Repository navigation
feat(sandbox): spike Landlock non-docker sandbox PoC (MCP-34.1) - #754
Conversation
Spike gating MCP-34 (non-docker isolation mode). Proves an unprivileged, non-Docker confinement primitive for stdio MCP servers on snap-docker Ubuntu 24.04, where Docker fails under AppArmor (MCPX_DOCKER_SNAP_APPARMOR, GH #71). - internal/sandbox: Landlock LSM fs allowlist via raw x/sys/unix syscalls (no new dependency) + setrlimit, ABI best-effort down-masking, fail-closed cross-platform stub. - Enforcement test re-execs a confined child: denies a path outside the allowlist, permits the RW allowlist, preserves stdin/stdout JSON-RPC framing. Runs in CI on ubuntu-latest (= Ubuntu 24.04). - Recommendation doc resolves plan decisions D2 (Landlock + rlimits + best-effort uid/gid; userns/bwrap deprioritized) and D3 (scanner degradation). Related MCP-3232, MCP-34
Deploying mcpproxy-docs with
|
| Latest commit: |
21bda5e
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://3bc1b404.mcpproxy-docs.pages.dev |
| Branch Preview URL: | https://spike-mcp-3232-nondocker-san.mcpproxy-docs.pages.dev |
|
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
📦 Build ArtifactsWorkflow Run: View Run Available Artifacts
How to DownloadOption 1: GitHub Web UI (easiest)
Option 2: GitHub CLI gh run download 28076531589 --repo smart-mcp-proxy/mcpproxy-go
|
![mcpproxy-gatekeeper[bot]](https://avatars.githubusercontent.com/u/216428285?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Gatekeeper approval — review verdict: ACCEPT (by KimiReviewer, model-diverse fallback).
This approval is posted automatically by the MCPProxy Gatekeeper App on behalf of KimiReviewer — the model-diverse reviewer-fallback reviewer of record (verdict lives in the Paperclip review thread). Author≠approver satisfied; QA + CI gates enforced separately.
Auto-approved per Model B (MCP-1249) + reviewer-fallback (MCP-3066).
|
Closing — Algis full-stop on CTO auto-spun roadmap work (on-hold/server items against personal-first). Not merging; parent epic parked to todo. |
Spike: non-Docker sandbox mechanism for snap-docker Ubuntu 24.04 (MCP-34.1)
Gates [MCP-34] (Non-Docker isolation mode). Determines — before the 1.5–2w
full build commits — which unprivileged primitive actually works for stdio MCP
servers on Ubuntu 24.04 with snap-installed Docker under AppArmor.
Recommendation (resolves plan decisions D2 + D3)
setrlimitfor resource caps + best-effortSysProcAttr.Credentialfor uid/gid. Landlock needs no user namespace, so it is not blocked by
kernel.apparmor_restrict_unprivileged_userns=1— the default on Ubuntu23.10+/24.04 that breaks bubblewrap. userns/bwrap deprioritized (would
trade one AppArmor block for another). Honest limit: no uid/gid separation
without root/CAP_SETUID.
launcher; skip the Docker scanner with a health-surfaced warning) over a native
scanner rewrite; final call in the scanner child issue.
Full write-up:
docs/development/sandbox-spike-mcp-34.md.Minimal PoC —
internal/sandbox/golang.org/x/sys/unixsyscalls (no newdependency),
setrlimit, ABI best-effort down-masking, fail-closedcross-platform stub.
TestLandlockEnforcesFilesystemAllowlistre-execs a confined child thatproves: (1) stdin→stdout JSON-RPC framing survives, (2) RW allowlist is
read+writable, (3) a path outside the allowlist is denied.
Verification
go build ./...(darwin + linux amd64/arm64) ✅ ·golangci-lintv2 (bothGOOS) 0 issues ✅ · cross-platform tests pass on macOS ✅.
ubuntu-latest(= Ubuntu 24.04) viago test -race ./...(not in the skiplist). I authored this on macOS and cannot exercise Landlock locally — the
PR's own CI run on ubuntu-latest is the proof; it
t.Skips gracefully if therunner lacks Landlock.
npx/uvxlaunch under the wrapper and the side-by-sideMCPX_DOCKER_SNAP_APPARMORreproduction — these belong with the launcher/spawn-branch work.
No production spawn path is modified; this is a spike (package + test + doc).
Related MCP-3232, MCP-34.