Harden sandbox: drop ptrace, tighten socket egress, enforce cap-drop/no-new-privileges - #160

Open

MauricioPerera wants to merge 3 commits into

openai:mainfrom

MauricioPerera:security-hardening-fixes

Commits on Jul 30, 2026

Harden sandbox seccomp: drop ptrace and tighten socket domain allowlist
MauricioPerera
committed
Fail closed if not launched with --cap-drop ALL --security-opt no-new-privileges
MauricioPerera
committed

Commits on Jul 31, 2026

Address Codex review: CI hardening flags, AF_NETLINK for bwrap, drop socketcall
MauricioPerera
committed