[codex] secure code sandbox secret isolation#7173
Conversation
Coverage Report
File CoverageNo changed files found. |
|
✅ Docs Preview Deployed! 🔗 👀 Click here to visit preview 🕒 Time: 2026-06-24 13:32:52 (UTC+8) |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 95cd7a95b3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| RUN groupadd -g 65537 sandbox && useradd -u 65537 -g 65537 -M -r -s /usr/sbin/nologin sandbox && \ | ||
| mkdir -p /tmp/fastgpt-python-sandbox && \ | ||
| chown -R sandbox:sandbox /app /tmp/fastgpt-python-sandbox |
There was a problem hiding this comment.
This image now creates the sandbox user but falls through to CMD without switching to it. BaseProcessPool.spawnWorker() does not set uid/gid, so /sandbox/js workers inherit the root server uid, whereas the previous Dockerfile ended with USER sandbox; in any deployment using this image, a JS sandbox escape or future allowlist mistake becomes container-root access. Please restore a non-root runtime for JS workers (or spawn them with the sandbox uid/gid) while keeping only the Python native isolation step privileged.
Useful? React with 👍 / 👎.
| return { | ||
| ...config, | ||
| baseURL: undefined, |
There was a problem hiding this comment.
When a caller uses Axios' auth option and the response redirects to a different host/protocol, this spread carries config.auth into the redirected request. The header filter removes an existing Authorization header, but the Node adapter re-applies Basic auth from auth, so a redirect controlled by the first server can receive those credentials. Drop auth whenever shouldDropSensitiveHeaders would be true.
Useful? React with 👍 / 👎.
|
✅ Build Successful - Preview fastgpt Image for this PR: 🕒 Time: 2026-06-24 13:37:33 (UTC+8) |
|
✅ Build Successful - Preview code-sandbox Image for this PR: 🕒 Time: 2026-06-24 13:39:18 (UTC+8) |
|
✅ Admin Preview Image Ready! 🕒 Time: 2026-06-24 13:34:42 (UTC+8) |
|
追加本次提交内容：
Related pro PR: https://github.com/labring/fastgpt-pro/pull/994 Validation: pnpm exec vitest run -c vitest.config.ts test/core/ai/llm/compress/index.test.tsResult: |
1 participant
What changed
SANDBOX_POOL_SIZE.Why
The old persistent Python worker model could not fully address the code sandbox secret exposure advisory because user code lived inside a long-running interpreter process. The new model executes each task in a disposable Python subprocess while keeping prewarmed clean processes for latency.
Validation
pnpm --filter @fastgpt/code-sandbox exec tsc --noEmitSANDBOX_MAX_MEMORY_MB=256 pnpm --filter @fastgpt/code-sandbox exec vitest run test/unit/python-isolated-runner.test.ts test/unit/process-pool.test.ts test/unit/resource-limits.test.ts --coverage.enabled=falsepnpm --filter @fastgpt/code-sandbox buildSANDBOX_POOL_SIZE=10: Python warm idle count 10, Python RSS total about 187MB, container working set about 388MiB.