chore(sandbox): land the merged uid-remap and OpenClaw compat work on integration - #33
Merged
Merged
Conversation
Each prebuilt stack's setup script runs under `set -euo pipefail` and
reads $HOME on its first working line, for the KUBECONFIG default and
the leading-~ expansions:
export KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config}"
REPO_PATH="${REPO_PATH/#\~/$HOME}"
A local-exec provisioner inherits only the environment tofu was invoked
with. A caller that constructs an allowlisted environment has no HOME to
pass through unless it had one itself, so the script aborts immediately:
./scripts/setup.sh: line 35: HOME: unbound variable
and the apply fails during provisioning, before the agent ever starts.
This does not reproduce from a login shell, which is why it survives
interactive use and only appears on an automated runner that builds a
clean environment. Every stack whose script reads $HOME is affected.
Stacks with no provisioner, or whose provisioner runs an inline command
that never reads $HOME, are left alone.
fix(tf): pass HOME to local-exec provisioners that need it
Fix sandbox ownership, cleanup and OpenClaw provider compatibility
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up carrier PR:
feat/sandbox-all-harnessesno longer flows tointegrationon its own now that #14 is merged, so this brings over the two PRs merged into the branch since then.HOMEto the tofulocal-execprovisioners whose setup scripts read it underset -u, so clean-environment runners don't die with "HOME: unbound variable" before the agent starts.--userlimit) instead of failing to start, with chown coverage for the workspace, fixtures and the generated kubeconfig; owner-scoped container naming and sweep so parallel runs can't reap each other; and OpenClaw provider compat (node-fetch shim, headless anthropic-vertex auth profile, model catalog additions).No new code beyond those two merges. Two deliberate behavior changes from #29, flagged at merge time: OpenClaw's
_build_envnow forwards ambient provider keys (e.g.OPENAI_API_KEY) across the sandbox boundary even withoutAGENT_API_KEY, andsweep_stray_containersis a no-op unlessBENCH_AGENT_SANDBOX_OWNERis set, so crash orphans are no longer reaped by default.🤖 Generated with Claude Code