kern-sandbox 0.2.8 → 0.2.9

package/README.md

@@ -129,7 +129,7 @@ A non-zero exit from *your code* is **not** a fault (`fault` stays `null`): it i
 | `oom` | the kernel's OOM killer took the box against its own memory cap. Read from a descriptor the code in the box cannot write, so it is an observation and not a guess from the exit code |
 | `killed` | SIGKILL with **no** OOM reported: an external kill (`kern stop`, a signal, the host out of memory), or a cap that did not bind here, which the message names |
 | `exec_failed` | the box started, the command did not exist inside it. `{language:"node"}` on an image with no `node` is the ordinary way there; the message names the binary AND the image |
-| `startup_failed` | your `timeoutS` fired while kern was still BUILDING the box, so the code never ran. A longer timeout does not help: a bind source on a dead NFS export does this |
+| `startup_failed` | the box never ran, and kern said why in `stderr`. Two shapes: your `timeoutS` fired while kern was still BUILDING the box (run it again: a fast second call was a cold image read), or kern refused to build it at all (an image that cannot be pulled, a mount it will not make) |
 
 ```js
 const r = await kern.runCode("while True: pass", { timeoutS: 5 });

package/index.js

@@ -36,7 +36,7 @@ const crypto = require("crypto");
 const zlib = require("zlib");
 const { spawn, spawnSync } = require("child_process");
 
-const VERSION = "0.2.8";
+const VERSION = "0.2.9";
 
 const DEFAULT_IMAGE = "python:3.12-slim";
 const WORKSPACE = "/workspace"; // where the persistent workspace is mounted inside every box
@@ -446,6 +446,26 @@ const REFUSED_MOUNT_SOURCES = new Set([
   "/run/docker.sock",
 ]);
 
+/** Credential directories, refused as a COMPONENT anywhere in the source. The set above is absolute
+ * paths, so it refused `$HOME` and accepted `$HOME/.ssh`: MEASURED, a box mounted with `~/.ssh` listed
+ * `id_ed25519` and `authorized_keys`. Refusing the parent and allowing its most sensitive child is the
+ * wrong way round, and it is the scenario a prompt-injected agent is steered into ("read ~/.aws"). These
+ * match by NAME because they live under a per-user home. No escape hatch, same as `/etc`: a job that
+ * needs one credential should be given that one file in the workspace. */
+const REFUSED_MOUNT_COMPONENTS = new Set([
+  ".ssh",
+  ".aws",
+  ".gnupg",
+  ".kube",
+  ".docker",
+  ".azure",
+  ".password-store",
+  ".netrc",
+  ".git-credentials",
+  ".pypirc",
+  ".npmrc",
+]);
+
 /** A PROGRAMMER/config error, THROWN: bad argument, illegal mount, `kern` not installed, or the box
  * FAILED TO START (kern exits 125 - a mount refused at runtime, an unmappable `--user`, a seccomp or
  * AppArmor setup error). A box that never started ran no user code, so it rejects rather than resolve a
@@ -837,6 +857,13 @@ function validateMount(source, target) {
       `refusing to mount the sensitive host path ${JSON.stringify(real)} into a sandbox ` +
         "(this would defeat the isolation)",
     );
+  for (const part of real.split(path.sep))
+    if (REFUSED_MOUNT_COMPONENTS.has(part))
+      throw new MountRefused(
+        `refusing to mount ${JSON.stringify(real)}: ${JSON.stringify(part)} holds credentials, and code ` +
+          "in the box would read them. If the job needs one secret, write THAT FILE into the workspace " +
+          "(sbx.writeFile) or mount a directory that holds only it",
+      );
   return [real, target];
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kern-sandbox",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "kern is a fast, rootless sandbox and virtual resource runtime for any workload, including untrusted and AI-generated code; kern-sandbox is its Node/TypeScript binding. Run untrusted or agent-generated code (Python/JS/Bash) in a real, kernel-enforced box in single-digit milliseconds, with no cloud, no account and no VM.",
   "keywords": [
     "sandbox",