bae8538695
* fix: shadow .env file in container to prevent agents from reading secrets The main agent's container mounts the project root read-only, which inadvertently exposed the .env file containing API keys. Mount /dev/null over /workspace/project/.env to shadow it — secrets are already passed via stdin and never need to be read from disk inside the container. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: adapt .env shadowing and runtime for Apple Container Apple Container (VirtioFS) only supports directory mounts, not file mounts. The previous /dev/null host-side mount over .env crashes with VZErrorDomain "A directory sharing device configuration is invalid". - Dockerfile: entrypoint now shadows .env via mount --bind inside the container, then drops privileges via setpriv to the host UID/GID - container-runner: main containers skip --user and pass RUN_UID/RUN_GID env vars so entrypoint starts as root for mount --bind - container-runtime: switch to Apple Container CLI (container), fix cleanupOrphans to use container list --format json - Skill: add Dockerfile and container-runner.ts to convert-to-apple-container skill (v1.1.0) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: revert src to Docker runtime, keep Apple Container in skill only The source files should remain Docker-compatible. The Apple Container adaptations live in the convert-to-apple-container skill and are applied on demand. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
16 lines
400 B
YAML
16 lines
400 B
YAML
skill: convert-to-apple-container
|
|
version: 1.1.0
|
|
description: "Switch container runtime from Docker to Apple Container (macOS)"
|
|
core_version: 0.1.0
|
|
adds: []
|
|
modifies:
|
|
- src/container-runtime.ts
|
|
- src/container-runtime.test.ts
|
|
- src/container-runner.ts
|
|
- container/build.sh
|
|
- container/Dockerfile
|
|
structured: {}
|
|
conflicts: []
|
|
depends: []
|
|
test: "npx vitest run src/container-runtime.test.ts"
|