d147f21490
New: ops-readonly, the read-only twin of the episode 9 ops-actions runner (fixed question list, three read-only mounts, no docker socket, read_only, cap_drop ALL). Four role skills in agents/skills/, loaded at run time from this repo's Forgejo. Two workflows: E (one agent, seven tools, one skill) and F (three agents, one skill each, the workflow is the orchestrator). Measured over 20 runs: no run of either variant produced all numbers and lists correct. The solo agent confuses similar counts and skips a tool; the crew calls every tool but drops fields at each role boundary. Sharpening the skill files did not help the crew, it made it worse. Logs are attacker text: an instruction in a request path is carried into the report as data, not obeyed, but carried. Claude-Session: https://claude.ai/code/session_017iP581CYtPfxdZYPPAyWZA
10 lines
461 B
Docker
10 lines
461 B
Docker
# ops-readonly (episode 11): the read-only executor behind the security report
|
|
# agents. python3-systemd is the only extra, it reads the host journal through
|
|
# libsystemd from a read-only bind mount. No docker client in here on purpose.
|
|
FROM debian:trixie-slim
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends python3 python3-systemd \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
COPY reader.py /reader.py
|
|
EXPOSE 8098
|
|
CMD ["python3", "-u", "/reader.py"]
|