rootfs bind-mount before deleting, so
+// this can't walk into the host filesystem even if a mount somehow survived.
+// Independent of the container teardown below, so it runs regardless.
+if (containerName?.startsWith("buildcage-proxy-")) {
+  try {
+    const scratchDir = scratchDirFor(containerName);
+    if (existsSync(scratchDir)) cleanupScratchDir(scratchDir);
+  } catch (e) {
+    console.log(`::warning::run post-cleanup: failed to remove sandbox scratch dir: ${e.message}`);
+  }
+}
+
 if (containerName && projectName) {
   execFileSync(
     "docker",
diff --git a/run/test/integration-test-die-with-parent.sh b/run/test/integration-test-die-with-parent.sh
new file mode 100755
index 0000000..e39d6e1
--- /dev/null
+++ b/run/test/integration-test-die-with-parent.sh
@@ -0,0 +1,84 @@
+#!/bin/bash
+# Verifies the setpriv --pdeathsig chain (see run-isolated.sh and
+# isolated-exec.js's buildOciConfig): SIGKILL-ing run-isolated.sh's own
+# process must tear down the whole sandboxed process tree rather than
+# leaving it running as an orphan. Drives run/dist/main.cjs directly, not
+# through the real action wrapper, so this script can reach in and kill
+# run-isolated.sh mid-run.
+set -uo pipefail
+
+: "${BUILDCAGE_LOCAL_IMAGE_REF:?BUILDCAGE_LOCAL_IMAGE_REF must be set to the locally built proxy image}"
+
+WORKDIR=$(mktemp -d)
+touch "$WORKDIR/state.env"
+FAILURES=0
+
+cleanup() {
+  [ -n "${NODE_PID:-}" ] && kill -9 "$NODE_PID" >/dev/null 2>&1
+  # sudo itself (setuid root) and everything under it run as root, so
+  # this needs the same privilege too.
+  sudo -n pkill -9 -f "sudo -n -- .*/run/scripts/run-isolated.sh" >/dev/null 2>&1
+  docker ps -aq --filter "name=buildcage-proxy-" | xargs -r docker rm -f >/dev/null 2>&1
+  docker network ls --filter "name=buildcage-proxy-" -q | xargs -r docker network rm >/dev/null 2>&1
+  rm -rf "$WORKDIR"
+}
+trap cleanup EXIT
+
+GITHUB_WORKSPACE="$WORKDIR" \
+GITHUB_STATE="$WORKDIR/state.env" \
+GITHUB_STEP_SUMMARY="$WORKDIR/summary.md" \
+BUILDCAGE_BUILD_TEST_HOOKS=1 \
+BUILDCAGE_LOCAL_IMAGE_REF="$BUILDCAGE_LOCAL_IMAGE_REF" \
+INPUT_RUN='echo sandboxed-process-started; sleep 300' \
+  node run/dist/main.cjs > "$WORKDIR/out.log" 2>&1 &
+NODE_PID=$!
+
+echo "waiting for the sandboxed 'sleep 300' to start..." >&2
+FOUND=0
+for _ in $(seq 1 60); do
+  if pgrep -f "sleep 300" >/dev/null 2>&1; then
+    FOUND=1
+    break
+  fi
+  sleep 0.5
+done
+if [ "$FOUND" != "1" ]; then
+  echo "  FAIL  sandboxed process never started; see log below"
+  cat "$WORKDIR/out.log"
+  exit 1
+fi
+sleep 0.5
+
+# Sudo's `use_pty` setting (common on Ubuntu) forks a monitor process ahead
+# of the actual script, which also matches "run-isolated.sh" in its argv --
+# this must target the real bash instance, not sudo's monitor (see
+# run-isolated.sh's own comment on this same distinction).
+mapfile -t BASH_PIDS < <(pgrep -f "/bin/bash .*/run/scripts/run-isolated.sh")
+if [ "${#BASH_PIDS[@]}" != "1" ]; then
+  echo "  FAIL  expected exactly 1 run-isolated.sh bash process, found ${#BASH_PIDS[@]}: ${BASH_PIDS[*]:-<none>}"
+  exit 1
+fi
+BASH_PID="${BASH_PIDS[0]}"
+
+# run-isolated.sh runs as root (via sudo -n), so killing it requires the
+# same privilege.
+sudo -n kill -9 "$BASH_PID"
+sleep 2
+
+echo ""
+echo "=== Sandbox die-with-parent Assertions ==="
+echo ""
+if pgrep -f "sleep 300" >/dev/null 2>&1; then
+  echo "  FAIL  sandboxed process survived as an orphan after run-isolated.sh was killed"
+  FAILURES=$((FAILURES + 1))
+else
+  echo "  PASS  entire sandbox process tree died with run-isolated.sh"
+fi
+
+echo ""
+if [ "$FAILURES" -gt 0 ]; then
+  echo "❌ FAILED: $FAILURES assertion(s) failed"
+  exit 1
+fi
+echo "✅ All assertions passed."
+echo ""
diff --git a/run/test/integration-test-fs-escape.sh b/run/test/integration-test-fs-escape.sh
new file mode 100755
index 0000000..4763d3e
--- /dev/null
+++ b/run/test/integration-test-fs-escape.sh
@@ -0,0 +1,91 @@
+#!/bin/bash
+# Verifies the sandbox does NOT re-expose a writable copy of the whole host
+# `/` through the scratch dir's `mount --rbind /` rootfs. That rootfs lives
+# under the scratch dir at /var/tmp/buildcage/sandbox-*/rootfs; that base
+# isn't one of the writable exceptions, so the recursive writable rbinds
+# never re-expose it. Drives run/dist/main.cjs directly, like the other run
+# integration tests.
+set -uo pipefail
+
+: "${BUILDCAGE_LOCAL_IMAGE_REF:?BUILDCAGE_LOCAL_IMAGE_REF must be set to the locally built proxy image}"
+
+WORKDIR=$(mktemp -d)
+WORKDIR2=$(mktemp -d)
+trap 'rm -rf "$WORKDIR" "$WORKDIR2"' EXIT
+touch "$WORKDIR/state.env"
+
+GITHUB_WORKSPACE="$WORKDIR" \
+GITHUB_STATE="$WORKDIR/state.env" \
+GITHUB_STEP_SUMMARY="$WORKDIR/summary.md" \
+BUILDCAGE_BUILD_TEST_HOOKS=1 \
+BUILDCAGE_LOCAL_IMAGE_REF="$BUILDCAGE_LOCAL_IMAGE_REF" \
+INPUT_RUN='set -e
+echo "=== the scratch rootfs must not re-expose host / ==="
+escaped=0
+for d in /var/tmp/buildcage/sandbox-*/rootfs; do
+  [ -e "$d" ] || continue
+  if [ -e "$d/etc" ] || [ -e "$d/bin" ] || [ -e "$d/usr" ]; then
+    echo "ESCAPE: host / reachable via $d"
+    ls -la "$d" 2>/dev/null
+    escaped=1
+  fi
+  if echo x > "$d/etc/.buildcage-escape-test" 2>/dev/null; then
+    echo "ESCAPE: wrote to host / via $d"
+    escaped=1
+  fi
+done
+[ "$escaped" = "0" ] || exit 1
+echo "OK: no writable host / re-exposure under any scratch rootfs"
+
+echo "=== the real host / stays visible but read-only (nested mounts included) ==="
+[ -r /etc/hostname ] || { echo "UNEXPECTED: /etc not readable via normal path"; exit 1; }
+if echo x > /etc/.buildcage-escape-etc 2>/dev/null; then
+  echo "UNEXPECTED: /etc writable"
+  exit 1
+fi
+echo "OK: /etc readable, read-only"
+
+echo "=== /tmp itself stays host-shared and writable ==="
+echo x > /tmp/.buildcage-escape-tmp-test
+rm -f /tmp/.buildcage-escape-tmp-test
+echo "OK: /tmp writable"
+' \
+  node run/dist/main.cjs
+CODE=$?
+
+echo ""
+echo "=== Sandbox Filesystem-Escape Assertions ==="
+echo ""
+if [ "$CODE" = "0" ]; then
+  echo "  PASS  no writable host / re-exposure; host / stays read-only; /tmp writable"
+else
+  echo "  FAIL  filesystem-escape assertion check failed (exit $CODE)"
+  exit 1
+fi
+echo ""
+
+# Misconfiguration guard: `writable: /var/tmp/buildcage` (or an ancestor of
+# it) would recursively re-expose the sandbox's own rootfs read-write --
+# assertScratchBaseNotWritable in isolated-exec.js must fail the step closed
+# rather than silently running with that hole open.
+touch "$WORKDIR2/state.env"
+
+GITHUB_WORKSPACE="$WORKDIR2" \
+GITHUB_STATE="$WORKDIR2/state.env" \
+GITHUB_STEP_SUMMARY="$WORKDIR2/summary.md" \
+BUILDCAGE_BUILD_TEST_HOOKS=1 \
+BUILDCAGE_LOCAL_IMAGE_REF="$BUILDCAGE_LOCAL_IMAGE_REF" \
+INPUT_WRITABLE="/var/tmp/buildcage" \
+INPUT_RUN="true" \
+  node run/dist/main.cjs
+GUARD_CODE=$?
+
+echo "=== Sandbox writable:/var/tmp/buildcage Fail-Closed Assertion ==="
+echo ""
+if [ "$GUARD_CODE" != "0" ]; then
+  echo "  PASS  writable: /var/tmp/buildcage was rejected (fails closed)"
+else
+  echo "  FAIL  writable: /var/tmp/buildcage was accepted (should fail closed, exit 0)"
+  exit 1
+fi
+echo ""
diff --git a/run/test/integration-test-nested-mount-readonly.sh b/run/test/integration-test-nested-mount-readonly.sh
new file mode 100755
index 0000000..fa73a67
--- /dev/null
+++ b/run/test/integration-test-nested-mount-readonly.sh
@@ -0,0 +1,57 @@
+#!/bin/bash
+# Verifies that a real filesystem separately mounted underneath a writable
+# exception (here, a bind mount under $GITHUB_WORKSPACE) is still visible
+# but individually forced read-only inside the sandbox -- the writable
+# guarantee covers only the exception paths themselves
+# (workdir/home/tmp/RUNNER_TEMP/writable:), not everything nested under
+# them (see computeReadonlyHostMounts: protectedPaths is checked by exact
+# match, not by prefix). Ordinary files/directories under workdir (not
+# separate mount points) are already covered by
+# integration-test-defaults.sh; this covers the separate-mount case
+# specifically, which computeReadonlyHostMounts handles differently -- a
+# regression guard against a future change that widened the writable
+# exception into a mount-point prefix match instead of an exact one.
+set -uo pipefail
+
+: "${BUILDCAGE_LOCAL_IMAGE_REF:?BUILDCAGE_LOCAL_IMAGE_REF must be set to the locally built proxy image}"
+
+WORKDIR=$(mktemp -d)
+NESTED_SRC=$(mktemp -d)
+MOUNT_POINT="$WORKDIR/nested-mount"
+mkdir -p "$MOUNT_POINT"
+
+cleanup() {
+  sudo -n umount "$MOUNT_POINT" >/dev/null 2>&1
+  rm -rf "$WORKDIR" "$NESTED_SRC"
+}
+trap cleanup EXIT
+
+sudo -n mount --bind "$NESTED_SRC" "$MOUNT_POINT"
+touch "$WORKDIR/state.env"
+
+GITHUB_WORKSPACE="$WORKDIR" \
+GITHUB_STATE="$WORKDIR/state.env" \
+GITHUB_STEP_SUMMARY="$WORKDIR/summary.md" \
+BUILDCAGE_BUILD_TEST_HOOKS=1 \
+BUILDCAGE_LOCAL_IMAGE_REF="$BUILDCAGE_LOCAL_IMAGE_REF" \
+INPUT_RUN='mp="$GITHUB_WORKSPACE/nested-mount"
+[ -d "$mp" ] || { echo "UNEXPECTED: nested mount point not visible in sandbox"; exit 1; }
+if echo x > "$mp/.buildcage-nested-mount-test" 2>/dev/null; then
+  echo "UNEXPECTED: nested mount under workdir was writable"
+  exit 1
+fi
+echo "OK: nested mount under workdir is visible and read-only"
+' \
+  node run/dist/main.cjs
+CODE=$?
+
+echo ""
+echo "=== Sandbox Nested-Mount-Read-Only Assertion ==="
+echo ""
+if [ "$CODE" = "0" ]; then
+  echo "  PASS  a real mount nested under workdir is visible but forced read-only"
+else
+  echo "  FAIL  nested-mount read-only check failed (exit $CODE)"
+  exit 1
+fi
+echo ""
diff --git a/run/test/integration-test-non-runc-default-pseudofs-readonly.sh b/run/test/integration-test-non-runc-default-pseudofs-readonly.sh
new file mode 100755
index 0000000..0e8815b
--- /dev/null
+++ b/run/test/integration-test-non-runc-default-pseudofs-readonly.sh
@@ -0,0 +1,62 @@
+#!/bin/bash
+# Verifies that a real pseudo-filesystem mount NOT among runc's own default
+# base-spec mounts (see freshMountDestinationsFrom in isolated-exec.js) is
+# still forced read-only inside the sandbox, rather than being silently
+# tolerated just because it superficially looks like a "kernel pseudo-fs".
+# securityfs is a concrete, realistic example: it's commonly mounted at
+# /sys/kernel/security on AppArmor-enabled hosts (the default on GitHub
+# Actions' Ubuntu runner images), but runc's default spec never declares a
+# mount for it. This test synthesizes an equivalent mount at a throwaway
+# location outside every writable exception, since remounting the real
+# /sys/kernel/security wouldn't be safe to do from a test script.
+set -uo pipefail
+
+: "${BUILDCAGE_LOCAL_IMAGE_REF:?BUILDCAGE_LOCAL_IMAGE_REF must be set to the locally built proxy image}"
+
+# Deliberately under /var/tmp, not /tmp: /tmp is always a writable
+# exception, which would defeat the point of this test.
+MOUNT_POINT="/var/tmp/buildcage-securityfs-test-$$"
+mkdir -p "$MOUNT_POINT"
+WORKDIR=$(mktemp -d)
+
+cleanup() {
+  sudo -n umount "$MOUNT_POINT" >/dev/null 2>&1
+  rmdir "$MOUNT_POINT" 2>/dev/null
+  rm -rf "$WORKDIR"
+}
+trap cleanup EXIT
+
+sudo -n mount -t securityfs securityfs "$MOUNT_POINT"
+touch "$WORKDIR/state.env"
+
+GITHUB_WORKSPACE="$WORKDIR" \
+GITHUB_STATE="$WORKDIR/state.env" \
+GITHUB_STEP_SUMMARY="$WORKDIR/summary.md" \
+BUILDCAGE_BUILD_TEST_HOOKS=1 \
+BUILDCAGE_LOCAL_IMAGE_REF="$BUILDCAGE_LOCAL_IMAGE_REF" \
+INPUT_RUN="mp='$MOUNT_POINT'
+[ -d \"\$mp\" ] || { echo 'UNEXPECTED: securityfs mount point not visible in sandbox'; exit 1; }
+# securityfs's own directory entries are populated by kernel LSM
+# subsystems, not user-creatable, so attempting to create a new file
+# there fails with EACCES regardless of the mount's ro/rw status -- that
+# wouldn't distinguish a fixed sandbox from a broken one. Check the actual
+# mount options in this mount namespace instead.
+opts=\$(awk -v mp=\"\$mp\" '\$5 == mp { last = \$6 } END { print last }' /proc/self/mountinfo)
+case \",\$opts,\" in
+  *,ro,*) echo 'OK: securityfs mount is read-only' ;;
+  *) echo \"UNEXPECTED: securityfs mount options were '\$opts' (expected ro)\"; exit 1 ;;
+esac
+" \
+  node run/dist/main.cjs
+CODE=$?
+
+echo ""
+echo "=== Sandbox Non-runc-default Pseudo-FS Read-Only Assertion ==="
+echo ""
+if [ "$CODE" = "0" ]; then
+  echo "  PASS  a real securityfs mount not among runc's own default mounts is forced read-only"
+else
+  echo "  FAIL  securityfs read-only check failed (exit $CODE)"
+  exit 1
+fi
+echo ""
diff --git a/run/test/integration-test-runner-temp.sh b/run/test/integration-test-runner-temp.sh
new file mode 100755
index 0000000..91e338b
--- /dev/null
+++ b/run/test/integration-test-runner-temp.sh
@@ -0,0 +1,36 @@
+#!/bin/bash
+# Verifies $RUNNER_TEMP is writable inside the sandbox by driving
+# run/dist/main.cjs directly, without the real action wrapper -- see
+# test-e2e.yml's test_sandbox_enforcement for the one case that does.
+# buildOciConfig's RUNNER_TEMP handling is already unit-tested against the
+# generated config.json; this proves runc actually honors it.
+set -uo pipefail
+
+: "${BUILDCAGE_LOCAL_IMAGE_REF:?BUILDCAGE_LOCAL_IMAGE_REF must be set to the locally built proxy image}"
+
+WORKDIR=$(mktemp -d)
+RUNNER_TEMP_DIR=$(mktemp -d)
+trap 'rm -rf "$WORKDIR" "$RUNNER_TEMP_DIR"' EXIT
+touch "$WORKDIR/state.env"
+
+GITHUB_WORKSPACE="$WORKDIR" \
+GITHUB_STATE="$WORKDIR/state.env" \
+GITHUB_STEP_SUMMARY="$WORKDIR/summary.md" \
+RUNNER_TEMP="$RUNNER_TEMP_DIR" \
+BUILDCAGE_BUILD_TEST_HOOKS=1 \
+BUILDCAGE_LOCAL_IMAGE_REF="$BUILDCAGE_LOCAL_IMAGE_REF" \
+INPUT_RUN='echo x > "$RUNNER_TEMP/.buildcage-runner-temp-test"
+rm -f "$RUNNER_TEMP/.buildcage-runner-temp-test"' \
+  node run/dist/main.cjs
+CODE=$?
+
+echo ""
+echo "=== Sandbox \$RUNNER_TEMP Writable Assertion ==="
+echo ""
+if [ "$CODE" = "0" ]; then
+  echo "  PASS  \$RUNNER_TEMP is writable inside the sandbox"
+else
+  echo "  FAIL  \$RUNNER_TEMP was not writable inside the sandbox (exit $CODE)"
+  exit 1
+fi
+echo ""
diff --git a/run/test/integration-test-seccomp.sh b/run/test/integration-test-seccomp.sh
new file mode 100755
index 0000000..5bb1acc
--- /dev/null
+++ b/run/test/integration-test-seccomp.sh
@@ -0,0 +1,65 @@
+#!/bin/bash
+# Verifies the Docker-default-profile-derived seccomp filter actually
+# blocks the two syscall classes docs/security.md names as motivating
+# examples (unprivileged user-namespace creation, io_uring) by driving
+# run/dist/main.cjs directly, without the real action wrapper — see
+# test-e2e.yml's test_sandbox_enforcement for the one case that does.
+set -uo pipefail
+
+: "${BUILDCAGE_LOCAL_IMAGE_REF:?BUILDCAGE_LOCAL_IMAGE_REF must be set to the locally built proxy image}"
+
+WORKDIR=$(mktemp -d)
+trap 'rm -rf "$WORKDIR"' EXIT
+touch "$WORKDIR/state.env"
+
+GITHUB_WORKSPACE="$WORKDIR" \
+GITHUB_STATE="$WORKDIR/state.env" \
+GITHUB_STEP_SUMMARY="$WORKDIR/summary.md" \
+BUILDCAGE_BUILD_TEST_HOOKS=1 \
+BUILDCAGE_LOCAL_IMAGE_REF="$BUILDCAGE_LOCAL_IMAGE_REF" \
+INPUT_RUN='set -e
+echo "=== unshare -U (unprivileged user-namespace creation) must be blocked ==="
+if unshare -U true 2>/dev/null; then
+  echo "UNEXPECTED: unshare -U succeeded"
+  exit 1
+fi
+echo "OK: unshare -U blocked"
+
+echo "=== io_uring_setup must be blocked ==="
+if ! command -v cc >/dev/null 2>&1; then
+  echo "SKIP: no C compiler available to exercise the raw syscall"
+else
+  # No $ or backticks below, so an unquoted heredoc delimiter is safe (no
+  # accidental expansion by the shell that processes it).
+  cat > /tmp/io_uring_check.c <<EOF
+#include <sys/syscall.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <errno.h>
+int main() {
+  long ret = syscall(__NR_io_uring_setup, 1, NULL);
+  if (ret == -1 && errno == EPERM) { printf("OK: io_uring_setup blocked\n"); return 0; }
+  printf("UNEXPECTED: io_uring_setup returned %ld errno=%d\n", ret, errno);
+  return 1;
+}
+EOF
+  cc -O0 -o /tmp/io_uring_check /tmp/io_uring_check.c
+  /tmp/io_uring_check
+fi
+
+echo "=== an ordinary syscall-heavy operation must still work (filter is not overly broad) ==="
+echo hello | grep -q hello && echo "OK: basic pipeline works"
+' \
+  node run/dist/main.cjs
+CODE=$?
+
+echo ""
+echo "=== Sandbox Seccomp Assertions ==="
+echo ""
+if [ "$CODE" = "0" ]; then
+  echo "  PASS  seccomp filter blocks unshare -U / io_uring_setup while ordinary syscalls still work"
+else
+  echo "  FAIL  seccomp assertion check failed (exit $CODE)"
+  exit 1
+fi
+echo ""