gstack

0 Fork 0

mirror of https://github.com/garrytan/gstack.git synced 2026-10-31 22:14:25 +01:00

Files

T

garrytan 7ae7776e50 I1: revert the seccomp-only eval container option; it does not let Codex's sandbox start

Run 37158847998 on this branch and a stock Ubicloud VM both show that
seccomp=unconfined only moves bubblewrap's failure from 'No permissions to
create a new namespace' to 'Failed to make / slave: Permission denied'.
Codex's sandbox started only with the host sysctl
kernel.apparmor_restrict_unprivileged_userns=0 plus seccomp and AppArmor
unconfined on the container, which a container job cannot set from its
steps. The relaxation bought nothing, so it goes; the fix is filed as a
TODO for the integrator.

This reverts commit ec97187.

2026-10-03 23:00:22 +00:00

actions

v1.89.1.0 fix: remove continuous checkpoint commits (#2970 )

2026-09-24 17:27:14 -04:00

docker

v1.91.16.0 fix: safe installs and upgrades, skills start everywhere, truthful completion (parallel wave) (#3014 )

2026-10-03 07:54:09 -07:00

scripts

v1.91.12.0 v1.91.12.0: audit fix wave, ~11-minute paid eval lanes, eval reliability policy (#2999 )

2026-10-01 13:55:16 -07:00

workflows

I1: revert the seccomp-only eval container option; it does not let Codex's sandbox start