[sstriker]

The harness-container survey (#2) found five gaps in our code. All five are fixed on main now. This PR updates docs/harness-containers.md to show this.

The change

• The summary table ("The answer, short"). Each "Fix" row is now "Fixed" and names its pull request:
  • fix: refuse vsock and io_uring in the Linux sandbox #14: vsock and io_uring, and no_new_privs.
  • fix: make read-only grants read-only below their submounts #15: the recursive read-only bind.
  • fix: refuse a tunnel to an unnamed port or a denied address #13 and fix: check the TLS server name inside a CONNECT tunnel #24: the CONNECT tunnel. fix: refuse a tunnel to an unnamed port or a denied address #13 restricts the port and checks the address. fix: check the TLS server name inside a CONNECT tunnel #24 checks the TLS server name.
  • ci: add Dependabot version updates for GitHub Actions #12: Dependabot, for the workflows' actions only.
  • mount: gate the io helper to Linux, so dm-mount compiles off it #5 and fix: report a death by signal as 128 plus its number, and name it #17: the macOS CI job compiles, and the launcher reports a death by signal.
  • fix: fail the launch when the egress socket cannot be bound #16: the egress socket bind.
• The gap sections. Each section has a "Fixed in" paragraph that says what the fix does. The tunnel section also says what stays open: the HTTP Host and the paths behind an allowed name.
• The Seatbelt section. The CI item is done. The developer-tools shim warning stays open.
• The spike result row for our backend. It now says that the result is from before fix: refuse vsock and io_uring in the Linux sandbox #14 and fix: make read-only grants read-only below their submounts #15.
• seccompiler and Landlock. seccompiler is in, with fix: refuse vsock and io_uring in the Linux sandbox #14. Landlock is not.

The rows for Landlock, gVisor and the npm lockfile do not change, because that work is not done.

Checks

This change is Markdown outside crates/ only. So scripts/docs-only.sh skips make check, and AGENTS.md skips the adversarial pass. I read each claim against the merged pull request and the code on main. For example, crates/sandbox/src/linux/seccomp.rs:85-97 sets no_new_privs and installs the filter.

Posted by Claude on behalf of @sstriker

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.