fix(security): remove host /proc mount from chroot mode

Host /proc exposes sensitive information including environment variables
of all host processes (which may contain secrets like API keys). This is
an unnecessary security risk since most language runtimes work without
/proc access.

- Remove /proc:/host/proc:ro mount from chroot mode
- Update tests to assert /proc is NOT mounted
- Update documentation to remove /proc references

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: Mossaka

docs-site/src/content/docs/reference/security-architecture.md

@@ -318,7 +318,6 @@ A common question: "If the command runs in the host filesystem, doesn't it escap
 | Aspect | Impact | Mitigation |
 |--------|--------|------------|
 | **Host $HOME access** | Can read `.ssh/`, `.aws/` | Use env vars for secrets, not files |
-| **Host /proc visible** | Can enumerate processes | Read-only, cannot modify |
 | **DNS override** | Host's resolv.conf modified | Backup created, restored on exit |
 
 ### When to Use Chroot Mode

docs/chroot-mode.md

@@ -142,7 +142,6 @@ In chroot mode, selective paths are mounted for security instead of the entire f
 | `/etc/ca-certificates` | `/host/etc/ca-certificates:ro` | CA certificates |
 | `/etc/passwd` | `/host/etc/passwd:ro` | User lookup |
 | `/etc/group` | `/host/etc/group:ro` | Group lookup |
-| `/proc` | `/host/proc:ro` | Process info (read-only) |
 
 ### Read-Write Mounts
 
@@ -214,7 +213,6 @@ Linux namespaces operate independently:
 | Risk | Severity | Description | Mitigation |
 |------|----------|-------------|------------|
 | Host file access | HIGH | `$HOME` is read-write | CI/CD secrets should use env vars, not files |
-| /proc visibility | MEDIUM | Can enumerate host processes | Read-only mount, cannot modify |
 | DNS override | LOW | Host's `/etc/resolv.conf` temporarily modified | Backup created, restored on exit |
 | /dev visibility | LOW | Device nodes visible | Read-only, cannot create new devices |
 
@@ -235,21 +233,6 @@ With chroot mode, the agent can read/write to the user's home directory:
 - Use short-lived tokens (`GITHUB_TOKEN` expires)
 - Consider what files exist on your runners
 
-### Process Visibility
-
-Inside the chroot, `/proc` shows host processes:
-
-```bash
-# Inside chroot
-ls /proc/
-1  2  3  ...  # Host PIDs visible
-
-cat /proc/1/cmdline
-/sbin/init  # Host's init process
-```
-
-**Mitigation**: `/proc` is mounted read-only. Cannot modify kernel parameters or send signals to host processes.
-
 ### DNS Configuration
 
 The container copies its DNS configuration to the host:

src/docker-manager.test.ts

@@ -546,7 +546,8 @@ describe('docker-manager', () => {
       expect(volumes).toContain('/opt:/host/opt:ro');
 
       // Should include special filesystems (read-only)
-      expect(volumes).toContain('/proc:/host/proc:ro');
+      // NOTE: /proc is NOT mounted to prevent exposure of host process environment variables
+      expect(volumes).not.toContain('/proc:/host/proc:ro');
       expect(volumes).toContain('/sys:/host/sys:ro');
       expect(volumes).toContain('/dev:/host/dev:ro');
 

src/docker-manager.ts

@@ -419,9 +419,9 @@ export function generateDockerCompose(
     // /opt/hostedtoolcache contains Python, Node, Ruby, Go, Java, etc.
     agentVolumes.push('/opt:/host/opt:ro');
 
-    // Special filesystem mounts for chroot (needed for process info, devices)
+    // Special filesystem mounts for chroot (needed for devices)
+    // NOTE: /proc is NOT mounted to prevent exposure of host process environment variables
     agentVolumes.push(
-      '/proc:/host/proc:ro',      // Read-only proc for runtime info
       '/sys:/host/sys:ro',        // Read-only sysfs
       '/dev:/host/dev:ro',        // Read-only device nodes (needed by some runtimes)
     );

src/types.ts

@@ -338,7 +338,7 @@ export interface WrapperConfig {
    * - /usr, /bin, /sbin, /lib, /lib64 - System binaries and libraries
    * - /opt - Tool cache (Python, Node, Ruby, Go, Java from GitHub runners)
    * - /etc/ssl, /etc/ca-certificates, /etc/alternatives, /etc/ld.so.cache - Runtime config
-   * - /proc, /sys, /dev - Special filesystems for runtime info
+   * - /sys, /dev - Special filesystems for runtime info (NOT /proc - security)
    *
    * Mounted paths (read-write):
    * - $HOME - User home directory for project files and Rust/Cargo