@north-light/env-docker 0.3.420 → 0.3.422

package/README.md

@@ -37,7 +37,7 @@ console.log(await client.system.health());
 await env.stop();
 ```
 
-`start()` creates a container from `ghcr.io/northlight-systems/crtrd:latest` unless you pass `image`, generates a bearer token, binds the mapped port to `127.0.0.1`, and waits for `/healthz`. `connection()` returns `{ baseURL, headers }`, the shape `new Crouter(...)` takes. `stop()` removes the container.
+`start()` creates a container from `ghcr.io/northlight-systems/crtrd:latest` unless you pass `image`, generates a bearer token, grants the privileges the image's sandbox launcher needs (`SYS_ADMIN` and `NET_ADMIN`, unconfined seccomp and AppArmor), binds the mapped port to `127.0.0.1`, and waits for `/healthz`. `connection()` returns `{ baseURL, headers }`, the shape `new Crouter(...)` takes. `stop()` removes the container.
 
 Options: `env` sets container environment variables, `port` selects a host port, `volume` mounts a named Docker volume at the crouter home. A named volume keeps canvas state and memory when the container is recreated.
 

package/dist/index.d.ts

@@ -6,6 +6,8 @@ export type { Connection, DockerEnvironment, StartOptions };
  * locally built tag (e.g. `crtrd:local`).
  */
 export declare const DEFAULT_IMAGE = "ghcr.io/northlight-systems/crtrd:latest";
+/** `docker run` flags the image's sandbox launcher needs. */
+export declare const LAUNCHER_PRIVILEGES: readonly ["--cap-add", "SYS_ADMIN", "--cap-add", "NET_ADMIN", "--security-opt", "seccomp=unconfined", "--security-opt", "apparmor=unconfined"];
 /** Run the crtrd image, wait until `/healthz` answers 200 through the mapped
  *  port, and return its connection settings. `stop()` stops and
  *  removes the container. */

package/dist/index.js

@@ -8,6 +8,13 @@ import { CONTAINER_PORT, inspectContainer, isContainerRunning, readHostPortFromI
  * locally built tag (e.g. `crtrd:local`).
  */
 export const DEFAULT_IMAGE = 'ghcr.io/northlight-systems/crtrd:latest';
+/** `docker run` flags the image's sandbox launcher needs. */
+export const LAUNCHER_PRIVILEGES = [
+    '--cap-add', 'SYS_ADMIN',
+    '--cap-add', 'NET_ADMIN',
+    '--security-opt', 'seccomp=unconfined',
+    '--security-opt', 'apparmor=unconfined',
+];
 const HEALTH_TIMEOUT_MS = 60_000;
 const HEALTH_INTERVAL_MS = 300;
 function generateToken() {
@@ -23,7 +30,10 @@ export async function start(opts = {}) {
     const image = opts.image ?? DEFAULT_IMAGE;
     const name = opts.name ?? generateName();
     const token = generateToken();
-    const args = ['run', '-d', '--name', name, '-e', `CRTRD_TOKEN=${token}`];
+    // The image's root launcher installs iptables rules and builds bubblewrap
+    // sandboxes for each agent, so it needs the same privileges hosting grants
+    // its guests; without them it exits before /healthz ever answers.
+    const args = ['run', '-d', '--name', name, '-e', `CRTRD_TOKEN=${token}`, ...LAUNCHER_PRIVILEGES];
     for (const [key, value] of Object.entries(opts.env ?? {})) {
         args.push('-e', `${key}=${value}`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/env-docker",
-  "version": "0.3.420",
+  "version": "0.3.422",
   "description": "Docker connection manager for the crouter SDK — start, attach to, and stop a crtrd container over the docker CLI. Zero crouter imports.",
   "type": "module",
   "main": "./dist/index.js",