@boldblackai/harness 1.8.5 → 1.9.0

package/README.md

@@ -25,7 +25,7 @@ and [`hermes`](https://github.com/NousResearch/hermes-agent) — so you can poin
 
 ## Quickstart
 
-[Docker](https://www.docker.com) is required. By default, harness uses LM Studio locally:
+A container runtime is required. By default harness uses [Docker](https://www.docker.com); on macOS 26 / Apple Silicon you can also use Apple's native [`container`](https://github.com/apple/container) CLI — see [Container runtime](#container-runtime). With the default runtime and LM Studio locally:
 
 ```bash
 lms daemon up
@@ -189,6 +189,8 @@ Each run starts the container with:
 - `--security-opt seccomp=...` — inline seccomp profile blocks `socket(AF_ALG)` to prevent kernel crypto API access (a known container escape vector)
 - Only your mounted directory (or single file with `-f`) is visible to the agent
 
+These hardening flags are docker-specific. Under `HARNESS_CONTAINER_RUNTIME=apple`, `--security-opt` is not applied (apple/container workloads are microVMs with their own guest kernel, so the seccomp profile's host-kernel role is subsumed by the VM boundary); capability restrictions remain. See [Container runtime](#container-runtime).
+
 ### Image verification
 
 By default, harness verifies that the container image was signed by the official CI workflow and carries a valid SLSA provenance attestation. This requires [cosign](https://github.com/sigstore/cosign):
@@ -241,9 +243,27 @@ If an old `.harness/` directory exists in your working directory, harness will e
 
 ### Environment variables
 
-| Variable             | Description |
-|----------------------|-------------|
-| `HARNESS_IMAGE_TAG`  | Override the Docker image tag (defaults to the package version). Setting this implies `--no-verify`. |
+| Variable                    | Description |
+|-----------------------------|-------------|
+| `HARNESS_IMAGE_TAG`         | Override the Docker image tag (defaults to the package version). Setting this implies `--no-verify`. |
+| `HARNESS_CONTAINER_RUNTIME` | Container runtime to use: `docker` (default) or `apple` (Apple's [`container`](https://github.com/apple/container) CLI). |
+| `XDG_DATA_HOME`             | Override the base directory for persistence data (defaults to `~/.local/share`). |
+| `XDG_CACHE_HOME`            | Override the base directory for the cosign cache (defaults to `~/.cache`). |
+
+#### Container runtime
+
+By default harness runs images with `docker`. On macOS 26 / Apple Silicon you can opt into Apple's native [`container`](https://github.com/apple/container) CLI (v1.0.0+) instead, which runs OCI images as lightweight Linux microVMs:
+
+```bash
+brew install container     # install Apple's container CLI (v1.0.0+)
+export HARNESS_CONTAINER_RUNTIME=apple
+container system start     # one-time: start the container system service
+harness -p "write me a fizzbuzz in Go"
+```
+
+The value is **named, not boolean** (`apple` or `docker`, case-insensitive); any other value is a hard error. harness never auto-detects the runtime — you must opt in. Image verification (cosign + SLSA provenance) works identically under both runtimes; the verified-digest cache is keyed by digest, so a digest verified under one runtime is a cache hit under the other.
+
+**Security note.** Under `=apple`, harness does not apply the `--security-opt no-new-privileges` and `--security-opt seccomp=...` flags it uses under docker, because `apple/container` has no `--security-opt` option. This is not a security regression: each apple/container workload is a microVM with its own ephemeral guest kernel (Apple Virtualization framework), so the `block-af-alg.json` profile's host-kernel role — blocking `socket(AF_ALG)` — is subsumed by the VM boundary itself (hardware-assisted isolation, strictly stronger than a syscall filter). Capability restrictions (`--cap-drop=ALL --cap-add=NET_RAW`) **are** supported and stay on. Only `ro`/`readonly` is honored for volume options under the apple path (SELinux relabel flags like `:Z` are meaningless under macOS virtiofs).
 
 ### Agent-specific behavior
 

package/bin/harness.js

@@ -10,6 +10,150 @@ const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const minimist_1 = __importDefault(require("minimist"));
 const SECCOMP_PROFILE = node_path_1.default.join(__dirname, "seccomp-profiles", "block-af-alg.json");
+class DockerRuntime {
+    binary() {
+        return "docker";
+    }
+    pullArgs(image) {
+        return ["pull", image];
+    }
+    inspectImage(image) {
+        try {
+            const out = (0, node_child_process_1.execFileSync)("docker", [
+                "image",
+                "inspect",
+                "--format",
+                "{{if .RepoDigests}}{{index .RepoDigests 0}}{{end}}",
+                image,
+            ], { stdio: ["ignore", "pipe", "ignore"], timeout: 5000 })
+                .toString()
+                .trim();
+            return {
+                exists: true,
+                digest: /@sha256:[0-9a-f]{64}$/.test(out) ? out : null,
+            };
+        }
+        catch {
+            return { exists: false, digest: null };
+        }
+    }
+    runArgs(input) {
+        const ttyFlags = input.interactive ? ["-it"] : ["-i"];
+        return [
+            "run",
+            "--rm",
+            ...ttyFlags,
+            "--cap-drop=ALL",
+            "--cap-add=NET_RAW",
+            "--security-opt",
+            "no-new-privileges:true",
+            "--security-opt",
+            `seccomp=${SECCOMP_PROFILE}`,
+            ...input.envFileArgs,
+            ...input.envArgs,
+            ...input.volumeArgs,
+            ...input.userVolumeArgs,
+            "-w",
+            input.workdir,
+            input.image,
+            ...input.containerCmd,
+        ];
+    }
+    ensureReady() {
+        // docker is the default; assume present. (A missing docker surfaces as a
+        // clear spawn ENOENT at run time, same as pre-runtime-abstraction behavior.)
+    }
+}
+class AppleContainerRuntime {
+    binary() {
+        return "container";
+    }
+    pullArgs(image) {
+        // apple/container nests pull under the `image` subgroup.
+        return ["image", "pull", image];
+    }
+    inspectImage(image) {
+        let out;
+        try {
+            out = (0, node_child_process_1.execFileSync)("container", ["image", "inspect", image], {
+                stdio: ["ignore", "pipe", "ignore"],
+                timeout: 5000,
+            }).toString();
+        }
+        catch {
+            return { exists: false, digest: null };
+        }
+        // apple/container's `image inspect` always emits a JSON array (no
+        // --format flag). The image-index/manifest-list digest it reports at
+        // data[0].configuration.descriptor.digest is exactly what cosign signs
+        // for a multi-arch image and what docker exposes as the RepoDigest.
+        try {
+            const parsed = JSON.parse(out);
+            const digest = Array.isArray(parsed)
+                ? parsed[0]?.configuration?.descriptor?.digest
+                : null;
+            if (typeof digest === "string" && /^sha256:[0-9a-f]{64}$/.test(digest)) {
+                const repo = image.split(":")[0];
+                return { exists: true, digest: `${repo}@${digest}` };
+            }
+            return { exists: true, digest: null };
+        }
+        catch {
+            return { exists: true, digest: null };
+        }
+    }
+    runArgs(input) {
+        // apple/container (Swift ArgumentParser) wants -i and -t as separate
+        // tokens (no clustered -it) and space-separated capability values (no
+        // `=` join). It has no --security-opt at all: each workload is a microVM
+        // with its own guest kernel, so the block-af-alg seccomp profile's
+        // host-kernel role is subsumed by the VM boundary and no-new-privileges
+        // is only a minor in-guest defense-in-depth loss. Capability
+        // restrictions ARE supported, so --cap-drop=ALL --cap-add=NET_RAW stays.
+        const ttyFlags = input.interactive ? ["-i", "-t"] : ["-i"];
+        return [
+            "run",
+            "--rm",
+            ...ttyFlags,
+            "--cap-drop",
+            "ALL",
+            "--cap-add",
+            "NET_RAW",
+            ...input.envFileArgs,
+            ...input.envArgs,
+            ...input.volumeArgs,
+            ...input.userVolumeArgs,
+            "-w",
+            input.workdir,
+            input.image,
+            ...input.containerCmd,
+        ];
+    }
+    ensureReady() {
+        try {
+            (0, node_child_process_1.execFileSync)("container", ["--version"], {
+                stdio: ["ignore", "ignore", "ignore"],
+                timeout: 5000,
+            });
+        }
+        catch {
+            console.error("harness: HARNESS_CONTAINER_RUNTIME=apple requires the `container` CLI (Apple container, v1.0.0+). Install from https://github.com/apple/container/releases and run `container system start`, or unset HARNESS_CONTAINER_RUNTIME to use docker.");
+            process.exit(1);
+        }
+    }
+}
+function selectRuntime() {
+    const raw = (process.env.HARNESS_CONTAINER_RUNTIME ?? "docker").toLowerCase();
+    switch (raw) {
+        case "docker":
+            return new DockerRuntime();
+        case "apple":
+            return new AppleContainerRuntime();
+        default:
+            console.error(`harness: unknown HARNESS_CONTAINER_RUNTIME="${raw}". Valid values: apple, docker (or unset for docker).`);
+            process.exit(1);
+    }
+}
 class PiAdapter {
     buildCommand({ prompt, model, envFilePath }) {
         // In local mode (no env file), pass --provider ollama so pi routes
@@ -87,26 +231,6 @@ function cachePath() {
     const base = process.env.XDG_CACHE_HOME || node_path_1.default.join(node_os_1.default.homedir(), ".cache");
     return node_path_1.default.join(base, "harness", "cosign-verified.json");
 }
-function inspectLocalImage(image) {
-    try {
-        const out = (0, node_child_process_1.execFileSync)("docker", [
-            "image",
-            "inspect",
-            "--format",
-            "{{if .RepoDigests}}{{index .RepoDigests 0}}{{end}}",
-            image,
-        ], { stdio: ["ignore", "pipe", "ignore"], timeout: 5000 })
-            .toString()
-            .trim();
-        return {
-            exists: true,
-            digest: /@sha256:[0-9a-f]{64}$/.test(out) ? out : null,
-        };
-    }
-    catch {
-        return { exists: false, digest: null };
-    }
-}
 function readCache() {
     try {
         const raw = node_fs_1.default.readFileSync(cachePath(), "utf8");
@@ -147,31 +271,31 @@ function cosign(args) {
         });
     });
 }
-async function verifyImage(image) {
-    let { exists, digest: digestRef } = inspectLocalImage(image);
+async function verifyImage(runtime, image) {
+    let { exists, digest: digestRef } = runtime.inspectImage(image);
     const cache = readCache();
     if (digestRef && cache.verified[digestRef]) {
         return;
     }
     if (exists && !digestRef) {
         console.error(`harness: refusing to verify ${image}: image exists locally but has no registry digest (locally-built?).`);
-        console.error("harness: verifying the tag would check registry bytes, not the local image docker would run.");
+        console.error("harness: verifying the tag would check registry bytes, not the local image the runtime would run.");
         console.error("harness: use --no-verify, or set HARNESS_IMAGE_TAG for an implicit skip.");
         process.exit(1);
     }
     if (!digestRef) {
         console.error(`harness: pulling ${image} for verification...`);
         try {
-            (0, node_child_process_1.execFileSync)("docker", ["pull", image], {
+            (0, node_child_process_1.execFileSync)(runtime.binary(), runtime.pullArgs(image), {
                 stdio: ["ignore", "inherit", "inherit"],
                 timeout: 600000,
             });
         }
         catch {
-            console.error(`harness: docker pull failed for ${image}`);
+            console.error(`harness: ${runtime.binary()} pull failed for ${image}`);
             process.exit(1);
         }
-        digestRef = inspectLocalImage(image).digest;
+        digestRef = runtime.inspectImage(image).digest;
         if (!digestRef) {
             console.error(`harness: failed to resolve digest for ${image} after pull`);
             process.exit(1);
@@ -244,9 +368,10 @@ Options:
   -h, --help             Show this help message
 
 Environment variables:
-  HARNESS_IMAGE_TAG      Override the Docker image tag (defaults to package version)
-  XDG_DATA_HOME         Override the base directory for persistence data (defaults to ~/.local/share)
-  XDG_CACHE_HOME        Override the base directory for cosign cache (defaults to ~/.cache)
+  HARNESS_IMAGE_TAG           Override the Docker image tag (defaults to package version)
+  HARNESS_CONTAINER_RUNTIME   Container runtime to use: docker (default) or apple (Apple container CLI)
+  XDG_DATA_HOME              Override the base directory for persistence data (defaults to ~/.local/share)
+  XDG_CACHE_HOME             Override the base directory for cosign cache (defaults to ~/.cache)
 
 Persistence data is stored at $XDG_DATA_HOME/harness/<project>/<agent>/.
 
@@ -375,13 +500,15 @@ for (const spec of volumeArgList) {
     }
 }
 async function run(prompt) {
+    const runtime = selectRuntime();
+    runtime.ensureReady();
     const image = getImage(agentName);
     if (!noVerify) {
         if (process.env.HARNESS_IMAGE_TAG) {
             console.error(`harness: HARNESS_IMAGE_TAG is set; skipping cosign verification for ${image}`);
         }
         else {
-            await verifyImage(image);
+            await verifyImage(runtime, image);
         }
     }
     const envFileArgs = envFilePath
@@ -395,7 +522,6 @@ async function run(prompt) {
     const containerCmd = adapter.buildCommand(adapterOptions);
     const adapterDockerArgs = adapter.extraDockerArgs?.(adapterOptions) ?? [];
     const interactive = process.stdin.isTTY;
-    const ttyFlags = interactive ? ["-it"] : ["-i"];
     let volumeArgs;
     if (fileArg) {
         const absFile = node_path_1.default.resolve(fileArg);
@@ -480,28 +606,18 @@ async function run(prompt) {
     for (const spec of volumeArgList) {
         userVolumeArgs.push("-v", `${node_path_1.default.resolve(spec.split(":")[0])}:${spec.split(":").slice(1).join(":")}`);
     }
-    const args = [
-        "run",
-        "--rm",
-        ...ttyFlags,
-        "--cap-drop=ALL",
-        "--cap-add=NET_RAW",
-        "--security-opt",
-        "no-new-privileges:true",
-        "--security-opt",
-        `seccomp=${SECCOMP_PROFILE}`,
-        ...envFileArgs,
-        ...cloudModeEnv,
-        ...adapterDockerArgs,
-        ...volumeArgs,
-        ...userVolumeArgs,
-        "-w",
-        "/workspace",
+    const args = runtime.runArgs({
+        interactive,
+        envFileArgs,
+        envArgs: [...cloudModeEnv, ...adapterDockerArgs],
+        volumeArgs,
+        userVolumeArgs,
+        workdir: "/workspace",
         image,
-        ...containerCmd,
-    ];
-    const docker = (0, node_child_process_1.spawn)("docker", args, { stdio: "inherit" });
-    docker.on("exit", (code) => process.exit(code ?? 1));
+        containerCmd,
+    });
+    const child = (0, node_child_process_1.spawn)(runtime.binary(), args, { stdio: "inherit" });
+    child.on("exit", (code) => process.exit(code ?? 1));
 }
 if (!process.stdin.isTTY && promptArg === null) {
     let input = "";

package/bin/seccomp-profiles/seccomp-profiles/block-af-alg.json

@@ -0,0 +1,10 @@
+{
+  "defaultAction": "SCMP_ACT_ALLOW",
+  "syscalls": [
+    {
+      "names": ["socket"],
+      "action": "SCMP_ACT_ERRNO",
+      "args": [{ "index": 0, "op": "SCMP_CMP_EQ", "value": 38 }]
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boldblackai/harness",
-  "version": "1.8.5",
+  "version": "1.9.0",
   "description": "Portable environment for running coding agents in a container",
   "bin": {
     "harness": "bin/harness.js"
@@ -21,7 +21,7 @@
     "lint": "pnpm lint:ts && pnpm lint:md && pnpm lint:sh && pnpm lint:docker && pnpm lint:actions",
     "lint:ts": "biome check .",
     "lint:md": "markdownlint-cli2 \"**/*.md\" \"#node_modules\"",
-    "lint:sh": "shellcheck entrypoint.sh entrypoint-opencode.sh entrypoint-hermes.sh",
+    "lint:sh": "shellcheck setup-env.sh entrypoint.sh entrypoint-opencode.sh entrypoint-hermes.sh",
     "lint:docker": "hadolint Dockerfile Dockerfile.opencode Dockerfile.hermes",
     "lint:actions": "actionlint",
     "format": "biome format --write .",