fix: preserve agent startup with restricted tmp - #7679

Merged

lpcox merged 18 commits into

mainfrom

copilot/fix-filesystem-allowwrite-issue

Aug 24, 2026

Commits on Aug 23, 2026

Initial plan
Copilot
authored
94546d8
fix: move init signal mount outside tmp
Copilot
authored
a0d68d4
fix: escape init signal dir in compose command
Copilot
authored
74c60b3

Commits on Aug 24, 2026

test: run filesystem-allowwrite integration test in CI

lpcox
and
Copilot
committed
e8c4435
fix: skip credential overlays for files absent on the host

lpcox
and
Copilot
committed
d4d0614
fix: drop credential overlays that cannot be mounted under a policy

lpcox
and
Copilot
committed
7b3593d
fix: prepare the workspace mountpoint inside the chroot home

lpcox
and
Copilot
committed
82a45a5
fix: stage the chroot command script under /run, not /tmp

lpcox
and
Copilot
committed
0cb81ea
fix: prepare nested mountpoints and stage helpers off /tmp

Lawrence Cox
and
Copilot
committed
0f46d2b
test: assert no preparation, not zero nested mountpoints

Lawrence Cox
and
Copilot
committed
eac540f
fix: give the init container the legacy signal path and file mountpoints

Lawrence Cox
and
Copilot
committed
94c4a32
fix: treat an absent bind source as a directory mountpoint

Lawrence Cox
and
Copilot
committed
319add7
fix: refuse an unusable file mountpoint instead of trusting it

Lawrence Cox
and
Copilot
committed
e831ac6
fix: keep a shared /tmp path prefix runner-resolvable

Lawrence Cox
and
Copilot
committed
e09f0e1
test: pin prefix resolution to a platform-independent shape

Lawrence Cox
and
Copilot
committed
12eb70d
fix: distinguish shared from daemon-only Docker host path prefixes

Lawrence Cox
and
Copilot
committed
f85b0d4
test: assert prepared mountpoints instead of modelling runc on daemon paths

Lawrence Cox
and
Copilot
committed
4af3832
test: scope the shared /tmp assertions to prefix-invariant mounts

Lawrence Cox
and
Copilot
committed
43d47a2

Navigation Menu

Uh oh!

fix: preserve agent startup with restricted tmp - #7679

fix: preserve agent startup with restricted tmp#7679
lpcox merged 18 commits into
mainfrom
copilot/fix-filesystem-allowwrite-issue

Commits on Aug 23, 2026

Initial plan

fix: move init signal mount outside tmp

fix: escape init signal dir in compose command

Commits on Aug 24, 2026

test: run filesystem-allowwrite integration test in CI

fix: skip credential overlays for files absent on the host

fix: drop credential overlays that cannot be mounted under a policy

fix: prepare the workspace mountpoint inside the chroot home

fix: stage the chroot command script under /run, not /tmp

fix: prepare nested mountpoints and stage helpers off /tmp

test: assert no preparation, not zero nested mountpoints

fix: give the init container the legacy signal path and file mountpoints

fix: treat an absent bind source as a directory mountpoint

fix: refuse an unusable file mountpoint instead of trusting it

fix: keep a shared /tmp path prefix runner-resolvable

test: pin prefix resolution to a platform-independent shape

fix: distinguish shared from daemon-only Docker host path prefixes

test: assert prepared mountpoints instead of modelling runc on daemon paths

test: scope the shared /tmp assertions to prefix-invariant mounts