Jason WoltjeandClaude Opus 4.5 3f16bbeca1 fix(#338): Add Docker security hardening (CapDrop, ReadonlyRootfs, PidsLimit) ...

- Drop all Linux capabilities by default (CapDrop: ALL)
- Enable read-only root filesystem (agents write to mounted /workspace volume)
- Limit process count to 100 to prevent fork bombs (PidsLimit)
- Add no-new-privileges security option to prevent privilege escalation
- Add DockerSecurityOptions type with configurable security settings
- All options are configurable via config but secure by default
- Add comprehensive tests for security hardening options (20+ new tests)

Refs #338

Co-Authored-By: Claude Opus 4.5 <[email protected]>

2026-02-05 18:21:43 -06:00

..

api

fix(#338): Validate DEFAULT_WORKSPACE_ID as UUID

2026-02-05 16:55:48 -06:00

coordinator

fix(#338): Log queue corruption and backup corrupted file

2026-02-05 18:13:15 -06:00

orchestrator

fix(#338): Add Docker security hardening (CapDrop, ReadonlyRootfs, PidsLimit)

2026-02-05 18:21:43 -06:00

web

fix(#338): Standardize API base URL and auth mechanism across components

2026-02-05 18:04:01 -06:00