fix(agent-challenge): stop RO-rootfs on own_runner task containers

[echobt]

Summary

• After the digest-manifest fix (PR fix(agent-challenge): resolve TB digest manifest in installed wheel #58), every trial crashed with mkdir: cannot create directory '/tests': Read-only file system.
• Task containers incorrectly inherited the DooD job-client --read-only posture.
• Remove --read-only from task-guest hardening only; keep cap-drop ALL, no-new-privileges, pids-limit, tmpfs /tmp, and workspace volume.

Symptom

After digest-manifest resolution shipped, verifier upload_tests failed while the container was still running:

mkdir: cannot create directory '/tests': Read-only file system

This blocked all scoring after bootstrap.

Root cause

own_runner task guests incorrectly inherited the DooD job-client --read-only rootfs posture. Harbor paths and apt-based test.sh need a writable rootfs for /tests and related layout.

Fix

• Stop passing --read-only from hardening_run_args for task-guest containers.
• Keep existing hardening: --cap-drop ALL, --security-opt no-new-privileges, --pids-limit, tmpfs /tmp, workspace volume mounts.
• Wire DooD env into upload_tests / collect_verifier_dir so verifier I/O still works under the broker.

Security residual (honest)

Same-container agent+verifier means a malicious agent can still subvert the toolchain before tests run. That is inherent to harbor parity + apt-based test.sh. A fresh-container verifier is the correct P0 follow-up. Product path remains host-trust unattested. Oracle: CONDITIONAL SHIP.

Changes

• packages/challenges/agent-challenge/src/agent_challenge/evaluation/own_runner/container_builder.py
• packages/challenges/agent-challenge/src/agent_challenge/evaluation/own_runner/verifier_runner.py
• packages/challenges/agent-challenge/tests/test_own_runner_isolation_invariants.py

Cherry-pick of 587bb1ce onto current main (post PR #58 merge b1cec36d). No unrelated commits.

Test plan

• Isolation invariants 14/14
• Area suite 720 passed / 3 skipped
• E2E VerifierOutcome score=1.0
• CI green on this PR
• After merge: base-master published; in-image assert "--read-only" not in hardening_run_args()

CI

• Waiting for required checks to go green on this head SHA.

Notes

• Does not touch production host, compose.env, keyrelease/ratls/wallet.
• Follow-up: fresh-container verifier isolation (P0).

Summary by CodeRabbit

• Bug Fixes

  • Task containers can now write to required task and verification paths while retaining security protections such as dropped capabilities, process limits, and no-new-privileges.
  • Docker operations now reliably use the configured runtime environment when transferring test files and verification logs.

• Tests

  • Expanded coverage verifies writable container paths and continued enforcement of hardening controls.

[coderabbitai]

📝 Walkthrough

Walkthrough

Task containers no longer use --read-only, preserving existing hardening controls while allowing required task and harbor paths to remain writable. Docker copy operations now receive the daemon-specific environment, and isolation tests validate both behaviors.

Changes

Own runner runtime changes

Layer / File(s)	Summary
Writable task rootfs hardening and validation packages/challenges/agent-challenge/src/agent_challenge/evaluation/own_runner/container_builder.py, packages/challenges/agent-challenge/tests/test_own_runner_isolation_invariants.py	hardening_run_args() omits --read-only while retaining capability dropping, no-new-privileges, bounded pids, writable /tmp, and workspace mounts. Tests verify writable rootfs and harbor paths.
Daemon environment for Docker copies packages/challenges/agent-challenge/src/agent_challenge/evaluation/own_runner/verifier_runner.py	Docker execution and copy subprocesses receive environment._daemon_env() through the upload and verifier-log collection paths.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: removing read-only rootfs from own_runner task containers.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/tb-writable-task-rootfs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

packages/challenges/agent-challenge/src/agent_challenge/evaluation/own_runner/container_builder.py (1)

298-321: 🔒 Security & Privacy | 🔵 Trivial

Deliberate --read-only removal, well-justified and tested.

The rationale (harbor paths /tests, /logs/verifier, /solution, /app plus apt-based test.sh needing a writable rootfs) is sound, and the other hardening controls (cap-drop ALL, no-new-privileges, bounded pids-limit, writable /tmp tmpfs) remain intact. This is directly validated by test_hardening_run_args_does_not_force_readonly_rootfs and test_task_container_allows_harbor_verifier_paths in the companion test file.

One thing worth keeping in mind operationally: this widens the writable surface for the container that runs task/agent-submitted code (previously RO). Since network isolation, cap-drop, and pids limits are unchanged and the container is short-lived and destroyed per task, this looks acceptable — just flagging it as a posture change worth being aware of if this container is ever reused for anything beyond the sanctioned harbor workflow.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@packages/challenges/agent-challenge/src/agent_challenge/evaluation/own_runner/container_builder.py`
around lines 298 - 321, The hardened task-container configuration intentionally
omits --read-only to preserve writable harbor paths and package installation
behavior. Keep hardening_run_args unchanged, including its existing capability,
privilege, PID, tmpfs, and workspace-volume options, and retain the accompanying
tests that validate the writable-rootfs posture.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In
`@packages/challenges/agent-challenge/src/agent_challenge/evaluation/own_runner/container_builder.py`:
- Around line 298-321: The hardened task-container configuration intentionally
omits --read-only to preserve writable harbor paths and package installation
behavior. Keep hardening_run_args unchanged, including its existing capability,
privilege, PID, tmpfs, and workspace-volume options, and retain the accompanying
tests that validate the writable-rootfs posture.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f0218ff5-1416-4fa5-93c6-ef370c251fd6

📥 Commits

Reviewing files that changed from the base of the PR and between b1cec36 and ef34fd8.

📒 Files selected for processing (3)

• packages/challenges/agent-challenge/src/agent_challenge/evaluation/own_runner/container_builder.py
• packages/challenges/agent-challenge/src/agent_challenge/evaluation/own_runner/verifier_runner.py
• packages/challenges/agent-challenge/tests/test_own_runner_isolation_invariants.py