fix: keep agent-executor nsjail opt-in

daryllimyt · daryllimyt · commit a3b93228cb16 · 2026-04-23T13:30:52.000-04:00
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
@@ -345,10 +345,10 @@ services:
       target: development
     restart: unless-stopped
     # Required for nsjail sandbox (agent runtime isolation)
-    cap_add:
-      - SYS_ADMIN
-    security_opt:
-      - seccomp:unconfined
+    # cap_add:
+    #   - SYS_ADMIN
+    # security_opt:
+    #   - seccomp:unconfined
     # Required for pasta userspace networking (creates TAP device in sandbox netns)
     # devices:
     #   - /dev/net/tun:/dev/net/tun
