Docker hardening

[andri-coral]

Why this matters

Marketplace and linked-source agents now run with hardened defaults out of the box: read-only rootfs, dropped capabilities, bounded CPU/memory/PIDs, non-root UID, denied executable runtime. So a buggy or hostile third-party agent can't trash the host, exhaust resources, or escape the container.

Operators don't need to write bespoke per-agent Docker policy: the hardening is uniform across all marketplace and linked agents, overridable per-tier in config.toml when an agent legitimately needs more headroom.

Locally-authored agents keep running under the looser trusted_local profile so day-to-day development iteration is unaffected.

Hardening

ExecutionTrustPolicy resolved from AgentRegistrySourceIdentifier → applied to docker-java HostConfig. Marketplace defaults:

• readOnlyRootFilesystem = true, user = "65532:65532" (distroless nonroot)
• nanoCpus = 1e9 (1 vCPU), memoryLimitBytes = 512 MiB, pidsLimit = 256
• dropCapabilities = {"ALL"}, noNewPrivileges = true
• tmpfs /tmp rw,noexec,nosuid,nodev,size=64m

Trusted defaults keep caps/privs/pids posture + tmpfs (defense-in-depth) and skip rootfs/UID/resource caps so local iteration stays smooth. "Trusted" is not "permissive" — it's "less constrained".

ExecutableRuntime denied for marketplace/linked unless security.allow_untrusted_executable_runtime = true.

File-transport temp payloads tightened to read-only POSIX perms.

Agent-side surface

• HOME/TMPDIR/XDG_* redirected to tmpfs when requiresWritableTmpHome — necessary plumbing under RO rootfs + non-root UID for distroless images, not extra hardening.

Scope and known gaps

• Out of scope egress mediation; manifest [execution] schema; runtime × tier compatibility (resolver doesn't see RuntimeId yet, so the marketplace UID will conflict with the OpenShell supervisor when Stage 2 lands
• requireImageDigest plumbing in place, off by default. Operators can opt in via config.toml.

Operator overrides

[security]
allow_untrusted_executable_runtime = false   # default

[docker.marketplace]
memory_limit_bytes = 1073741824              # 1 GiB
require_image_digest = true                  # strict pinning today

Marketplace images must ship with the 65532:65532 UID/GID present. Agents requiring root fail at container start under the default profile, the operator can relax [docker.marketplace] user or the author must repackage.