Skip to content

fix(gateway): validate container workspaces in their own namespace - #140703

Open
nateEc wants to merge 3 commits into
NousResearch:mainfrom
nateEc:codex/fix-container-session-cwd
Open

nateEc wants to merge 3 commits into
NousResearch:mainfrom
nateEc:codex/fix-container-session-cwd

Conversation

@nateEc

@nateEc nateEc commented Oct 17, 2026 •

Copy link
Copy Markdown

Fixes #140527.

A Docker profile can use its container workspace even when that path does not exist on the gateway host. Explicit volume destinations under /home or /Users also survive cwd sanitization. Host-local and automatic host-mount modes retain their existing-directory checks.

Session creation, frozen-policy restore, shared workspace readiness and managed-worker admission validate paths in the correct namespace. Preserve the structured missing-host-folder error and never-run settlement behavior. The regressions drive real terminal/config consumers and the managed admission guard; only worker execution is stubbed there.

Current-main reconciliation — 2026-11-07

Merged main 122fc40fb06b722b4debedac429c57336cff61ae into this branch, retaining both this PR's container-workspace probes and main's new Desktop workspace selection/recreation tests. Original commit authorship is preserved. Tested head: 7d9a87c73c76bfd7391fee5786e84ffae5ab432f.

Validation

  • Current-main production code with the retained regressions: 3 container cases failed, 2 host-directory controls passed.
  • scripts/run_tests.sh tests/tools/test_docker_backend_real.py tests/gateway/test_session_policy_remote_cwd.py tests/gateway/test_docker_session_workspace.py --fail-on-skip -q -j 1: 47 passed, zero skips, including 12 real-container tests.
  • Real Docker probes follow creation → frozen-policy restore → terminal → file tools for /work, /home and /Users destinations, using a Unicode/space-containing host bind mount. They verify running containers, cwd persistence, byte-exact file roundtrips, Desktop workspace selection, container recreation and cleanup.
  • Adjacent workspace-readiness, cwd sanitization, mounted-host cwd and Modal suites: 40 passed, 3 Linux-only skips.
  • All 15 scripts/check checks pass; dependency locks are unchanged.
  • Native macOS / isolated PM-built Python 3.14, retries disabled, Docker Desktop 28.1.1, linux/arm64 debian:13-slim. Tested image ID: sha256:37e6c80085f82a8a7f1cea2b83f036d9c084a2cd3d5be1aa6fd56d7c6f8ad7ba.
  • All test containers removed. No full-suite or native Linux managed-process E2E claim.

No change to host-side context-file discovery. Upstream Actions require maintainer approval; local verification is not an upstream-CI success claim.

@whyyagswhy

Copy link
Copy Markdown

Verified head SHA 0448249b matches PR. tests/gateway/test_session_policy_remote_cwd.py: 11 passed, 0 failed via scripts/run_tests.sh. ruff clean on changed files.

@alt-glitch alt-glitch added area/sessions Session lifecycle, resume, persistence, history backend/docker Docker container execution comp/gateway Gateway runner, session dispatch, delivery comp/tools Tool registry, model_tools, toolsets P2 Medium — degraded but workaround exists type/bug Something isn't working tool/file File tools (read, write, patch, search) labels Oct 17, 2026
@nateEc
nateEc marked this pull request as ready for review October 19, 2026 02:24
• 容器会话的创建、恢复和逐轮就绪检查不再依赖宿主目录是否存在;本地和自动挂载模式仍保持宿主校验。

• 显式 Docker 挂载目标及子目录优先于宿主路径启发式,避免有效目录被回退为 /root。

• 新增回归先红后绿;邻近 53 个测试通过,两个进程级失败在未修改 main 上同样复现,12 项检查通过。
• 贯通会话创建、策略恢复、终端执行和文件工具,覆盖三种容器路径及含中文空格的宿主挂载目录。

• 验证目录持久化、文件字节一致性及容器清理;旧基线三例均因目录校验失败。

• Docker Desktop 实机 10 个测试和网关 11 个回归通过,12 项检查通过。
合并当前主线,保留容器命名空间修复及 Desktop 工作区选择和重建的新增用例。
验证 12 项真实 Docker 测试及相关测试,共 87 项通过,3 项 Linux 专属测试跳过。
原主线复现 3 项容器目录失败,2 项宿主目录对照通过;15 项仓库检查通过。

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/sessions Session lifecycle, resume, persistence, history backend/docker Docker container execution comp/gateway Gateway runner, session dispatch, delivery comp/tools Tool registry, model_tools, toolsets P2 Medium — degraded but workaround exists tool/file File tools (read, write, patch, search) type/bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Docker backend: no terminal.cwd value works for both the gateway and the container when docker_mount_cwd_to_workspace: false

3 participants