Skip to content

feat(execd): trust mitm proxy by default #630

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Pangjiping wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(execd): trust mitm proxy by default #630

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 48 additions & 0 deletions components/execd/bootstrap.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,54 @@

set -e

# Returns 0 if the value looks like a boolean "true" (1, true, yes, on).
is_truthy() {
case "$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]')" in
1 | true | yes | on) return 0 ;;
*) return 1 ;;
esac
}

# Install mitm egress CA into the system trust store (no extra env vars).
# - Debian/Ubuntu/Alpine: update-ca-certificates + /usr/local/share/ca-certificates/
# - RHEL/CentOS/Fedora/Alma/Rocky: update-ca-trust + /etc/pki/ca-trust/source/anchors/
trust_mitm_ca() {
cert="$1"
if command -v update-ca-certificates >/dev/null 2>&1; then
mkdir -p /usr/local/share/ca-certificates
cp "$cert" /usr/local/share/ca-certificates/opensandbox-mitmproxy-ca.crt
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector bot Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Avoid hard-failing bootstrap when installing MITM CA

When OPENSANDBOX_EGRESS_MITMPROXY_TRANSPARENT is enabled, this path writes into system trust directories before starting execd; on non-root containers or read-only root filesystems, cp fails and set -e terminates the whole bootstrap, so the sandbox never starts. This is a compatibility regression because bootstrap.sh previously treated similar setup steps as best-effort (warning-only) for constrained images.

Useful? React with 👍 / 👎.

update-ca-certificates
return 0
fi
if command -v update-ca-trust >/dev/null 2>&1; then
mkdir -p /etc/pki/ca-trust/source/anchors
cp "$cert" /etc/pki/ca-trust/source/anchors/opensandbox-mitmproxy-ca.pem
if ! update-ca-trust extract; then
update-ca-trust
fi
return 0
fi
echo "error: cannot install mitm CA (need update-ca-certificates or update-ca-trust)" >&2
exit 1
}

MITM_CA="/opt/opensandbox/mitmproxy-ca-cert.pem"
if is_truthy "${OPENSANDBOX_EGRESS_MITMPROXY_TRANSPARENT:-}"; then
i=0
while [ "$i" -lt 10 ]; do
if [ -f "$MITM_CA" ] && [ -s "$MITM_CA" ]; then
break
fi
sleep 1
i=$((i + 1))
done
if [ ! -f "$MITM_CA" ] || [ ! -s "$MITM_CA" ]; then
echo "error: timed out after 10s waiting for $MITM_CA (egress mitm CA export)" >&2
exit 1
fi
trust_mitm_ca "$MITM_CA"
fi

EXECD="${EXECD:=/opt/opensandbox/execd}"

if [ -z "${EXECD_ENVS:-}" ]; then
Expand Down
Loading