feat(box): add privileged plumbing for DinD - #646

Open

G4614 wants to merge 32 commits into

boxlite-ai:mainfrom

G4614:feat/dind-privileged-plumbing

Commits on Aug 12, 2026

feat(box): add privileged plumbing for DinD
G4614
committed
6df9d50
fix(rest): satisfy Rust 1.97 clippy
G4614
committed
15164f9
feat(cli): add privileged flag to run and create
G4614
committed
495ee56
feat(box): make privileged mode a regular option
G4614
committed
c1023d5
chore(api): refresh generated clients
G4614
committed
fb9bcf9
chore(api): complete generated client refresh
G4614
committed
bdb2c1a
chore(api): preserve generated file ending
G4614
committed
8dc30fe
fix(box): normalize privileged options at every boundary
G4614
committed
5373a6d
fix(guest): retain shared readonly path policy
G4614
committed
9239c74
fix(api): defer capability support validation to guest
G4614
committed
19eb831
fix(box): reject conflicting privileged capabilities
G4614
committed
65f06d5
style(python): format privileged options test
G4614
committed
c4e67c9
fix(box): make privileged mode guest-complete
G4614
committed
91a6915
refactor(box): resolve privileged policy before guest boundary
G4614
committed
b7d49b8
docs(box): describe the complete guest-level privileged shape

G4614
and
claude
committed
6055c38
fix(box): correct privileged normalization, /sys scope and SDK toggle

G4614
and
claude
committed
55998ef
fix(box): gate privileged on the release that introduces it

G4614
and
claude
committed
b6bd1de
refactor: move control-plane/runner/SDK changes to a separate PR

G4614
and
claude
committed
881e7db
Delete docs/architecture/pr-646-dind-capabilities.md
G4614
committed
0f6aade
fix(container): resolve privileged policy on host
G4614
committed
58f1584
fix(runtime): sanitize REST options centrally
G4614
committed
21d9cb5
test(guest): compile atomic policy test
G4614
committed
8222001
test(guest): cover independent atomic policy
G4614
committed
31f5e95
test(guest): drop guest-side recheck now that host is trusted

G4614
and
claude
committed
4e98fe4
docs(proto): explain container security fields
G4614
committed
9b0b01e
fix(container): drop cgroup namespace and allow-all device rule

G4614
and
claude
committed
6ae5abe
docs: revert reference docs to main pending a follow-up pass

G4614
and
claude
committed
d7ea2da
fix(runtime): drop create_inner's redundant privileged normalization

G4614
and
claude
committed
e0dbea9
refactor(privileged): host resolves masked/readonly paths, guest applies verbatim
G4614
committed
88abf6b
refactor(scope): move CLI/self-hosted-REST privileged exposure to a follow-up PR
G4614
committed
6f93caa
refactor(privileged): source default masked/readonly paths from oci-spec
G4614
committed
1eb8b2a
refactor(privileged): stop resolving masked_paths through privileged
G4614
committed
ba99cef

Navigation Menu

Uh oh!

feat(box): add privileged plumbing for DinD - #646

feat(box): add privileged plumbing for DinD#646
G4614 wants to merge 32 commits into
boxlite-ai:mainfrom
G4614:feat/dind-privileged-plumbing

Commits on Aug 12, 2026

feat(box): add privileged plumbing for DinD

fix(rest): satisfy Rust 1.97 clippy

feat(cli): add privileged flag to run and create

feat(box): make privileged mode a regular option

chore(api): refresh generated clients

chore(api): complete generated client refresh

chore(api): preserve generated file ending

fix(box): normalize privileged options at every boundary

fix(guest): retain shared readonly path policy

fix(api): defer capability support validation to guest

fix(box): reject conflicting privileged capabilities

style(python): format privileged options test

fix(box): make privileged mode guest-complete

refactor(box): resolve privileged policy before guest boundary

docs(box): describe the complete guest-level privileged shape

fix(box): correct privileged normalization, /sys scope and SDK toggle

fix(box): gate privileged on the release that introduces it

refactor: move control-plane/runner/SDK changes to a separate PR

Delete docs/architecture/pr-646-dind-capabilities.md

fix(container): resolve privileged policy on host

fix(runtime): sanitize REST options centrally

test(guest): compile atomic policy test

test(guest): cover independent atomic policy

test(guest): drop guest-side recheck now that host is trusted

docs(proto): explain container security fields

fix(container): drop cgroup namespace and allow-all device rule

docs: revert reference docs to main pending a follow-up pass

fix(runtime): drop create_inner's redundant privileged normalization

refactor(privileged): host resolves masked/readonly paths, guest applies verbatim

refactor(scope): move CLI/self-hosted-REST privileged exposure to a follow-up PR

refactor(privileged): source default masked/readonly paths from oci-spec

refactor(privileged): stop resolving masked_paths through privileged