kyle/boxmaker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

M3b review fixes by the design model: curl --globoff, podman --pull=never

Browse Source 
Review findings 1 and 2, both plan defects. curl gains --globoff and a
leading --disable; both podman runs gain --pull=never. The given fetch.rs and
the six golden files change with them. Checked on straylight with a rebuilt
image: a glob URL is one request, a missing image fails at once.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kyle
2026-09-23 15:25:51 -07:00
co-authored by Claude Opus 5.5
parent 75c2f1adbf
commit c3aaecdae2
19 changed files with 37 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/specs/2026-09-22-m3b-runner.md
+6 -3
View File
@@ -150,7 +150,7 @@ The container is named `boxmaker-<session>-<call>-<n>`, where `n` counts calls w
(never a shell string):
```
run --rm -i --name=<name> --label=boxmaker=tool --network=none --read-only --cap-drop=all
run --rm -i --name=<name> --label=boxmaker=tool --network=none --pull=never --read-only --cap-drop=all
--security-opt=no-new-privileges --userns=keep-id --pids-limit=<pids> --memory=<memory>
--tmpfs=/tmp:rw,size=64m,mode=1777
[--volume=<path>:<path>:ro | :rw for each mount, in RunSpec order]
@@ -175,13 +175,16 @@ polling. Then:
Every text above is fixed: tool output never reaches the model through a `RunError`.
`--pull=never` (added after the M3b review): an image that is not loaded fails the call at once
(exit 125) instead of Podman trying to pull it, which would be unlisted egress.
### `http_fetch`
Before the tool container, `brokerd` makes `<home>/run/egress/<name>/` (mode 0700) and starts the
proxy:
```
run -d --rm --name=<name>-egress --label=boxmaker=egress --network=<egress_network> --read-only
run -d --rm --name=<name>-egress --label=boxmaker=egress --network=<egress_network> --pull=never --read-only
--cap-drop=all --security-opt=no-new-privileges --userns=keep-id --pids-limit=64
--memory=128m --volume=<egress dir>:/run/egress:rw
<image> /bin/toolkit egress-proxy --socket /run/egress/egress.sock --allow <hosts joined by ,>
@@ -196,7 +199,7 @@ out is the socket.
`curl`'s arguments inside the tool container are fixed:
```
/bin/curl --silent --show-error --proto =https --proto-redir =https --location --max-redirs 5
/bin/curl --disable --silent --show-error --globoff --proto =https --proto-redir =https --location --max-redirs 5
--max-time 50 --max-filesize 8388608 --cacert /etc/ssl/certs/ca-certificates.crt
--proxy socks5h://localhost/run/egress/egress.sock --write-out "\n[http %{response_code}]"
--url <url>