René's URL Explorer Experiment


Title: fix(supervisor): drop sandbox child capability bounding set by alangou · Pull Request #2001 · NVIDIA/OpenShell · GitHub

Open Graph Title: fix(supervisor): drop sandbox child capability bounding set by alangou · Pull Request #2001 · NVIDIA/OpenShell

X Title: fix(supervisor): drop sandbox child capability bounding set by alangou · Pull Request #2001 · NVIDIA/OpenShell

Description: OpenShell is the safe, private runtime for autonomous AI agents. - fix(supervisor): drop sandbox child capability bounding set by alangou · Pull Request #2001 · NVIDIA/OpenShell

Open Graph Description: Summary Drop the Linux capability bounding set in the common sandbox child privilege-drop path so workloads and openshell connect shells cannot regain container-granted capabilities after exec. Rel...

X Description: Summary Drop the Linux capability bounding set in the common sandbox child privilege-drop path so workloads and openshell connect shells cannot regain container-granted capabilities after exec. Rel...

Opengraph URL: https://github.com/NVIDIA/OpenShell/pull/2001

X: @github

direct link

Domain: github.com

route-pattern/_view_fragments/voltron/pull_requests/show/:user_id/:repository/:id/pull_request_layout(.:format)
route-controllervoltron_pull_requests_fragments
route-actionpull_request_layout
fetch-noncev2:47d7285b-fab0-7210-cb91-8acd145679f7
current-catalog-service-hashae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b
request-idE094:2495A6:D05C8B:12D47BB:6A4CC6DE
html-safe-noncebccd6e24c650cc4f40c77e5892c27c89887c756953f2205cc734dbecc2a6c8dc
visitor-payloadeyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJFMDk0OjI0OTVBNjpEMDVDOEI6MTJENDdCQjo2QTRDQzZERSIsInZpc2l0b3JfaWQiOiI3MzU4NDg2ODQ0ODk0MTM2MDMxIiwicmVnaW9uX2VkZ2UiOiJpYWQiLCJyZWdpb25fcmVuZGVyIjoiaWFkIn0=
visitor-hmacd1fd391b698d2f913594e4690322b8a17582e3c52e0eaa4a7ff8bcf088ab849b
hovercard-subject-tagpull_request:3935475273
github-keyboard-shortcutsrepository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot
google-site-verificationApib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I
octolytics-urlhttps://collector.github.com/github/collect
analytics-location///voltron/pull_requests_fragments/pull_request_layout
fb:app_id1401488693436528
apple-itunes-appapp-id=1477376905, app-argument=https://github.com/_view_fragments/voltron/pull_requests/show/NVIDIA/OpenShell/2001/pull_request_layout
twitter:imagehttps://opengraph.githubassets.com/6a3856557f28918f820a352ac7a395092a6e10a5282de84b2cc3b1c3740e5e71/NVIDIA/OpenShell/pull/2001
twitter:cardsummary_large_image
og:imagehttps://opengraph.githubassets.com/6a3856557f28918f820a352ac7a395092a6e10a5282de84b2cc3b1c3740e5e71/NVIDIA/OpenShell/pull/2001
og:image:altSummary Drop the Linux capability bounding set in the common sandbox child privilege-drop path so workloads and openshell connect shells cannot regain container-granted capabilities after exec. Rel...
og:image:width1200
og:image:height600
og:site_nameGitHub
og:typeobject
og:author:usernamealangou
hostnamegithub.com
expected-hostnamegithub.com
None3d11bb817438277de2a940854450e83a7d32b6aeb5014e9e6b00a6423900251c
turbo-cache-controlno-cache
go-importgithub.com/NVIDIA/OpenShell git https://github.com/NVIDIA/OpenShell.git
octolytics-dimension-user_id1728152
octolytics-dimension-user_loginNVIDIA
octolytics-dimension-repository_id1166129534
octolytics-dimension-repository_nwoNVIDIA/OpenShell
octolytics-dimension-repository_publictrue
octolytics-dimension-repository_is_forkfalse
octolytics-dimension-repository_network_root_id1166129534
octolytics-dimension-repository_network_root_nwoNVIDIA/OpenShell
turbo-body-classeslogged-out env-production page-responsive
disable-turbofalse
browser-stats-urlhttps://api.github.com/_private/browser/stats
browser-errors-urlhttps://api.github.com/_private/browser/errors
released0da0eb92994395299ed4450bf67b0373005be36
ui-targetfull
theme-color#1e2327
color-schemelight dark

Links:

Skip to contenthttps://github.com/NVIDIA/OpenShell/pull/2001#start-of-content
https://github.com/
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2FNVIDIA%2FOpenShell%2Fpull%2F2001
GitHub CopilotWrite better code with AIhttps://github.com/features/copilot
GitHub Copilot appDirect agents from issue to mergehttps://github.com/features/ai/github-app
MCP RegistryNewIntegrate external toolshttps://github.com/mcp
ActionsAutomate any workflowhttps://github.com/features/actions
CodespacesInstant dev environmentshttps://github.com/features/codespaces
IssuesPlan and track workhttps://github.com/features/issues
Code ReviewManage code changeshttps://github.com/features/code-review
GitHub Advanced SecurityFind and fix vulnerabilitieshttps://github.com/security/advanced-security
Code securitySecure your code as you buildhttps://github.com/security/advanced-security/code-security
Secret protectionStop leaks before they starthttps://github.com/security/advanced-security/secret-protection
Why GitHubhttps://github.com/why-github
Documentationhttps://docs.github.com
Bloghttps://github.blog
Changeloghttps://github.blog/changelog
Marketplacehttps://github.com/marketplace
View all featureshttps://github.com/features
Enterpriseshttps://github.com/enterprise
Small and medium teamshttps://github.com/team
Startupshttps://github.com/enterprise/startups
Nonprofitshttps://github.com/solutions/industry/nonprofits
App Modernizationhttps://github.com/solutions/use-case/app-modernization
DevSecOpshttps://github.com/solutions/use-case/devsecops
DevOpshttps://github.com/solutions/use-case/devops
CI/CDhttps://github.com/solutions/use-case/ci-cd
View all use caseshttps://github.com/solutions/use-case
Healthcarehttps://github.com/solutions/industry/healthcare
Financial serviceshttps://github.com/solutions/industry/financial-services
Manufacturinghttps://github.com/solutions/industry/manufacturing
Governmenthttps://github.com/solutions/industry/government
View all industrieshttps://github.com/solutions/industry
View all solutionshttps://github.com/solutions
AIhttps://github.com/resources/articles?topic=ai
Software Developmenthttps://github.com/resources/articles?topic=software-development
DevOpshttps://github.com/resources/articles?topic=devops
Securityhttps://github.com/resources/articles?topic=security
View all topicshttps://github.com/resources/articles
Customer storieshttps://github.com/customer-stories
Events & webinarshttps://github.com/resources/events
Ebooks & reportshttps://github.com/resources/whitepapers
Business insightshttps://github.com/solutions/executive-insights
GitHub Skillshttps://skills.github.com
Documentationhttps://docs.github.com
Customer supporthttps://support.github.com
Community forumhttps://github.com/orgs/community/discussions
Trust centerhttps://github.com/trust-center
Partnershttps://github.com/partners
View all resourceshttps://github.com/resources
GitHub SponsorsFund open source developershttps://github.com/sponsors
Security Labhttps://securitylab.github.com
Maintainer Communityhttps://maintainers.github.com
Acceleratorhttps://github.com/accelerator
GitHub Starshttps://stars.github.com
Archive Programhttps://archiveprogram.github.com
Topicshttps://github.com/topics
Trendinghttps://github.com/trending
Collectionshttps://github.com/collections
Enterprise platformAI-powered developer platformhttps://github.com/enterprise
GitHub Advanced SecurityEnterprise-grade security featureshttps://github.com/security/advanced-security
Copilot for BusinessEnterprise-grade AI featureshttps://github.com/features/copilot/copilot-business
Premium SupportEnterprise-grade 24/7 supporthttps://github.com/premium-support
Pricinghttps://github.com/pricing
Search syntax tipshttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
documentationhttps://docs.github.com/search-github/github-code-search/understanding-github-code-search-syntax
Sign in https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2FNVIDIA%2FOpenShell%2Fpull%2F2001
Sign up https://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Fvoltron%2Fpull_requests_fragments%2Fpull_request_layout&source=header-repo&source_repo=NVIDIA%2FOpenShell
Reloadhttps://github.com/NVIDIA/OpenShell/pull/2001
Reloadhttps://github.com/NVIDIA/OpenShell/pull/2001
Reloadhttps://github.com/NVIDIA/OpenShell/pull/2001
Please reload this pagehttps://github.com/NVIDIA/OpenShell/pull/2001
NVIDIA https://github.com/NVIDIA
OpenShellhttps://github.com/NVIDIA/OpenShell
Notifications https://github.com/login?return_to=%2FNVIDIA%2FOpenShell
Fork 921 https://github.com/login?return_to=%2FNVIDIA%2FOpenShell
Star 7.4k https://github.com/login?return_to=%2FNVIDIA%2FOpenShell
Code https://github.com/NVIDIA/OpenShell
Issues 245 https://github.com/NVIDIA/OpenShell/issues
Pull requests 81 https://github.com/NVIDIA/OpenShell/pulls
Discussions https://github.com/NVIDIA/OpenShell/discussions
Actions https://github.com/NVIDIA/OpenShell/actions
Projects https://github.com/NVIDIA/OpenShell/projects
Security and quality 0 https://github.com/NVIDIA/OpenShell/security
Insights https://github.com/NVIDIA/OpenShell/pulse
Code https://github.com/NVIDIA/OpenShell
Issues https://github.com/NVIDIA/OpenShell/issues
Pull requests https://github.com/NVIDIA/OpenShell/pulls
Discussions https://github.com/NVIDIA/OpenShell/discussions
Actions https://github.com/NVIDIA/OpenShell/actions
Projects https://github.com/NVIDIA/OpenShell/projects
Security and quality https://github.com/NVIDIA/OpenShell/security
Insights https://github.com/NVIDIA/OpenShell/pulse
alangouhttps://github.com/alangou
mainhttps://github.com/NVIDIA/OpenShell/tree/main
alangou/os-173-high-docker-sandboxes-run-as-root-with-sys_admin-andhttps://github.com/NVIDIA/OpenShell/tree/alangou/os-173-high-docker-sandboxes-run-as-root-with-sys_admin-and
Conversationhttps://github.com/NVIDIA/OpenShell/pull/2001
Commits1 (1)https://github.com/NVIDIA/OpenShell/pull/2001/commits
Checkshttps://github.com/NVIDIA/OpenShell/pull/2001/checks
Files changedhttps://github.com/NVIDIA/OpenShell/pull/2001/files
fix(supervisor): drop sandbox child capability bounding sethttps://github.com/NVIDIA/OpenShell/pull/2001#top
alangouhttps://github.com/alangou
mainhttps://github.com/NVIDIA/OpenShell/tree/main
alangou/os-173-high-docker-sandboxes-run-as-root-with-sys_admin-andhttps://github.com/NVIDIA/OpenShell/tree/alangou/os-173-high-docker-sandboxes-run-as-root-with-sys_admin-and
https://github.com/alangou
alangouhttps://github.com/alangou
Jun 25, 2026https://github.com/NVIDIA/OpenShell/pull/2001#issue-4744142548
Please reload this pagehttps://github.com/NVIDIA/OpenShell/pull/2001
#1452https://github.com/NVIDIA/OpenShell/issues/1452
Please reload this pagehttps://github.com/NVIDIA/OpenShell/pull/2001
https://github.com/alangou
alangouhttps://github.com/alangou
derekwaynecarrhttps://github.com/derekwaynecarr
maxamillionhttps://github.com/maxamillion
mrunalphttps://github.com/mrunalp
code ownershttps://github.com/NVIDIA/OpenShell/blob/c7879a0a1d0a1d914dc745e843255ce1141cda1e/.github/CODEOWNERS#L2
June 25, 2026 13:17https://github.com/NVIDIA/OpenShell/pull/2001#event-27200669094
https://github.com/elezar
elezarhttps://github.com/elezar
Jun 25, 2026 https://github.com/NVIDIA/OpenShell/pull/2001#pullrequestreview-4572405822
View reviewed changes https://github.com/NVIDIA/OpenShell/pull/2001/files
crates/openshell-supervisor-process/src/process.rshttps://github.com/NVIDIA/OpenShell/pull/2001/files#diff-1efd6428d85eeb99d512dae1e2417669ed57641366324fee597d2dddbfe95541
Please reload this pagehttps://github.com/NVIDIA/OpenShell/pull/2001
https://github.com/elezar
elezarhttps://github.com/elezar
Jun 25, 2026 https://github.com/NVIDIA/OpenShell/pull/2001#pullrequestreview-4572497564
View reviewed changes https://github.com/NVIDIA/OpenShell/pull/2001/files
elezarhttps://github.com/elezar
https://github.com/NVIDIA/OpenShell/pull/2001#pullrequestreview-4572497564
Learn morehttps://docs.github.com/articles/managing-disruptive-comments/#hiding-a-comment
Please reload this pagehttps://github.com/NVIDIA/OpenShell/pull/2001
https://github.com/johntmyers
johntmyershttps://github.com/johntmyers
Jun 25, 2026https://github.com/NVIDIA/OpenShell/pull/2001#issuecomment-4801868615
Please reload this pagehttps://github.com/NVIDIA/OpenShell/pull/2001
https://github.com/alangou
alangouhttps://github.com/alangou
force-pushedhttps://github.com/NVIDIA/OpenShell/compare/0c0c87e3713b44436b80fc4105799717776891cc..b62975243adc843d4ab0f613f4b53c3fb3f9c0e1
0c0c87ehttps://github.com/NVIDIA/OpenShell/commit/0c0c87e3713b44436b80fc4105799717776891cc
b629752https://github.com/NVIDIA/OpenShell/commit/b62975243adc843d4ab0f613f4b53c3fb3f9c0e1
Compare https://github.com/NVIDIA/OpenShell/compare/0c0c87e3713b44436b80fc4105799717776891cc..b62975243adc843d4ab0f613f4b53c3fb3f9c0e1
June 26, 2026 13:11https://github.com/NVIDIA/OpenShell/pull/2001#event-27247345206
https://github.com/alangou
alangouhttps://github.com/alangou
elezarhttps://github.com/elezar
June 26, 2026 13:27https://github.com/NVIDIA/OpenShell/pull/2001#event-27247915384
https://github.com/alangou
alangouhttps://github.com/alangou
Jun 26, 2026https://github.com/NVIDIA/OpenShell/pull/2001#issuecomment-4810013770
@johntmyershttps://github.com/johntmyers
@elezarhttps://github.com/elezar
Please reload this pagehttps://github.com/NVIDIA/OpenShell/pull/2001
https://github.com/elezar
elezarhttps://github.com/elezar
Jun 26, 2026 https://github.com/NVIDIA/OpenShell/pull/2001#pullrequestreview-4579957006
View reviewed changes https://github.com/NVIDIA/OpenShell/pull/2001/files
crates/openshell-server/src/compute/mod.rshttps://github.com/NVIDIA/OpenShell/pull/2001/files#diff-8d18d6b9f7f033dc1ce15d977535cb2abdebd123df97f5f86c2d7d3cc5f2595c
Please reload this pagehttps://github.com/NVIDIA/OpenShell/pull/2001
https://github.com/alangou
alangouhttps://github.com/alangou
force-pushedhttps://github.com/NVIDIA/OpenShell/compare/b62975243adc843d4ab0f613f4b53c3fb3f9c0e1..6acb0bc9a26a1b90142e58e7c8e9ac4a748a682c
b629752https://github.com/NVIDIA/OpenShell/commit/b62975243adc843d4ab0f613f4b53c3fb3f9c0e1
6acb0bchttps://github.com/NVIDIA/OpenShell/commit/6acb0bc9a26a1b90142e58e7c8e9ac4a748a682c
Compare https://github.com/NVIDIA/OpenShell/compare/b62975243adc843d4ab0f613f4b53c3fb3f9c0e1..6acb0bc9a26a1b90142e58e7c8e9ac4a748a682c
June 26, 2026 15:14https://github.com/NVIDIA/OpenShell/pull/2001#event-27252045633
https://github.com/alangou
alangouhttps://github.com/alangou
elezarhttps://github.com/elezar
June 26, 2026 16:05https://github.com/NVIDIA/OpenShell/pull/2001#event-27253943045
https://github.com/cjagwani
cjagwanihttps://github.com/cjagwani
Jun 26, 2026 https://github.com/NVIDIA/OpenShell/pull/2001#ref-issue-4408426050
[Nemoclaw] [All Platforms] Sandbox allows dangerous capabilities in bounding set despite empty effective set NVIDIA/NemoClaw#3280 https://github.com/NVIDIA/NemoClaw/issues/3280
https://github.com/johntmyers
johntmyershttps://github.com/johntmyers
Jun 26, 2026https://github.com/NVIDIA/OpenShell/pull/2001#issuecomment-4813951237
@alangouhttps://github.com/alangou
Please reload this pagehttps://github.com/NVIDIA/OpenShell/pull/2001
https://github.com/alangou
fix(supervisor): drop sandbox child capability bounding sethttps://github.com/NVIDIA/OpenShell/pull/2001/commits/b0bb43b7396f9d2eb397de9e2181145d53701c3b
b0bb43bhttps://github.com/NVIDIA/OpenShell/pull/2001/commits/b0bb43b7396f9d2eb397de9e2181145d53701c3b
https://github.com/alangou
alangouhttps://github.com/alangou
force-pushedhttps://github.com/NVIDIA/OpenShell/compare/6acb0bc9a26a1b90142e58e7c8e9ac4a748a682c..b0bb43b7396f9d2eb397de9e2181145d53701c3b
6acb0bchttps://github.com/NVIDIA/OpenShell/commit/6acb0bc9a26a1b90142e58e7c8e9ac4a748a682c
b0bb43bhttps://github.com/NVIDIA/OpenShell/commit/b0bb43b7396f9d2eb397de9e2181145d53701c3b
Compare https://github.com/NVIDIA/OpenShell/compare/6acb0bc9a26a1b90142e58e7c8e9ac4a748a682c..b0bb43b7396f9d2eb397de9e2181145d53701c3b
June 29, 2026 08:44https://github.com/NVIDIA/OpenShell/pull/2001#event-27320088368
https://github.com/alangou
alangouhttps://github.com/alangou
Jun 29, 2026https://github.com/NVIDIA/OpenShell/pull/2001#issuecomment-4830958291
Please reload this pagehttps://github.com/NVIDIA/OpenShell/pull/2001
@johntmyershttps://github.com/johntmyers
Please reload this pagehttps://github.com/NVIDIA/OpenShell/pull/2001
https://github.com/alangou
alangouhttps://github.com/alangou
June 29, 2026 09:30https://github.com/NVIDIA/OpenShell/pull/2001#event-27322031684
https://github.com/elezar
elezarhttps://github.com/elezar
test:e2e https://github.com/NVIDIA/OpenShell/issues?q=state%3Aopen%20label%3Atest%3Ae2e
Jun 29, 2026https://github.com/NVIDIA/OpenShell/pull/2001#event-27327944809
https://github.com/apps/github-actions
github-actionshttps://github.com/apps/github-actions
Jun 29, 2026https://github.com/NVIDIA/OpenShell/pull/2001#issuecomment-4832284028
the existing runhttps://github.com/NVIDIA/OpenShell/actions/runs/28359745045
Please reload this pagehttps://github.com/NVIDIA/OpenShell/pull/2001
https://github.com/elezar
elezarhttps://github.com/elezar
Jun 29, 2026 https://github.com/NVIDIA/OpenShell/pull/2001#pullrequestreview-4592988360
View reviewed changes https://github.com/NVIDIA/OpenShell/pull/2001/files/b0bb43b7396f9d2eb397de9e2181145d53701c3b
https://github.com/alangou
alangouhttps://github.com/alangou
afc06ddhttps://github.com/NVIDIA/OpenShell/commit/afc06dd2a4ae9b269832657cdd8016e52bde3bbf
Jun 29, 2026https://github.com/NVIDIA/OpenShell/pull/2001#event-27336297878
Please reload this pagehttps://github.com/NVIDIA/OpenShell/pull/2001
https://github.com/alangou
alangouhttps://github.com/alangou
June 29, 2026 15:10https://github.com/NVIDIA/OpenShell/pull/2001#event-27336298925
https://github.com/waynesun09
waynesun09https://github.com/waynesun09
Jun 30, 2026 https://github.com/NVIDIA/OpenShell/pull/2001#ref-pullrequest-4779505981
fix: pin supervisor image to match openshell CLI version fullsend-ai/fullsend#2795 https://github.com/fullsend-ai/fullsend/pull/2795
https://github.com/ralphbean
ralphbeanhttps://github.com/ralphbean
Jun 30, 2026 https://github.com/NVIDIA/OpenShell/pull/2001#ref-issue-4779183537
Sandbox enters Error phase immediately on creation across all agent types and openshell versions fullsend-ai/fullsend#2792 https://github.com/fullsend-ai/fullsend/issues/2792
ben-alkovhttps://github.com/ben-alkov
Jun 30, 2026 https://github.com/NVIDIA/OpenShell/pull/2001#ref-commit-facd02e
https://github.com/waynesun09
fix: pin supervisor image to match openshell CLI versionhttps://github.com/ben-alkov/fullsend/commit/facd02e71bcd31b052cb83725a977f742529e98a
facd02ehttps://github.com/ben-alkov/fullsend/commit/facd02e71bcd31b052cb83725a977f742529e98a
NVIDIA/OpenShell#2001https://github.com/NVIDIA/OpenShell/pull/2001
fullsend-ai#2792https://github.com/fullsend-ai/fullsend/issues/2792
https://github.com/waynesun09
waynesun09https://github.com/waynesun09
Jun 30, 2026 https://github.com/NVIDIA/OpenShell/pull/2001#ref-issue-4779983775
supervisor v0.0.73 crashes in rootless Podman: drop_capability_bounding_set() EPERM with non-empty bounding set #2069 https://github.com/NVIDIA/OpenShell/issues/2069
https://github.com/elezar
elezarhttps://github.com/elezar
Jul 1, 2026 https://github.com/NVIDIA/OpenShell/pull/2001#ref-pullrequest-4780573449
fix(supervisor): tolerate non-empty bounding set when CAP_SETPCAP is unavailable #2075 https://github.com/NVIDIA/OpenShell/pull/2075
https://github.co/hiddenchars
https://github.com/NVIDIA/OpenShell/pull/{{ revealButtonHref }}
Sign up for freehttps://github.com/join?source=comment-repo
Sign in to commenthttps://github.com/login?return_to=https%3A%2F%2Fgithub.com%2FNVIDIA%2FOpenShell%2Fpull%2F2001
https://github.com/elezar
elezar https://github.com/elezar
https://github.com/NVIDIA/OpenShell/pull/2001/files/b0bb43b7396f9d2eb397de9e2181145d53701c3b
https://github.com/mrunalp
mrunalp https://github.com/mrunalp
https://github.com/maxamillion
maxamillion https://github.com/maxamillion
https://github.com/derekwaynecarr
derekwaynecarr https://github.com/derekwaynecarr
test:e2e https://github.com/NVIDIA/OpenShell/issues?q=state%3Aopen%20label%3Atest%3Ae2e
feat(sandbox): support --cap-drop / capability scoping on sandbox create https://github.com/NVIDIA/OpenShell/issues/1452
Please reload this pagehttps://github.com/NVIDIA/OpenShell/pull/2001
https://github.com/alangou
https://github.com/johntmyers
https://github.com/elezar
https://github.com
Termshttps://docs.github.com/site-policy/github-terms/github-terms-of-service
Privacyhttps://docs.github.com/site-policy/privacy-policies/github-privacy-statement
Securityhttps://github.com/security
Statushttps://www.githubstatus.com/
Communityhttps://github.community/
Docshttps://docs.github.com/
Contacthttps://support.github.com?tags=dotcom-footer

Viewport: width=device-width

URLs of crawlers that visited me.