fix: prove Linux Agent sandbox boundary

2026-07-10 17:59:56 +08:00
parent f4968d6657
commit f07f280b8f
19 changed files with 381 additions and 55 deletions
@@ -25,7 +25,7 @@ unit is written or enabled.
 Preflight validates the configured bind host/port, authenticated PostgreSQL
 access, Node/cph/Prisma, configured and canonical path traversal, and a real
 bubblewrap namespace. The post-provision phase runs the built Hub dependency
-graph, a database query, cph and bubblewrap as the service user under
+graph, a database query, cph, socat and bubblewrap as the service user under
 `no_new_privs`, matching the systemd security context. HTTP binding is awaited
 before the Feishu listener starts, so bind failure rejects startup instead of
 leaving a listener-only process alive.