Add bubblewrap filesystem isolation for recursive child processes#1
Draft
rawwerks wants to merge 6 commits intoopenprose:mainfrom
Draft
Add bubblewrap filesystem isolation for recursive child processes#1rawwerks wants to merge 6 commits intoopenprose:mainfrom
rawwerks wants to merge 6 commits intoopenprose:mainfrom
Conversation
Child rlm invocations (depth > 0) re-exec inside bwrap with an overlayfs
on RLM_PROJECT_DIR. Writes are captured in a private upper dir — parallel
children cannot conflict with each other or corrupt the parent's data.
The /rlm/tree directory is bind-mounted writable through the sandbox so
trace files and RETURN answer files remain visible to the parent.
Guards: skipped in mock mode (_RLM_MOCK_DIR), when bwrap is not installed,
when already inside bwrap (_RLM_IN_BWRAP), or when RLM_ISOLATION=none.
New environment variables:
RLM_ISOLATION — bwrap (default) or none
RLM_PROJECT_DIR — directory to overlay (default: cwd at root depth)
Tests:
test/bwrap.bats — 10 unit tests (5 mock-mode guards, 5 mechanical
bwrap invariants that run bwrap directly, no LLM)
e2e/bwrap.bats — 6 end-to-end tests with real LLM calls (delete
protection, overwrite protection, read-through,
parallel isolation, RETURN through sandbox, control
test with isolation disabled)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Ubuntu 24.04 ships bwrap 0.9.0 which lacks --overlay-src support (added in 0.10.0). Multi-stage build compiles bwrap 0.11.0 and copies the binary into the final image. Build tools are discarded in the builder stage to keep the image small. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replaces explicit --overlay (with host-managed upper/work dirs) with --tmp-overlay (bwrap-managed invisible tmpfs). This avoids the nested overlayfs problem inside Docker containers where the rootfs is already overlay2. Simpler code, works on host, Docker, and VMs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove misleading /context/ reference from system prompt — /context/ is not bind-mounted writable through bwrap, so children cannot write to it. Add comment in mechanical tests explaining why they use --overlay instead of --tmp-overlay (to inspect the upper dir; E2E tests cover the real path). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…omments - Remove plugins COPY/ENV from Dockerfile (unrelated to bwrap isolation) - Add comment explaining RLM_PROJECT_DIR=/ fallback behavior - Add comment noting /tmp bind-mount precedence over overlay Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The inline comment after backslash-continuation would cause a runtime syntax error. Move the /tmp caveat into the comment block above. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
rlmprocesses (depth > 0) now re-exec inside bubblewrap with--tmp-overlayonRLM_PROJECT_DIR, giving each child a private copy-on-write view of the project directory/rlm/treedirectory is bind-mounted writable through the sandbox so trace files and RETURN answer files remain visible to the parentRLM_ISOLATION=noneto disable; defaults tobwrapwhen bubblewrap is availableTest plan
docker build -t rlm .— bwrap 0.11.0 confirmed🤖 Generated with Claude Code