Conversation
There was a problem hiding this comment.
Pull request overview
This PR introduces a Linux-only “verify-and-exec” startup verifier that runs as the outermost process for workloads/commands, validates the container’s kernel sandbox baseline via /proc/self/status, and only then execs the intended application argv. It threads the verifier contract through runtime policy, build locks, and Docker execution paths by adding a dedicated “application runtime layer” that embeds the probe into the final runnable image lineage.
Changes:
- Add
reploy-probe verify-execmode that fails closed unless seccomp filtering,no-new-privileges, and empty capability sets are active before executing the application. - Package the probe into a dedicated application runtime layer and record/validate that layer in the build lock + current-build verification flows.
- Update Docker render/exec paths (persistent workloads, private-environment workloads, transient commands, shells) to run via the verifier entrypoint and verified argv contract.
Reviewed changes
Copilot reviewed 48 out of 48 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| internal/probe/startup_verifier.go | Implements /proc/self/status parsing and verify-and-exec logic. |
| internal/probe/startup_verifier_test.go | Unit tests for status parsing and verify-exec argv/flow guarantees. |
| internal/probe/startup_exec_other.go | Non-Linux exec backend stub for verify-exec mode. |
| internal/probe/startup_exec_linux.go | Linux exec backend using syscall.Exec. |
| internal/probe/protocol_test.go | Ensures existing probe modes don’t touch verifier/exec paths. |
| internal/probe/main.go | Adds verify-exec -- <abs cmd...> CLI mode wiring. |
| internal/dockerdeploy/testdata/resolved_compose.yaml | Updates compose to run workload via probe entrypoint + verify-exec contract. |
| internal/dockerdeploy/runtime_policy_compile.go | Includes startup verifier contract in compiled runtime policy. |
| internal/dockerdeploy/runtime_layer_test_helpers_test.go | Test helper to construct runtime-layer fixtures for build locks. |
| internal/dockerdeploy/runtime_host_preflight_test.go | Updates policy fixtures to include startup verifier contract. |
| internal/dockerdeploy/provider_graph_validation_test.go | Updates policy fixtures to include startup verifier contract. |
| internal/dockerdeploy/provider_build_prepare.go | Loads/validates verifier metadata and threads it into reuse matching/prep. |
| internal/dockerdeploy/provider_build_prepare_test.go | Adds backend fixture for verifier loading during prepare. |
| internal/dockerdeploy/provider_build_execute.go | Threads verifier into provider build completion input. |
| internal/dockerdeploy/provider_build_completion.go | Validates verifier and passes it into final validation/finalization pipeline. |
| internal/dockerdeploy/provider_build_completion_test.go | Updates completion tests for runtime-layer output and verifier plumbing. |
| internal/dockerdeploy/private_workload_environment_test.go | Asserts private env compose now uses verifier entrypoint + verify-exec args. |
| internal/dockerdeploy/private_workload_environment_integration_test.go | Uses an image that includes the verifier runtime layer for integration tests. |
| internal/dockerdeploy/prepared_python_graph_reuse_test.go | Updates reuse fixtures for runtime layer + policy verifier. |
| internal/dockerdeploy/full_validation.go | Allows validating a “final” image distinct from the last component layer. |
| internal/dockerdeploy/full_validation_test.go | Updates tests to cover distinct final validation behavior. |
| internal/dockerdeploy/final_validation_pipeline.go | Builds/inspects/retains the runtime layer before validating/finalizing. |
| internal/dockerdeploy/final_validation_pipeline_test.go | Adds coverage for runtime-layer failure cleanup/ordering and updated requests. |
| internal/dockerdeploy/execution_render.go | Renders verifier entrypoint + verify-exec argv for workloads/private env flows. |
| internal/dockerdeploy/current_build_verify.go | Verifies cached runtime layer + validates finalization against runtime image. |
| internal/dockerdeploy/current_build_verify_test.go | Updates fixtures/expectations for runtime image inspection and validation count. |
| internal/dockerdeploy/current_build_reuse.go | Adds verifier as a semantic reuse boundary for current-build matching. |
| internal/dockerdeploy/current_build_reuse_test.go | Adds reuse invalidation coverage for verifier drift. |
| internal/dockerdeploy/command_execution.go | Runs transient commands via verifier entrypoint + verify-exec argv. |
| internal/dockerdeploy/command_execution_test.go | Updates arg assertions for verifier entrypoint + verify-exec contract. |
| internal/dockerdeploy/command_execution_integration_test.go | Uses verifier-including image and asserts baseline enforcement in Docker. |
| internal/dockerdeploy/build_publication_test.go | Updates build publication fixtures for runtime-layer presence/lineage. |
| internal/dockerdeploy/build_lock_assembly.go | Stores runtime layer in the build lock and validates runtime-layer connectivity. |
| internal/dockerdeploy/build_lock_assembly_test.go | Updates assembly test expectations for runtime-layer-based validation subject. |
| internal/dockerdeploy/application_startup_verifier_integration_test.go | New Docker integration test for verifier enforcement + argv exactness + exit code. |
| internal/dockerdeploy/application_sandbox_plan.go | Adds verifier contract to sandbox plan and validates it. |
| internal/dockerdeploy/application_sandbox_plan_test.go | Adds sandbox rejection cases for verifier contract drift + updates args expectations. |
| internal/dockerdeploy/application_runtime_layer.go | Builds/inspects the runtime layer that injects the probe into the runnable image. |
| internal/dockerdeploy/application_runtime_layer_test.go | Unit tests for Dockerfile rendering and runtime-layer identity invariants. |
| internal/dockerdeploy/application_runtime_layer_retention.go | Retains runtime layer images via content-addressed Docker tags. |
| internal/dockerdeploy/application_runtime_layer_retention_test.go | Tests retention behavior, reuse, rollback, and mismatch handling. |
| internal/deploy/runtime_verifier.go | Defines verifier + runtime-layer schemas/contracts and validation utilities. |
| internal/deploy/runtime_policy.go | Adds startup verifier to runtime policy schema + validation. |
| internal/deploy/runtime_policy_test.go | Updates policy fixtures for startup verifier field. |
| internal/deploy/build_lock.go | Adds runtime layer to build lock and enforces lineage/verifier-policy consistency. |
| internal/deploy/build_lock_test.go | Updates build lock fixtures and adds negative coverage for runtime layer constraints. |
| docs/CONTROLLED_SESSION_DESIGN.md | Documents startup verification as part of the global sandbox prerequisites. |
| .changes/unreleased/+application-startup-verifier.yaml | Adds a Security changelog fragment for the new verifier behavior. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| func readApplicationKernelStatus() ([]byte, error) { | ||
| content, err := os.ReadFile(applicationKernelStatusPath) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("read %s: %w", applicationKernelStatusPath, err) | ||
| } | ||
| return content, nil | ||
| } |
|
@codex review |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
84b0485 to
e56a29a
Compare
1c324c7 to
c34da44
Compare
b8b814a to
83068ca
Compare
7f18dd4 to
b6a8b57
Compare
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b6a8b57e8d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bda823d785
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5a883f44a3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Nodes []NodeLockV1 `json:"nodes"` | ||
| Catalog []providers.RealizedOutput `json:"catalog"` | ||
| RuntimePolicy RuntimePolicyV1 `json:"runtime_policy"` | ||
| RuntimeLayer ApplicationRuntimeLayerV1 `json:"runtime_layer"` |
There was a problem hiding this comment.
Existing deployments have build locks already written with schema: "lock-v1" that do not contain the new runtime_layer field (and their embedded runtime policy also lacks startup_verifier). After this change, ReadBuildLock still decodes them as lock-v1 but DecodeBuildLockV1/ValidateBuildLockV1 rejects the zero-value verifier/runtime layer, and ValidateCurrentBuild propagates that error from build preparation instead of treating the old current build as stale. That means an upgraded user with a pre-verifier current generation can be blocked before Reploy gets a chance to rebuild the image with the new verifier; please add a schema migration/version bump or explicitly classify pre-verifier locks as rebuildable stale state.
Useful? React with 👍 / 👎.
Stack created with Sapling. Best reviewed with ReviewStack.