Skip to content

Commit 09b8bca

Browse files
akostadinovakostadinov
committed
use overlayfs for local repo and add tests
1 parent 6db0ca4 commit 09b8bca

7 files changed

Lines changed: 1125 additions & 3 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
version: 2
2+
updates:
3+
# Enable version updates for GitHub Actions
4+
- package-ecosystem: "github-actions"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
day: "monday"
9+
time: "09:00"
10+
open-pull-requests-limit: 10
11+
labels:
12+
- "dependencies"
13+
- "github-actions"
14+
commit-message:
15+
prefix: "ci"
16+
include: "scope"
17+
reviewers:
18+
- "3scale-labs/maintainers"
19+
assignees:
20+
- "3scale-labs/maintainers"

‎.github/workflows/tests.yml‎

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
name: Tests
2+
3+
on:
4+
push:
5+
branches: [ main, develop ]
6+
pull_request:
7+
branches: [ main, develop ]
8+
9+
jobs:
10+
test:
11+
name: Run Test Suite
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- name: Checkout code
16+
uses: actions/checkout@v4
17+
18+
- name: Install dependencies
19+
run: |
20+
sudo apt-get install -y expect apparmor-profiles
21+
22+
- name: Get bubblewrap latest commit
23+
id: bwrap-commit
24+
run: |
25+
COMMIT=$(git ls-remote https://github.com/containers/bubblewrap.git HEAD | cut -f1)
26+
echo "commit=$COMMIT" >> $GITHUB_OUTPUT
27+
echo "Bubblewrap latest commit: $COMMIT"
28+
29+
- name: Restore bubblewrap from cache
30+
id: cache-bwrap
31+
uses: actions/cache/restore@v4
32+
with:
33+
path: /tmp/bwrap-bin
34+
key: bwrap-${{ runner.os }}-${{ steps.bwrap-commit.outputs.commit }}
35+
36+
- name: Install build dependencies
37+
if: steps.cache-bwrap.outputs.cache-hit != 'true'
38+
run: |
39+
sudo apt-get install -y \
40+
meson \
41+
ninja-build \
42+
libcap-dev \
43+
gcc \
44+
pkg-config
45+
46+
- name: Build latest bubblewrap
47+
if: steps.cache-bwrap.outputs.cache-hit != 'true'
48+
run: |
49+
# Clone and build latest bubblewrap
50+
cd /tmp
51+
git clone https://github.com/containers/bubblewrap.git
52+
cd bubblewrap
53+
meson setup builddir --prefix=/usr
54+
meson compile -C builddir
55+
56+
# Prepare binary for caching
57+
mkdir -p /tmp/bwrap-bin
58+
cp builddir/bwrap /tmp/bwrap-bin/
59+
60+
- name: Save bubblewrap to cache
61+
if: steps.cache-bwrap.outputs.cache-hit != 'true'
62+
uses: actions/cache/save@v4
63+
with:
64+
path: /tmp/bwrap-bin
65+
key: bwrap-${{ runner.os }}-${{ steps.bwrap-commit.outputs.commit }}
66+
67+
- name: Install bubblewrap
68+
run: |
69+
sudo cp /tmp/bwrap-bin/bwrap /usr/bin/bwrap
70+
sudo chmod +x /usr/bin/bwrap
71+
72+
# Verify version (should be 0.11.0 or later)
73+
bwrap --version
74+
75+
- name: Setup user namespaces for bubblewrap
76+
run: |
77+
# Configure subuid and subgid for unprivileged user namespaces
78+
USERNAME=$(whoami)
79+
80+
# Add subuid mapping (100000 UIDs starting from 100000)
81+
# echo "$USERNAME:100000:65536" | sudo tee -a /etc/subuid
82+
83+
# Add subgid mapping (100000 GIDs starting from 100000)
84+
# echo "$USERNAME:100000:65536" | sudo tee -a /etc/subgid
85+
86+
# Enable unprivileged user namespaces (should already be enabled on Ubuntu)
87+
# echo "kernel.unprivileged_userns_clone=1" | sudo tee -a /etc/sysctl.conf
88+
# sudo sysctl -p
89+
90+
# Setup AppArmor profile for bubblewrap user namespaces
91+
sudo ln -s /usr/share/apparmor/extra-profiles/bwrap-userns-restrict /etc/apparmor.d/bwrap
92+
sudo apparmor_parser /etc/apparmor.d/bwrap
93+
94+
# Verify setup
95+
cat /etc/subuid
96+
cat /etc/subgid
97+
98+
- name: Setup test environment
99+
run: |
100+
# Create isolated home for agent
101+
mkdir -p ~/aihome
102+
103+
# Initialize git config (required for some tests)
104+
git config --global user.email "ci@github.actions"
105+
git config --global user.name "GitHub Actions"
106+
107+
- name: Run merge-overlay tests
108+
run: |
109+
cd ${{ github.workspace }}
110+
./tests/test-merge-overlay.expect
111+
112+
- name: Setup for agent-dev tests
113+
run: |
114+
# Ensure we're in a git repo with proper setup
115+
cd ${{ github.workspace }}
116+
git status || git init
117+
118+
# Create .claude directory structure if needed
119+
mkdir -p .claude
120+
touch .claude/settings.local.json || true
121+
122+
- name: Run agent-dev integration tests
123+
run: |
124+
cd ${{ github.workspace }}
125+
./tests/test-agent-dev.expect
126+
127+
- name: Test summary
128+
if: always()
129+
run: |
130+
echo "Test execution completed"
131+
echo "Check logs above for detailed results"
132+
133+
lint:
134+
name: Shell Script Linting
135+
runs-on: ubuntu-latest
136+
137+
steps:
138+
- name: Checkout code
139+
uses: actions/checkout@v4
140+
141+
- name: Install ShellCheck
142+
run: sudo apt-get install -y shellcheck
143+
144+
- name: Lint shell scripts
145+
run: |
146+
echo "Linting bash scripts..."
147+
shellcheck agent-dev merge-overlay || true
148+
echo "Note: Some warnings may be acceptable for this use case"

‎README.md‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
# Agent Dev Environment
2+
3+
[![Tests](https://github.com/3scale-labs/agent-dev-env/actions/workflows/tests.yml/badge.svg)](https://github.com/3scale-labs/agent-dev-env/actions/workflows/tests.yml)
4+
15
# Goal
26
The goal is to easily start your coding agent within a secure sandbox environment that closely resembles your actual development environment and safely merge the results back.
37

@@ -31,4 +35,19 @@ Now you can just call the script from within a git working tree and feel the fal
3135
* also `asdf`, `npm` and other directories from user's real home are monuted read-only inside the sandbox home so that you have access to these installations without ability to install, remove and modify them
3236
* note: *this means you need to install all necessary libraries from the host*
3337

34-
TODO: what is possibly unsafe - e.g. gitignored files, careful when merging (if I implement this)
38+
The biggest concern I see is merging the changes after exiting the agent. One has to be careful with merging files that are a potential treat outside the sanbox.
39+
40+
A lesser but potentially important in some environments is the cocern that a malware may set roots into the sandbox and use local resources or network access for malicious purposes. On signs of weird behavior, I'd suggest investigating and wiping the agent home dir to start over.
41+
42+
## Running Tests
43+
44+
```bash
45+
# Install expect if not already installed
46+
sudo apt install expect # Debian/Ubuntu
47+
# or
48+
sudo dnf install expect # Fedora/RHEL
49+
50+
# Run all tests
51+
./tests/test-merge-overlay.expect # Test the merge workflow
52+
./tests/test-agent-dev.expect # Test isolation and sandbox behavior
53+
```

‎agent-dev‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535
set -euo pipefail
3636

3737
# Configuration
38-
AI_HOME="$HOME/aihome"
38+
AI_HOME="${AI_HOME:-$HOME/aihome}"
3939
REPO_DIR="$(pwd)"
4040

4141
# Overlay directories for repository isolation (using full path to avoid conflicts)

‎merge-overlay‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ get_file_status() {
6262
local repo_file="$2"
6363

6464
# Check if it's a whiteout file (deletion marker in overlayfs)
65-
if [[ "$(basename "$overlay_file")" =~ ^\\.wh\\. ]]; then
65+
if [[ "$(basename "$overlay_file")" =~ ^\.wh\. ]]; then
6666
echo "deleted"
6767
return
6868
fi

0 commit comments

Comments
 (0)