Support restricted shared agent runtimes - #2125
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4ea5724d82
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0334d5e42f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 01a16162f2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 335bbe4238
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 172d2c76af
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 774f7cc779
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 018d0c31fe
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 797eb7b. Configure here.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c16de90919
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if routes is None: | ||
| self._proxy.policy = NetworkPolicy( | ||
| ["*"], [], [HOST_ALIAS], allow_non_global=True | ||
| ) | ||
| return |
There was a problem hiding this comment.
When a restricted Docker box is reused after the first rollout, this branch only makes the HTTP proxy permissive; the container routes are still cut because _cut remains true and DockerRuntime.run() can only help commands that honor the injected proxy env. A later task or harness setup that uses raw TCP/SSH or a tool that ignores HTTP_PROXY will fail even though runtime.rollout() has supposedly reopened trusted setup; before this change those restricted Docker runtimes were rejected for reuse. Either restore the routes or keep Docker shared reuse limited to cases where setup is proxy-compatible.
Useful? React with 👍 / 👎.
c16de90 to
bd752cf
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bd752cf75b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| result = await self.run( | ||
| ["sh", "-c", _KILL_AFTER_SNAPSHOT], | ||
| {"VF_PROCESS_BASELINE": self._process_baseline}, |
There was a problem hiding this comment.
When the first agent runs as root, as it does in the default Docker Python image, it can replace sh or place a malicious one earlier on PATH; the next rollout then executes this attacker-controlled binary to perform the process cleanup. It can report success without killing anything, and the subsequent shell-based snapshot can preserve its background process as part of the new baseline before unrestricted setup networking is restored, allowing solver code to forge the judge result or use trusted egress. Fresh evidence in this revision is that the newly added isolation defense itself relies on executables from the filesystem it is meant to distrust; process cleanup and snapshotting need to occur through a host/provider mechanism or an immutable trusted executable.
Useful? React with 👍 / 👎.
1 participant
Overview
Enable sequential agents to share a network-restricted runtime while preserving the trusted-setup and restricted-execution boundary.
Details
The base runtime now owns the common policy lifecycle: it grants trusted setup once, records policy activation, and accumulates framework routes used by later rollouts. Docker and Prime reuse that lifecycle while keeping only their backend-specific enforcement code. Docker updates its proxy policy without repeating the one-way network cut, while Prime reapplies its provider policy when a new framework route is introduced.
An exported
shared_runtimecontext manager provisions one box and prepares peer harnesses before restrictions activate. Later sequential agents skip harness installation, retain their own task and trace lifecycle, and refresh the active policy with their current interception and tool routes.Agentic judge uses this abstraction for Docker and Prime solver runtimes and carries the solver task network policy into the generated judge task.
Note
Support restricted shared agent runtimes across rollouts
Runtime.rolloutasync context manager that enables restricted runtimes to be reused across rollouts by killing non-baseline processes, clearing setup caches, and toggling between unrestricted trusted-setup networking and filtered execution-time networking between runs.Runtime._apply_network_policy(routes)as an abstract method; passingNonerestores unrestricted networking, passing routes applies the configured allow/block policy. Implemented in bothDockerRuntimeandPrimeRuntime.AgenticJudgeEnv.runraisesRuntimeErrorif the shared runtime is network-restricted butexecution_preparedis not set, indicating the solver exited before the network policy was activated.network_allowandnetwork_blocksettings viaJudgeTask.from_trace.SandboxErrorif a second rollout is attempted while one is already in progress (exclusive claim required).Macroscope summarized bd752cf.
Note
High Risk
Changes sandbox isolation (process killing, network policy toggling) and concurrent-use rules for restricted runtimes; mis-implementation could leak egress or break multi-agent shared-box flows.
Overview
Network-restricted runtimes can be reused across sequential rollouts instead of being single-use.
prepare_setup()is replaced by aRuntime.rollout()async context manager that exclusively claims the box, and on reuse kills processes not in the prior snapshot, clears uv/setup caches, and temporarily restores unrestricted egress before the next agent’s trusted setup.Rollouts enter that scope via a dedicated
_runtime_stackinRolloutRun(including onabort/close).prepare_executionnow drives policy through_apply_network_policy(routes)and setsexecution_preparedwhen the cut is applied.Docker and Prime implement
_apply_network_policy:routes=Noneopens trusted setup; non-Noneapplies allow/block plus framework routes. Docker skips repeating the one-way iptables cut when_cutis already set.Agentic judge copies the solver’s
network_allow/network_blockonto the judge task and raises if the shared box is restricted but the solver never reachedexecution_prepared. The agentic-judge e2e uses a Dockerblocklist to exercise the restricted shared box path.Reviewed by Cursor Bugbot for commit bd752cf. Bugbot is set up for automated code reviews on this repo. Configure here.