feat(execd): trust mitm proxy by default#630
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 478c093b19
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| cert="$1" | ||
| if command -v update-ca-certificates >/dev/null 2>&1; then | ||
| mkdir -p /usr/local/share/ca-certificates | ||
| cp "$cert" /usr/local/share/ca-certificates/opensandbox-mitmproxy-ca.crt |
There was a problem hiding this comment.
When OPENSANDBOX_EGRESS_MITMPROXY_TRANSPARENT is enabled, this path writes into system trust directories before starting execd; on non-root containers or read-only root filesystems, cp fails and set -e terminates the whole bootstrap, so the sandbox never starts. This is a compatibility regression because bootstrap.sh previously treated similar setup steps as best-effort (warning-only) for constrained images.
Useful? React with 👍 / 👎.
3 participants
Summary
Testing
Breaking Changes
Checklist