Harden application container identity and kernel policy

[omry]

---

Stack created with Sapling. Best reviewed with ReviewStack.

• Add controlled-session lifecycle state machine #18
• Add controlled-session framed protocol #17
• Define controlled-session authorization #16
• Make queued admission cancellation deterministic #15
• Enforce coarse application network policy #14
• Protect host system trees from runtime binds #13
• Enforce root host filesystem boundary #12
• Add container-local runtime identities #11
• Verify application sandbox at startup #10
• -> Harden application container identity and kernel policy #9
• Unify application sandbox planning #8
• Document controlled sessions and repositories #7

[Copilot]

Pull request overview

This PR hardens the runtime security baseline for both persistent workload containers (Compose) and one-shot transient containers (shell/app commands/lifecycle) by standardizing container identity and enforcing stricter kernel/security options, while removing the previously used trusted “probe” bootstrap path for transient execution.

Changes:

• Remove the reploy-probe “run-transient” helper path and start transient containers directly as the final runtime UID/GID with a bounded tmpfs home.
• Add canonical supplementary group propagation across planning, install-account resolution, and Docker renderers; reject root-group membership for non-root identities.
• Enforce a kernel baseline (drop all Linux capabilities, enable no-new-privileges, and pin an explicit seccomp profile) across Compose workloads and transient docker run/create.

Reviewed changes

Copilot reviewed 42 out of 42 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
internal/probe/run_transient.go	Removed transient-runner implementation from probe helper.
internal/probe/run_transient_linux.go	Removed Linux transient-runner implementation from probe helper.
internal/probe/run_transient_other.go	Removed non-Linux transient-runner stub from probe helper.
internal/probe/main.go	Removed run-transient CLI mode and updated argument handling.
internal/probe/protocol_test.go	Removed tests covering run-transient mode and identity parsing.
internal/dockerdeploy/testdata/resolved_compose.yaml	Updated golden Compose output to include group/cap/security options and tmpfs ownership.
internal/dockerdeploy/provider_uninstall_public_test.go	Updated runtime comparisons to use reflect.DeepEqual for slice-bearing structs.
internal/dockerdeploy/provider_install_run.go	Extended install options to carry supplementary GIDs.
internal/dockerdeploy/provider_install_public_test.go	Updated runtime comparisons for supplementary groups.
internal/dockerdeploy/provider_install_plan.go	Propagated supplementary GIDs into Docker plan context.
internal/dockerdeploy/provider_install_plan_test.go	Asserted supplementary group propagation into Docker sandbox planning.
internal/dockerdeploy/provider_install_entry_test.go	Updated runtime comparisons for supplementary groups.
internal/dockerdeploy/provider_install_account.go	Ensured system install input resets/sets supplementary GIDs appropriately.
internal/dockerdeploy/provider_install_account_test.go	Added/updated coverage for supplementary group propagation via resolved install owner.
internal/dockerdeploy/provider_build_run.go	Included host supplementary group discovery/normalization and propagated into Docker planning.
internal/dockerdeploy/provider_build_run_test.go	Updated staged runtime tests to validate supplementary group normalization behavior.
internal/dockerdeploy/private_workload_environment_integration_test.go	Added live checks for UID/GID/groups and kernel baseline inside the container.
internal/dockerdeploy/live_run_container_test.go	Updated transient execution planning calls to new signature (no probe workspace).
internal/dockerdeploy/install_account_support.go	Resolved and normalized supplementary groups for install owners.
internal/dockerdeploy/install_account_support_test.go	Added unit tests for supplementary group resolution and root-group rejection.
internal/dockerdeploy/execution_render.go	Rendered Compose with group_add, cap_drop, security_opt, and tmpfs ownership.
internal/dockerdeploy/execution_render_test.go	Updated render assertions to include kernel baseline and new tmpfs options.
internal/dockerdeploy/execution_plan.go	Extended planning context and runtime user plan to include supplementary GIDs.
internal/dockerdeploy/environment_lifecycle_executor.go	Removed probe workspace preparation from transient lifecycle execution path.
internal/dockerdeploy/current_workload_lifecycle.go	Removed probe workspace preparation from transient lifecycle actions.
internal/dockerdeploy/current_workload_lifecycle_test.go	Updated ordering expectations after removing probe workspace lifecycle steps.
internal/dockerdeploy/current_shell_run.go	Removed probe workspace preparation from reploy shell transient execution.
internal/dockerdeploy/current_shell_run_test.go	Updated ordering expectations and execution backend signatures.
internal/dockerdeploy/current_runtime_plan.go	Propagated supplementary groups into current-runtime Docker planning context.
internal/dockerdeploy/current_app_command_run.go	Removed probe workspace preparation from transient app-command execution.
internal/dockerdeploy/current_app_command_run_test.go	Updated ordering expectations and execution backend signatures.
internal/dockerdeploy/command_execution.go	Reworked transient container invocation: tmpfs home with uid/gid, final identity at start, kernel baseline flags, direct entrypoint.
internal/dockerdeploy/command_execution_test.go	Updated unit tests for new transient/shell command argv structure and security flags.
internal/dockerdeploy/command_execution_integration_test.go	Updated Docker integration test to validate identity + kernel baseline (and removed probe helper build).
internal/dockerdeploy/application_sandbox_plan.go	Introduced canonical kernel policy in sandbox plan and supplementary group normalization/validation.
internal/dockerdeploy/application_sandbox_plan_test.go	Added/updated tests to validate identity/kernel escape rejection and renderer parity.
docs/REDESIGN_EVALUATION.md	Updated design notes to reflect tmpfs-based home + removal of trusted bootstrap helper.
docs/CONTROLLED_SESSION_DESIGN.md	Documented current implementation status of identity and kernel baseline enforcement.
docs/BLUEPRINT_ENVIRONMENT_MODEL.md	Updated environment model docs to describe tmpfs home and direct final-identity start.
docs/BACKLOG.md	Added a P1 backlog item for Docker Desktop identity work (macOS/Windows).
docs/APT_PROVIDER_DETAIL_DESIGN.md	Updated provider design doc to reflect tmpfs home and removal of bootstrap helper.
.changes/unreleased/+application-kernel-sandbox.yaml	Added a Security changelog fragment for the hardened baseline.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[omry]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: a09b60cb15

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[omry]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 8f9d4a7488

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".