feat: migrate the run action's sandbox to runc with seccomp support#175

Merged

dash14 merged 28 commits into

mainfrom

feat/run-action-runc-migration

Jul 19, 2026

Commits on Jul 19, 2026

feat: distribute runc and a seccomp profile generator in run's proxy image
dash14
committed
feat: extract runc/gen-seccomp-profile and build the OCI bundle in JS
dash14
committed
feat: drive run-isolated.sh's sandbox via runc instead of unshare/setpriv
dash14
committed
feat: add a die-with-parent equivalent via setpriv --pdeathsig
dash14
committed
test: add seccomp and die-with-parent integration tests, fix the dev loop
dash14
committed
docs: describe the runc-based sandbox and seccomp filter
dash14
committed
fix: assert exact values in the dev-loop smoke test, not just presence
dash14
committed
fix: prevent rmSync from destroying host files and fix root.readonly's non-recursion
dash14
committed
fix: wrap OCI bundle construction in a SandboxError
dash14
committed
refactor: share the extra masked /proc paths between JS and the dev loop
dash14
committed
refactor: require --gateway/--dns/--target-ip instead of hardcoded defaults
dash14
committed
chore: track run/dev/Dockerfile's RUNC_VERSION with renovate too
dash14
committed
fix: guard against pgrep -f matching multiple run-isolated.sh processes
dash14
committed
perf: cache the runc bootstrap (extraction/spec/seccomp) per proxy image
dash14
committed
docs: describe the runc bootstrap cache added in the previous commit
dash14
committed
fix: retry the scratch-dir cleanup on transient EBUSY
dash14
committed
fix: stage the rootfs bind-mount in a private mount namespace
dash14
committed
docs: describe the private mount namespace staging from the previous commit
dash14
committed
refactor: trim redundant comments in the runc migration's source files
dash14
committed
fix: use sudo to kill run-isolated.sh in the die-with-parent test
dash14
committed
docs: rewrite Run Action Internals as a chronological walkthrough
dash14
committed
refactor: extract the runc bootstrap into the run's own scratch directory
dash14
committed
fix: stage the sandbox rootfs outside every writable exception and reclaim it from post
dash14
committed
fix: resolve setpriv to an absolute path for the sandboxed init
dash14
committed
docs: clarify the run action's design goal and the Docker-in-sandbox limitation
dash14
committed
test: cover $RUNNER_TEMP writability and nested-mount read-only enforcement at the OS level
dash14
committed
perf: bind-mount the sandbox rootfs before setting up its network
dash14
committed
fix: force read-only real host mounts runc doesn't itself remount fresh
dash14
committed