feat: integrate fail-closed gVisor Docker execution provider - #350
Merged
Conversation
…ovider - Add runtime parameter to DockerExecutionResource (default: runc) - Add runtime parameter to create_resource() factory - Inject --runtime flag in _container_base_args after security hardening - Add _inspect_runsc_availability() for fail-closed gVisor - inspect_availability() checks runsc when runtime != runc - async_probe/async_ensure/async_health_check reflect container_runtime - _normalize_code_sandbox accepts gvisor - register_*_sandbox_action maps sandbox=gvisor to docker_runtime=runsc
When gVisor/runsc is selected, the Sentry user-space kernel enforces strict syscall filtering regardless of default_args. The static _isolation_capabilities() method cannot detect this, so we now override the isolation report in async_probe() when runtime != 'runc'. Changes: - Override isolation['syscalls_restricted'] = True for gVisor - Override isolation['mechanism'] = 'gvisor_container' - Add isolation['container_runtime'] = 'gvisor/runsc' - Add 20 tests across 6 categories (Docker regression, fail-closed, isolation capabilities, pipeline integration, cleanup/lifecycle, health/probe/ensure consistency) - Update conftest.py to include agently_stage_stub for test env
This was referenced Aug 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
devon top of that preserved history, then corrects the integration without rewriting contributor commits.gvisorprovider/resource subtype; generic Docker remains mechanism-neutral.runscruntime or when the bounded runtime execution probe fails.sandbox="gvisor"behavior in English and Chinese.Root cause addressed
#345 treated host
runscbinary presence as proof that Docker could run the selected runtime, and placed mechanism-specific behavior in the generic Docker provider. That could report readiness for an unregistered or invalid Docker runtime.Attribution and follow-up
This branch preserves the original commits and authors from #345. It does not close #345. After this PR merges, close #345 as superseded with a link to this PR, per #342.
Related: #342, #335, #345.
Validation
python -m pytest -q— 2550 passed, 28 skipped (Agently-Stage 0.3.8).