fix(docker): DockerClient.create 添加 seccomp=unconfined 默认配置#498
Open
LUERUI wants to merge 1 commit intoagentscope-ai:mainfrom
Open
fix(docker): DockerClient.create 添加 seccomp=unconfined 默认配置#498LUERUI wants to merge 1 commit intoagentscope-ai:mainfrom
LUERUI wants to merge 1 commit intoagentscope-ai:mainfrom
Conversation
问题：Node.js 沙箱容器在创建线程时需要调用 clone() 系统调用， Docker 默认 seccomp profile 会阻止该调用，导致容器异常。 修复：在 DockerClient.create 中，如果用户未显式指定 security_opt， 默认附加 security_opt: ["seccomp=unconfined"]。 策略： - 未传入 security_opt 时默认启用 - 用户显式传入空列表 [] 可选择关闭（opt-out） - 用户传入自定义值时保留原值，不覆盖 影响范围： - 仅影响 DockerClient，KubernetesClient 不受影响 - tests/unit/test_docker_client_seccomp.py 新增 7 个单元测试覆盖 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
DockerClient.create中，默认附加security_opt: ["seccomp=unconfined"]security_opt时保留原值，不覆盖[]视为 opt-out，不追加默认配置问题背景
Node.js 沙箱容器在创建线程时需要通过
clone()系统调用，Docker 默认的 seccomp profile 会阻止该系统调用，导致容器运行异常。
修改范围
src/agentscope_runtime/common/container_clients/docker_client.py：create方法 +2 行tests/unit/test_docker_client_seccomp.py：新增，7 个单元测试Test plan