From 7b14f79e2c03af035ad294f71330e9bafd31b684 Mon Sep 17 00:00:00 2001 From: Algis Dumbris Date: Mon, 29 Jun 2026 06:58:21 +0300 Subject: [PATCH 1/5] qa(sandbox): MCP-3236 integration tests + CI workflow + snap-docker harness MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - .github/workflows/sandbox-integration.yml: dedicated CI job on ubuntu-latest (kernel 6.8, Landlock ABI 3) — runs sandbox package tests, upstream/core wrapper integration tests, scanner isolation-mode degradation tests, binary build, and server startup probe with isolation.mode=sandbox - docs/development/sandbox-snap-docker-harness.md: manual harness for Ubuntu snap-docker hosts — negative baseline (mode=docker → AppArmor failure reproducing GH #71) and positive case (mode=sandbox → Landlock confinement, scanner graceful degradation) - docs/qa/mcpproxy-qa-mcp3236-2026-06-29.html: HTML QA report (10/11 pass, 1 skip — linux-only Landlock tests skip on darwin as designed) Satisfies exit criterion #4 of MCP-34 (MCP-3236). --- .github/workflows/sandbox-integration.yml | 151 ++++++ .../sandbox-snap-docker-harness.md | 235 ++++++++++ docs/qa/mcpproxy-qa-mcp3236-2026-06-29.html | 436 ++++++++++++++++++ 3 files changed, 822 insertions(+) create mode 100644 .github/workflows/sandbox-integration.yml create mode 100644 docs/development/sandbox-snap-docker-harness.md create mode 100644 docs/qa/mcpproxy-qa-mcp3236-2026-06-29.html diff --git a/.github/workflows/sandbox-integration.yml b/.github/workflows/sandbox-integration.yml new file mode 100644 index 00000000..b19525b1 --- /dev/null +++ b/.github/workflows/sandbox-integration.yml @@ -0,0 +1,151 @@ +name: Sandbox Integration Tests + +# MCP-34.5 / MCP-3236: Prove sandbox isolation works on Linux (Landlock LSM). +# ubuntu-latest == Ubuntu 24.04, kernel 6.8 — Landlock ABI ≥ 3 available. +# These tests are also covered by unit-tests.yml; this job surfaces them +# explicitly and adds the server-startup probe so CI shows dedicated evidence. + +on: + push: + branches: ["*"] + paths: + - "internal/sandbox/**" + - "internal/upstream/core/sandbox*.go" + - "internal/security/scanner/**" + - "internal/upstream/core/**" + - ".github/workflows/sandbox-integration.yml" + pull_request: + branches: ["*"] + paths: + - "internal/sandbox/**" + - "internal/upstream/core/sandbox*.go" + - "internal/security/scanner/**" + - "internal/upstream/core/**" + - ".github/workflows/sandbox-integration.yml" + workflow_dispatch: + +jobs: + sandbox-integration: + name: Sandbox Integration (Linux / Landlock) + runs-on: ubuntu-latest + + env: + GO111MODULE: "on" + + steps: + - name: Checkout code + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + + - name: Set up Go + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 + with: + go-version: "1.25" + cache: true + + - name: Download dependencies + run: go mod download + + # Confirm the kernel supports Landlock before running enforcement tests. + - name: Check Landlock availability + run: | + uname -r + if grep -qi landlock /proc/kallsyms 2>/dev/null || \ + cat /proc/sys/kernel/landlock/abi 2>/dev/null | grep -q "[1-9]"; then + echo "Landlock available" + else + # ubuntu 24.04 exposes ABI via a prctl probe — let the Go test skip logic handle it + echo "Landlock probe inconclusive — Go tests will auto-skip if unavailable" + fi + + # 1. sandbox package: Landlock enforcement (TestLandlockEnforcesFilesystemAllowlist), + # wrap/encode round-trip, rlimit constants. + - name: Run sandbox package tests + run: go test -v -race ./internal/sandbox/... + + # 2. upstream/core: wrapWithSandbox full re-exec integration + # (TestSandboxWrapper_EndToEnd, TestSandboxWrapper_FailClosed, spec builders). + - name: Run upstream/core sandbox tests + run: go test -v -race -run "Sandbox|sandbox|buildSandbox" ./internal/upstream/core/... + + # 3. scanner/engine: degradation under sandbox/none isolation mode + # (TestEngineResolveScannersSkipsDockerUnderSandbox, TestEngineEffectiveIsolationMode). + - name: Run scanner isolation-mode tests + run: go test -v -race -run "Sandbox|sandbox|IsolationMode|isolation" ./internal/security/scanner/... + + # 4. Full sandbox + scanner test set with race detector. + - name: Run all sandbox-related tests (race) + run: | + go test -race \ + ./internal/sandbox/... \ + ./internal/upstream/core/... \ + ./internal/security/scanner/... + + # 5. Build the binary (proves sandbox code compiles on linux/amd64). + - name: Build mcpproxy binary + run: go build -v -o mcpproxy ./cmd/mcpproxy + + # 6. Server startup probe: start mcpproxy with isolation.mode=sandbox, + # verify it starts healthy, check the upstream list (no stdio servers + # configured so no wrapWithSandbox is called — this proves the binary + # starts cleanly under this config, not sandbox enforcement itself). + - name: Start mcpproxy with isolation.mode=sandbox (startup probe) + run: | + mkdir -p /tmp/mcp3236-ci + cat > /tmp/mcp3236-ci/mcp_config.json <<'EOF' + { + "listen": "127.0.0.1:19237", + "api_key": "qa-sandbox-ci-test", + "enable_web_ui": false, + "isolation": { "mode": "sandbox" }, + "mcpServers": [] + } + EOF + MCPPROXY_DATA_DIR=/tmp/mcp3236-ci ./mcpproxy serve \ + --config /tmp/mcp3236-ci/mcp_config.json \ + --log-level=debug \ + > /tmp/mcp3236-ci/server.log 2>&1 & + SERVER_PID=$! + echo "SERVER_PID=$SERVER_PID" >> "$GITHUB_ENV" + # Wait for server to be ready + for i in $(seq 1 20); do + if curl -sf -H "X-API-Key: qa-sandbox-ci-test" \ + http://127.0.0.1:19237/api/v1/status > /dev/null 2>&1; then + echo "Server ready after ${i}s" + break + fi + sleep 1 + done + + - name: Verify server health under sandbox config + run: | + STATUS=$(curl -sf -H "X-API-Key: qa-sandbox-ci-test" \ + http://127.0.0.1:19237/api/v1/status) + echo "$STATUS" | python3 -m json.tool + RUNNING=$(echo "$STATUS" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('running',False))") + if [ "$RUNNING" != "True" ]; then + echo "ERROR: server not running" + cat /tmp/mcp3236-ci/server.log + exit 1 + fi + echo "Server healthy with isolation.mode=sandbox" + + - name: macOS/non-Linux graceful-degrade probe (build check) + run: | + # Cross-compile for darwin to prove the no-op path compiles cleanly. + GOOS=darwin GOARCH=arm64 go build -o /dev/null ./internal/sandbox/... 2>&1 || true + GOOS=darwin GOARCH=arm64 go build -o /dev/null ./internal/upstream/core/ 2>&1 || true + echo "Cross-compile probe done (darwin build tags: sandbox_other.go path)" + + - name: Stop server + if: always() + run: | + if [ -n "$SERVER_PID" ]; then kill "$SERVER_PID" 2>/dev/null || true; fi + cat /tmp/mcp3236-ci/server.log 2>/dev/null || true + + - name: Upload server log + if: always() + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: sandbox-server-log + path: /tmp/mcp3236-ci/server.log + retention-days: 7 diff --git a/docs/development/sandbox-snap-docker-harness.md b/docs/development/sandbox-snap-docker-harness.md new file mode 100644 index 00000000..24e93a8a --- /dev/null +++ b/docs/development/sandbox-snap-docker-harness.md @@ -0,0 +1,235 @@ +# Sandbox Mode: Manual Snap-Docker Harness (MCP-34.5) + +This document proves **exit criterion #4 of MCP-34**: reproducing the GH #71 +snap-Docker AppArmor failure with `mode: docker`, then showing `mode: sandbox` +succeeds as a drop-in replacement on an Ubuntu host where Docker is installed +via snap. + +## Background + +Snap-installed Docker ships with an AppArmor profile that enforces +`no-new-privileges`. This profile is inherited by any container the snap Docker +daemon launches, including the scanner containers mcpproxy uses for security +analysis. When mcpproxy tries to run a scanner container, Docker rejects the +`setuid`/`setgid` syscalls the container needs, producing an AppArmor denial. +See [docs/errors/MCPX_DOCKER_SNAP_APPARMOR.md](../errors/MCPX_DOCKER_SNAP_APPARMOR.md). + +`isolation.mode: sandbox` avoids Docker entirely: stdio servers run under the +native Landlock+rlimit wrapper (`mcpproxy __sandbox_exec -- `) and scanner +containers are cleanly skipped with an honest "degraded" status rather than +failing noisily. + +## Prerequisites + +- Ubuntu 22.04 or 24.04 (kernel 5.15+ or 6.8+, Landlock ≥ ABI 1) +- mcpproxy binary built (`make build` or `go build ./cmd/mcpproxy`) +- An `npx` stdio server available (e.g. `@modelcontextprotocol/server-everything`) + +```bash +# Install snap Docker +sudo snap install docker +sudo adduser $USER docker +newgrp docker +docker --version # e.g. Docker version 27.x.x +``` + +## Step 1 — Negative Baseline: `mode: docker` fails + +Configure mcpproxy with `mode: docker` and a simple stdio server: + +```bash +mkdir -p /tmp/harness-docker +cat > /tmp/harness-docker/mcp_config.json <<'EOF' +{ + "listen": "127.0.0.1:18080", + "api_key": "harness-key", + "enable_web_ui": false, + "isolation": { "mode": "docker" }, + "mcpServers": [ + { + "name": "everything", + "command": "npx", + "args": ["-y", "@modelcontextprotocol/server-everything"], + "protocol": "stdio", + "enabled": true + } + ] +} +EOF + +MCPPROXY_DATA_DIR=/tmp/harness-docker ./mcpproxy serve \ + --config /tmp/harness-docker/mcp_config.json \ + --log-level=debug 2>&1 & +DOCKER_PID=$! +sleep 5 +``` + +Trigger a security scan: + +```bash +curl -sf -H "X-API-Key: harness-key" \ + http://127.0.0.1:18080/api/v1/servers/everything/scan | python3 -m json.tool +``` + +Expected result: `security_scan` field shows `"failed"` or `"error"` with a +message referencing AppArmor / `no-new-privileges`. The `everything` server +itself may work, but scanner containers fail to run. + +In the mcpproxy log you will see lines similar to: + +``` +ERROR scanner failed {"error": "OCI runtime exec failed: ... apparmor='DENIED' ..."} +``` + +This reproduces GH #71. + +```bash +kill $DOCKER_PID 2>/dev/null +``` + +## Step 2 — Positive Case: `mode: sandbox` succeeds + +Switch to `mode: sandbox`. The same stdio server now runs under Landlock +confinement instead of Docker: + +```bash +mkdir -p /tmp/harness-sandbox +cat > /tmp/harness-sandbox/mcp_config.json <<'EOF' +{ + "listen": "127.0.0.1:18081", + "api_key": "harness-key", + "enable_web_ui": false, + "isolation": { "mode": "sandbox" }, + "mcpServers": [ + { + "name": "everything", + "command": "npx", + "args": ["-y", "@modelcontextprotocol/server-everything"], + "protocol": "stdio", + "enabled": true + } + ] +} +EOF + +MCPPROXY_DATA_DIR=/tmp/harness-sandbox ./mcpproxy serve \ + --config /tmp/harness-sandbox/mcp_config.json \ + --log-level=debug 2>&1 & +SANDBOX_PID=$! +sleep 5 +``` + +Verify server health: + +```bash +curl -sf -H "X-API-Key: harness-key" \ + http://127.0.0.1:18081/api/v1/status | python3 -m json.tool +``` + +Expected: `"running": true`, `"health": {"level": "healthy"}`. + +Verify the everything server is up: + +```bash +curl -sf -H "X-API-Key: harness-key" \ + http://127.0.0.1:18081/api/v1/servers | python3 -m json.tool +``` + +Expected: `"status": "connected"` for the `everything` server. + +Check the mcpproxy log for the sandbox wrapper message: + +```bash +grep -i "sandbox isolation enabled\|Landlock\|sandbox" \ + /tmp/harness-sandbox/*.log 2>/dev/null || \ + journalctl --no-pager -n 50 _PID=$SANDBOX_PID 2>/dev/null +``` + +Expected: `sandbox isolation enabled for server (Landlock + rlimits)` for the +`everything` server. + +Trigger a tool call through the proxy to confirm end-to-end stdio works: + +```bash +# Initialize MCP session +HEADERS_FILE=$(mktemp) +curl -sf -D "$HEADERS_FILE" -o /tmp/init.json \ + -X POST http://127.0.0.1:18081/mcp \ + -H 'Content-Type: application/json' \ + -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"harness","version":"1.0"}}}' +SESSION=$(grep -i 'mcp-session-id' "$HEADERS_FILE" | awk '{print $2}' | tr -d '\r') + +# Search for tools +curl -sf -X POST http://127.0.0.1:18081/mcp \ + -H "Content-Type: application/json" \ + -H "Mcp-Session-Id: $SESSION" \ + -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"retrieve_tools","arguments":{"query":"echo","limit":3}}}' \ + | python3 -m json.tool +``` + +Expected: tool results returned from the `everything` server running under +Landlock confinement. + +Check the scan status — scanner containers are intentionally skipped but the +result is `"degraded"` (not failed) because the in-process TPA scanner still +runs: + +```bash +curl -sf -H "X-API-Key: harness-key" \ + http://127.0.0.1:18081/api/v1/servers/everything/scan | python3 -m json.tool +``` + +Expected: `"security_scan": "degraded"`, `"findings": []`, no AppArmor errors. + +```bash +kill $SANDBOX_PID 2>/dev/null +``` + +## Step 3 — Write-Allowlist + Rlimit Assertions + +These are proven by the automated unit tests: + +```bash +# Run the full Landlock enforcement test suite (Linux only) +go test -v -race \ + ./internal/sandbox/... \ + ./internal/upstream/core/... \ + ./internal/security/scanner/... +``` + +Key tests: + +| Test | What it proves | +|------|---------------| +| `TestLandlockEnforcesFilesystemAllowlist` | Writes inside RW allowlist succeed; reads outside denied | +| `TestSandboxWrapper_EndToEnd` | Full re-exec path: write outside denied, rlimit applied, stdin→stdout passthrough | +| `TestSandboxWrapper_FailClosed` | Without spec, child refuses to exec (fail-closed) | +| `TestEngineResolveScannersSkipsDockerUnderSandbox` | Docker scanners prefailed under `mode=sandbox`; in-process still runs | +| `TestEngineEffectiveIsolationMode` | SetIsolationMode / resolver wiring | + +## CI Coverage + +The dedicated `sandbox-integration.yml` workflow runs on `ubuntu-latest` +(Ubuntu 24.04, kernel 6.8, Landlock ABI 3) on every push that touches sandbox +code. It covers: + +1. `internal/sandbox/...` — Landlock enforcement tests +2. `internal/upstream/core/...` — wrapper integration tests +3. `internal/security/scanner/...` — isolation-mode degradation tests +4. Server startup probe with `isolation.mode: sandbox` +5. Cross-compile probe for darwin (no-op path) + +The existing `unit-tests.yml` additionally runs all of these tests as part of +the full `go test -v -race ./...` sweep on ubuntu-latest. + +## Snap-Docker CI Note + +Snap Docker in GitHub Actions containers is unreliable — the snap daemon +(`snapd`) does not start cleanly inside most CI container images, and the +`no-new-privileges` AppArmor failure is a snap-host-specific behavior that +requires a full Ubuntu installation with snapd running as a systemd service. The +manual harness above (Steps 1–2) is the documented reproduction path for the +negative baseline. + +The positive case (sandbox mode works) is fully covered by CI on ubuntu-latest +without snap Docker, because the sandbox path does not involve Docker at all. diff --git a/docs/qa/mcpproxy-qa-mcp3236-2026-06-29.html b/docs/qa/mcpproxy-qa-mcp3236-2026-06-29.html new file mode 100644 index 00000000..ba6430cc --- /dev/null +++ b/docs/qa/mcpproxy-qa-mcp3236-2026-06-29.html @@ -0,0 +1,436 @@ + + + + + + MCPProxy QA Report — MCP-3236 (Sandbox Integration) + + + +
+
+

MCPProxy QA Report — MCP-3236 Sandbox Integration

+
+
+
+
+
+ +
+ + + + +
+
+
+
+ + + + From 822931f32d3402535e83fad53bdfe32b36df5145 Mon Sep 17 00:00:00 2001 From: Algis Dumbris Date: Mon, 29 Jun 2026 10:13:23 +0300 Subject: [PATCH 2/5] ci(sandbox): poll for running:True in health probe (fix MCP-3236 startup race) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 'Verify server health' step checked /api/v1/status once, immediately after the start step's readiness loop broke on the first HTTP-200 — but the server responds to /status before it finishes warming up (Bleve index, capability registration), so 'running' was still False and the step failed on CI. Retry for running:True up to 30s before failing. Related #71 --- .github/workflows/sandbox-integration.yml | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/.github/workflows/sandbox-integration.yml b/.github/workflows/sandbox-integration.yml index b19525b1..122b4fb0 100644 --- a/.github/workflows/sandbox-integration.yml +++ b/.github/workflows/sandbox-integration.yml @@ -118,12 +118,21 @@ jobs: - name: Verify server health under sandbox config run: | - STATUS=$(curl -sf -H "X-API-Key: qa-sandbox-ci-test" \ - http://127.0.0.1:19237/api/v1/status) - echo "$STATUS" | python3 -m json.tool - RUNNING=$(echo "$STATUS" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('running',False))") + # Poll for running:True — the server responds to /status before it + # finishes warming up (Bleve index, capability registration), so a + # single check races against startup. Retry up to 30s. + RUNNING=False + STATUS="" + for i in $(seq 1 30); do + STATUS=$(curl -sf -H "X-API-Key: qa-sandbox-ci-test" \ + http://127.0.0.1:19237/api/v1/status 2>/dev/null) || { sleep 1; continue; } + RUNNING=$(echo "$STATUS" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('running',False))" 2>/dev/null || echo False) + [ "$RUNNING" = "True" ] && { echo "Server ready after ${i}s"; break; } + sleep 1 + done + echo "$STATUS" | python3 -m json.tool || true if [ "$RUNNING" != "True" ]; then - echo "ERROR: server not running" + echo "ERROR: server not running (running != True after 30s)" cat /tmp/mcp3236-ci/server.log exit 1 fi From 2dadf8f858172b898f9222c5966961e389d2f090 Mon Sep 17 00:00:00 2001 From: Algis Dumbris Date: Mon, 29 Jun 2026 10:34:55 +0300 Subject: [PATCH 3/5] ci(sandbox): check status.phase==Ready, not nonexistent running field MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The health probe checked d.get('running') in /api/v1/status, but the response shape is {"status": {"phase": "Ready"}} — there is no top-level 'running' field, so the check was always False even though the server was up and serving. Poll for status.phase == Ready instead. Related #71 --- .github/workflows/sandbox-integration.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/sandbox-integration.yml b/.github/workflows/sandbox-integration.yml index 122b4fb0..bc0abfdb 100644 --- a/.github/workflows/sandbox-integration.yml +++ b/.github/workflows/sandbox-integration.yml @@ -118,25 +118,25 @@ jobs: - name: Verify server health under sandbox config run: | - # Poll for running:True — the server responds to /status before it - # finishes warming up (Bleve index, capability registration), so a - # single check races against startup. Retry up to 30s. - RUNNING=False + # /api/v1/status returns {"status": {"phase": "Ready", ...}, ...}. + # Readiness = status.phase == "Ready" (there is no top-level "running" + # field). The server serves HTTP before reaching Ready, so poll up to 30s. + PHASE="" STATUS="" for i in $(seq 1 30); do STATUS=$(curl -sf -H "X-API-Key: qa-sandbox-ci-test" \ http://127.0.0.1:19237/api/v1/status 2>/dev/null) || { sleep 1; continue; } - RUNNING=$(echo "$STATUS" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('running',False))" 2>/dev/null || echo False) - [ "$RUNNING" = "True" ] && { echo "Server ready after ${i}s"; break; } + PHASE=$(echo "$STATUS" | python3 -c "import sys,json; d=json.load(sys.stdin); print((d.get('status') or {}).get('phase',''))" 2>/dev/null || echo "") + [ "$PHASE" = "Ready" ] && { echo "Server reached phase=Ready after ${i}s"; break; } sleep 1 done echo "$STATUS" | python3 -m json.tool || true - if [ "$RUNNING" != "True" ]; then - echo "ERROR: server not running (running != True after 30s)" + if [ "$PHASE" != "Ready" ]; then + echo "ERROR: server did not reach phase=Ready (last phase='$PHASE') after 30s" cat /tmp/mcp3236-ci/server.log exit 1 fi - echo "Server healthy with isolation.mode=sandbox" + echo "Server healthy (phase=Ready) with isolation.mode=sandbox" - name: macOS/non-Linux graceful-degrade probe (build check) run: | From 9c844005e7f1fe7ae31d67fdd8eb649769ebf7e5 Mon Sep 17 00:00:00 2001 From: Algis Dumbris Date: Mon, 29 Jun 2026 10:55:56 +0300 Subject: [PATCH 4/5] ci(sandbox): poll /readyz (controller-backed) for readiness MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Parsing /api/v1/status JSON was fragile (the status object is nested and the healthy phase is 'Running', not 'Ready'). /readyz is the canonical readiness endpoint — controller-backed, returns 200 when IsReady() is true — so poll it for 200 instead. Structure-independent and idiomatic. Related #71 --- .github/workflows/sandbox-integration.yml | 27 ++++++++++++----------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/.github/workflows/sandbox-integration.yml b/.github/workflows/sandbox-integration.yml index bc0abfdb..a497d5c4 100644 --- a/.github/workflows/sandbox-integration.yml +++ b/.github/workflows/sandbox-integration.yml @@ -118,25 +118,26 @@ jobs: - name: Verify server health under sandbox config run: | - # /api/v1/status returns {"status": {"phase": "Ready", ...}, ...}. - # Readiness = status.phase == "Ready" (there is no top-level "running" - # field). The server serves HTTP before reaching Ready, so poll up to 30s. - PHASE="" - STATUS="" + # Use the dedicated readiness endpoint (/readyz returns 200 once the + # server has completed startup) — structure-independent, unlike parsing + # the /api/v1/status JSON. The server serves HTTP before it's ready, so + # poll up to 30s. + READY=0 for i in $(seq 1 30); do - STATUS=$(curl -sf -H "X-API-Key: qa-sandbox-ci-test" \ - http://127.0.0.1:19237/api/v1/status 2>/dev/null) || { sleep 1; continue; } - PHASE=$(echo "$STATUS" | python3 -c "import sys,json; d=json.load(sys.stdin); print((d.get('status') or {}).get('phase',''))" 2>/dev/null || echo "") - [ "$PHASE" = "Ready" ] && { echo "Server reached phase=Ready after ${i}s"; break; } + if curl -sf http://127.0.0.1:19237/readyz > /dev/null 2>&1; then + READY=1; echo "Server ready (/readyz 200) after ${i}s"; break + fi sleep 1 done - echo "$STATUS" | python3 -m json.tool || true - if [ "$PHASE" != "Ready" ]; then - echo "ERROR: server did not reach phase=Ready (last phase='$PHASE') after 30s" + echo "--- /readyz body ---"; curl -s http://127.0.0.1:19237/readyz || true; echo + echo "--- /api/v1/status ---" + curl -sf -H "X-API-Key: qa-sandbox-ci-test" http://127.0.0.1:19237/api/v1/status | python3 -m json.tool || true + if [ "$READY" != "1" ]; then + echo "ERROR: /readyz did not return 200 within 30s" cat /tmp/mcp3236-ci/server.log exit 1 fi - echo "Server healthy (phase=Ready) with isolation.mode=sandbox" + echo "Server healthy (/readyz) with isolation.mode=sandbox" - name: macOS/non-Linux graceful-degrade probe (build check) run: | From 9aab9fa72d4ae97371eaa4805a62838a9ec1a3eb Mon Sep 17 00:00:00 2001 From: Algis Dumbris Date: Mon, 29 Jun 2026 11:20:16 +0300 Subject: [PATCH 5/5] ci(sandbox): use docker_isolation.mode (global key) + assert sandbox actually resolved MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodexReviewer caught the probe was vacuous: the config used a top-level "isolation" key, but the GLOBAL isolation mode is docker_isolation.mode (per-server isolation is the only 'isolation' key). The wrong key was silently ignored, so the server started with isolation_mode=none — the 'sandbox' probe never tested sandbox. - workflow + harness: isolation -> docker_isolation for the global mode - workflow: assert the server log shows isolation_mode=sandbox (fail if not), so a future wrong-key regression can't pass vacuously - harness positive case now actually runs the stdio 'everything' server under Landlock (inherits global sandbox); negative baseline under docker (AppArmor) Related #71 --- .github/workflows/sandbox-integration.yml | 12 ++++++++++-- docs/development/sandbox-snap-docker-harness.md | 4 ++-- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/.github/workflows/sandbox-integration.yml b/.github/workflows/sandbox-integration.yml index a497d5c4..cc273610 100644 --- a/.github/workflows/sandbox-integration.yml +++ b/.github/workflows/sandbox-integration.yml @@ -96,7 +96,7 @@ jobs: "listen": "127.0.0.1:19237", "api_key": "qa-sandbox-ci-test", "enable_web_ui": false, - "isolation": { "mode": "sandbox" }, + "docker_isolation": { "mode": "sandbox" }, "mcpServers": [] } EOF @@ -137,7 +137,15 @@ jobs: cat /tmp/mcp3236-ci/server.log exit 1 fi - echo "Server healthy (/readyz) with isolation.mode=sandbox" + # Prove the server actually resolved SANDBOX mode (the global key is + # docker_isolation.mode — a wrong key silently falls back to "none", + # which would make this probe vacuous). + if ! grep -i "isolation_mode" /tmp/mcp3236-ci/server.log | grep -qi "sandbox"; then + echo "ERROR: server did not start in sandbox mode (expected isolation_mode=sandbox)" + grep -i "isolation_mode" /tmp/mcp3236-ci/server.log || echo "(no isolation_mode log line found)" + exit 1 + fi + echo "Server healthy (/readyz) and confirmed isolation_mode=sandbox" - name: macOS/non-Linux graceful-degrade probe (build check) run: | diff --git a/docs/development/sandbox-snap-docker-harness.md b/docs/development/sandbox-snap-docker-harness.md index 24e93a8a..d7141ff4 100644 --- a/docs/development/sandbox-snap-docker-harness.md +++ b/docs/development/sandbox-snap-docker-harness.md @@ -44,7 +44,7 @@ cat > /tmp/harness-docker/mcp_config.json <<'EOF' "listen": "127.0.0.1:18080", "api_key": "harness-key", "enable_web_ui": false, - "isolation": { "mode": "docker" }, + "docker_isolation": { "mode": "docker" }, "mcpServers": [ { "name": "everything", @@ -99,7 +99,7 @@ cat > /tmp/harness-sandbox/mcp_config.json <<'EOF' "listen": "127.0.0.1:18081", "api_key": "harness-key", "enable_web_ui": false, - "isolation": { "mode": "sandbox" }, + "docker_isolation": { "mode": "sandbox" }, "mcpServers": [ { "name": "everything",