Vouch Request: waynesun09

[waynesun09]

Hi — I filed #2069 (supervisor v0.0.73 crashes in rootless Podman due to cap_drop_bound() EPERM with non-empty bounding set) and @johntmyers asked if I could send a PR.

I have a fix ready in PR #2072 (auto-closed by the vouch gate). The change adds a fourth match arm to validate_capability_bounding_set_clear() for EPERM + non-empty bounding set — logs a warning and continues instead of crashing. It also adds a rootless-caps CI job that runs the supervisor capability tests as an unprivileged user on ubuntu-24.04 to prevent regressions.

I tested the fix locally by building the supervisor binary from the fix branch, packaging it into a local supervisor OCI image, and running it through the OpenShell gateway on macOS + Podman machine. The sandbox reached Ready and the supervisor logged the expected warning instead of crashing. I also ran it through a downstream fullsend agent pipeline end-to-end — sandbox creation, bootstrap, and code injection all succeeded.

I am a software engineer at Red Hat working on AI agent infrastructure. We use OpenShell as the sandbox runtime in our agent pipelines and hit this crash across all our organizations when supervisor :latest was re-tagged to v0.0.73.

[maxamillion]

/vouch

[github-actions[bot]]

@waynesun09 has been vouched by @maxamillion.

You can now submit pull requests to OpenShell. Welcome aboard.

Please read CONTRIBUTING.md before submitting.