[eXPerience83]

Problema confirmado en TrueNAS

La imagen ghcr.io/experience83/remote-dev:edge-amd64, revisión 5a56c3006135d41c913bb09a7f3be37d35c2c4df, contiene el directorio /usr/share/doc/remote-dev con modo 0444 (root:root). Al eliminar todas las capacidades (--cap-drop ALL), ni siquiera UID 0 puede atravesarlo y scripts/test-validation-tools.sh --local falla al leer third_party/BUILD-VERSIONS.env.

El origen es COPY --chmod=0444 LICENSE /usr/share/doc/remote-dev/LICENSE sin crear antes explícitamente el directorio padre. Es el mismo patrón de BuildKit ya mitigado para /etc/mise.

Cambio

• Crear explícitamente /usr/share/doc/remote-dev como root:root 0755 antes del primer COPY --chmod=0444. Conservar LICENSE a 0444.
• Validar en build la identidad/modo root:root 0755 para evitar otra imagen mal empaquetada.
• Extender el test de seis herramientas con comprobación estricta del modo y remote-dev-notices --check bajo su configuración existente --cap-drop ALL --read-only --network none.

Evidencia real

En TrueNAS, las herramientas funcionales y Python dual ya han pasado en ambos roles cuando se concedió DAC_READ_SEARCH solo al contenedor efímero de validación. La aplicación real superó salud, Doctor, aislamiento, ACL Generic/POSIX y recreación de los tres contenedores con persistencia de sesiones Codex/Antigravity. Ver #121.

Criterios de aceptación (pendientes de CI + nueva edge)

1. Build AMD64 y tests pasan, incluyendo scripts/test-validation-tools.sh sin --cap-add.
2. Imagen publicada: stat -c '%u:%g %a' /usr/share/doc/remote-dev devuelve 0:0 755.
3. remote-dev-notices --check y el test funcional pasan en contenedores efímeros sin capacidades, red ni mounts persistentes.
4. Verificar nueva imagen en TrueNAS sin alterar ACL del host y sin promover automáticamente stable.

No afecta a compose/truenas.yml, directorios persistentes ni a la PR de documentación #282.

Refs: #121.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 38 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: eXPerience83/remote-dev-containers/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: beeff7eb-e3e1-4400-8d7d-123ab6a4331b

📥 Commits

Reviewing files that changed from the base of the PR and between debb194 and 3517f4e.

📒 Files selected for processing: 2

• images/base/Dockerfile
• scripts/test-validation-tools.sh

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[eXPerience83]

Rebased on security-corrected main, 2026-10-21

The earlier head 7f4e115e21c9467e932f9f92b4bcb8fd55b8f10e failed its Trivy gate because it was based on pre-emSign-fix main and contained pip 26.2.1/certifi 2026.6.17. This is the same external CA incident fixed and squash-merged by PR #286 into new main debb1943471c1975b5ea3e80db9443d3bb0cfe66.

True rebased/squashed this two-file repair onto that exact main at 3517f4e76af8839370085995f5b40e8cc72fc5b3. Verified the new Dockerfile preserves uv 0.13.4 and both pip security checks, adds the explicit 0755 root:root notices directory and build-time check, and reuses the exact reviewed scripts/test-validation-tools.sh content asserting notice traversal and remote-dev-notices --check within the cap-dropped fixture. No host ACL, Compose, Python selections or persistent state touched.

Marked ready for review. Exact-head Build AMD64 #39553584727 is running. Please do not merge until it is green, review comments have been handled, and the new image is published. Live TrueNAS acceptance without DAC add-back remains a separate requirement in #121; no stable release or host change is claimed.

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.