kern-sandbox 0.2.27 → 0.2.29

package/README.md

@@ -21,8 +21,9 @@ unenforceable cap FATAL: the box refuses to start rather than run uncapped. It a
 other refusal does, as `fault.type === "startup_failed"` on the result, NOT as an exception from the
 constructor, so a caller that only catches exceptions will walk past it.
 
-Dependency-free: it shells out to the `kern` binary and does not re-implement isolation in
-JavaScript.
+The runtime this drives, its tests and the other bindings are one repository:
+**[github.com/getkern/kern](https://github.com/getkern/kern)**. Dependency-free: it shells out to
+the `kern` binary and does not re-implement isolation in JavaScript.
 
 **Your loop reads a field, not a stack trace.** A timeout, an OOM-kill, a blocked syscall or a missing
 interpreter each arrive as a typed `fault` on the result, beside stdout and the exit code, so the
@@ -176,7 +177,9 @@ Every relaxing option says so in its name or docs:
   line, so a credential in `env` does not leak into `ps`.
 - **mounts refused**: the host's own sources (`/`, `/etc`, `/root`, `/boot`, `/proc`, `/sys`, `/dev`,
   `$HOME`, the docker socket), any path with a **credential directory** in it (`.ssh`, `.aws`, `.gnupg`,
-  `.kube`, `.docker`, `.azure`, `.password-store`, `.netrc`, `.git-credentials`, `.pypirc`, `.npmrc`),
+  `.kube`, `.docker`, `.azure`, `.oci`, `.terraform.d`, `.password-store`, `.netrc`, `.git-credentials`,
+  `.pypirc`, `.npmrc`, `.databrickscfg`, `.boto`, `.s3cfg`, `.rclone.conf`, and under `.config`:
+  `gcloud`, `gh`, `doctl`, `rclone`),
   **kern's own state** (`$XDG_RUNTIME_DIR/kern`, the image cache, the config dir, the data dir that
   holds every named volume: the sandbox's control plane), and escaping targets.
 - **workspace I/O contained**: `writeFile`/`readFile` reject `..` escapes, open the final component

package/index.js

@@ -36,7 +36,7 @@ const crypto = require("crypto");
 const zlib = require("zlib");
 const { spawn, spawnSync } = require("child_process");
 
-const VERSION = "0.2.27";
+const VERSION = "0.2.29";
 
 const DEFAULT_IMAGE = "python:3.12-slim";
 const WORKSPACE = "/workspace"; // where the persistent workspace is mounted inside every box
@@ -493,6 +493,22 @@ function kernStateDirs() {
  * wrong way round, and it is the scenario a prompt-injected agent is steered into ("read ~/.aws"). These
  * match by NAME because they live under a per-user home. No escape hatch, same as `/etc`: a job that
  * needs one credential should be given that one file in the workspace. */
+//
+// THE LIST WAS SHORT OF THE PROMISE ABOVE IT, and the asymmetry is what gave it away: AWS refused,
+// Azure refused, GCP accepted. MEASURED against the published SDK with each directory CREATED first,
+// because a refusal that is really "source does not exist" is a skip wearing a pass - that is how
+// `~/.config/gcloud` read as covered on a host that has no gcloud.
+//
+// `~/.config/<tool>` NEEDS THE PARENT, which is why there is a second set below: `gcloud` and `gh`
+// are not dotfiles, and refusing a bare `gh` component anywhere would refuse `~/projects/gh/src` - a
+// guard that fires on ordinary work gets switched off, and then it guards nothing.
+//
+// DELIBERATELY NOT ADDED: `.cargo`, `.m2`, `.gem`. Each holds ONE credential file next to a package
+// cache people legitimately mount, so refusing the directory would break a real use and push callers
+// off the guard. The residual gap is named rather than papered over.
+//
+// KEPT IDENTICAL TO THE PYTHON BINDING on purpose: two spellings of one rule drift, and a caller who
+// moved between the two SDKs would meet a different boundary in each.
 const REFUSED_MOUNT_COMPONENTS = new Set([
   ".ssh",
   ".aws",
@@ -505,6 +521,20 @@ const REFUSED_MOUNT_COMPONENTS = new Set([
   ".git-credentials",
   ".pypirc",
   ".npmrc",
+  ".oci",
+  ".terraform.d",
+  ".databrickscfg",
+  ".boto",
+  ".s3cfg",
+  ".rclone.conf",
+]);
+
+// `parent/child` pairs, refused when they appear CONSECUTIVELY in the source.
+const REFUSED_MOUNT_PAIRS = new Set([
+  ".config/gcloud",
+  ".config/gh",
+  ".config/doctl",
+  ".config/rclone",
 ]);
 
 /** A PROGRAMMER/config error, THROWN: bad argument, illegal mount, `kern` not installed, or the box
@@ -908,13 +938,23 @@ function validateMount(source, target) {
           "docker socket is refused",
       );
   }
-  for (const part of real.split(path.sep))
-    if (REFUSED_MOUNT_COMPONENTS.has(part))
-      throw new MountRefused(
-        `refusing to mount ${JSON.stringify(real)}: ${JSON.stringify(part)} holds credentials, and code ` +
-          "in the box would read them. If the job needs one secret, write THAT FILE into the workspace " +
-          "(sbx.writeFile) or mount a directory that holds only it",
-      );
+  const parts = real.split(path.sep);
+  let hit = parts.find((p) => REFUSED_MOUNT_COMPONENTS.has(p));
+  if (hit === undefined)
+    // The `parent/child` form, consecutive so `~/.config/gh` is refused and `~/gh` is not.
+    for (let i = 0; i + 1 < parts.length; i++) {
+      const pair = `${parts[i]}/${parts[i + 1]}`;
+      if (REFUSED_MOUNT_PAIRS.has(pair)) {
+        hit = pair;
+        break;
+      }
+    }
+  if (hit !== undefined)
+    throw new MountRefused(
+      `refusing to mount ${JSON.stringify(real)}: ${JSON.stringify(hit)} holds credentials, and code ` +
+        "in the box would read them. If the job needs one secret, write THAT FILE into the workspace " +
+        "(sbx.writeFile) or mount a directory that holds only it",
+    );
   return [real, target];
 }
 
@@ -1449,6 +1489,22 @@ class Sandbox {
     if (!Array.isArray(this.capDrop))
       throw new SandboxError("capDrop must be an array of capability names");
     this._capDropArgs = this.capDrop.flatMap((c) => ["--cap-drop", validateCap(c)]);
+    // SKIP THE UID RANGE EXACTLY WHEN THE CAPABILITY IT SERVES IS BEING DROPPED ANYWAY, which is the
+    // default and costs a quarter of a cold box. `kern box --image` maps a sub-uid RANGE by default
+    // (so an image that degrades privilege in its entrypoint works), and mapping it forks two SETUID
+    // HELPERS. MEASURED: `parent:idmap` 22 us single-uid against ~1048 us ranged, and the whole box
+    // 3234 against 4298 us on this class's argv - paired, core-pinned, -1083 us (25%).
+    //
+    // IT BUYS THIS SANDBOX NOTHING when `ALL` is dropped, measured rather than argued: `setuid(1000)`
+    // inside a cell is refused either way under `--cap-drop ALL` (EPERM with the range, EINVAL
+    // without). WITHOUT it the range does work, so this is conditional: `capDrop: []` is a documented
+    // choice and keeps both the capability and the range.
+    //
+    // KEPT IDENTICAL TO THE PYTHON BINDING, including the condition: two spellings of one rule drift,
+    // and a caller who moved between the SDKs would meet a different box shape in each.
+    this._singleUid = this.capDrop.some(
+      (c) => String(c).toUpperCase().replace(/^CAP_/, "") === "ALL",
+    );
     this._profileArgs = (this.profiles || []).map(validateProfile);
     this._egressAllow = (this.egressAllow || []).map(validateDomain);
     if (this.apparmor !== null) validateApparmor(this.apparmor);
@@ -1593,6 +1649,7 @@ class Sandbox {
     }
     // kern's own --timeout is a tight BACKSTOP just beyond our deadline; OUR wait is the authority.
     argv.push(...this._capDropArgs);
+    if (this._singleUid) argv.push("--no-uid-range");
     argv.push("--timeout", String(Math.floor(timeoutS) + 5));
     if (this.memoryMb !== null) argv.push("--memory", `${this.memoryMb}m`);
     if (this.cpus !== null) argv.push("--cpus", String(this.cpus));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kern-sandbox",
-  "version": "0.2.27",
+  "version": "0.2.29",
   "description": "kern is a fast, rootless sandbox and virtual resource runtime for any workload, including untrusted and LLM-generated code; kern-sandbox is its Node/TypeScript binding. Run untrusted or agent-generated code (Python/JS/Bash) in a real, kernel-enforced box, one per call, with no cloud, no account and no VM.",
   "keywords": [
     "sandbox",