windy-git

Files

Kit OC5 b438b6a053 ci: run dind under Sysbox, not privileged (rollback override kept)

dind was privileged: true, so a job that escaped into dind was root on
Veron 1, which is Grant's workstation. Under sysbox-runc (sysbox-ce 0.7.1,
installed 09-23 with no docker restart) dind root is an unprivileged host
uid. Smoke-tested standalone: nested containers, internet, a services-style
postgres on a private network and a python image all pass unprivileged.
Fresh volume dind-storage-sysbox; the old dind-storage stays for
docker-compose.privileged.yml, the one-command rollback.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-23 12:41:42 -04:00

config.yaml

auth: token contract v1 (aud windy_git, both issuers); CI for eternitas

2026-09-23 02:58:56 -04:00

docker-compose.privileged.yml

ci: run dind under Sysbox, not privileged (rollback override kept)

2026-09-23 12:41:42 -04:00

docker-compose.yml

ci: run dind under Sysbox, not privileged (rollback override kept)

2026-09-23 12:41:42 -04:00

egress.sh

security: CI egress filter — jobs reach the internet, never Veron/LAN