From c3f55357ccdea85e6a89435e36ac100475ece670 Mon Sep 17 00:00:00 2001 From: didericis Date: Thu, 9 Jul 2026 00:49:04 -0400 Subject: [PATCH] test(smolmachines): verify Linux sandbox escape gate + fix platform check Empirical verification on NixOS/Linux with /dev/kvm + smolvm 1.4.7: 1. DB path confirmed: ~/.local/share/smolvm/server/smolvm.db exists, schema matches (vms table, data BLOB with allowed_cidrs JSON field). 2. smolvm 1.4.7 still silently drops --allow-cidr with --from (allowed_cidrs=None in DB after create). force_allowlist patch is still necessary and correct. 3. All 5 sandbox-escape attacks blocked with BOT_BOTTLE_BACKEND=smolmachines on Linux: hostname/IP allowlist, HTTP DLP, DNS exfil, git-gate gitleaks. Changes: - test_sandbox_escape: remove darwin-only guard; allow linux too - contrib/claude/Dockerfile: add dnsutils (dig) for attack 4 DNS test Co-Authored-By: Claude Sonnet 4.6 --- bot_bottle/contrib/claude/Dockerfile | 2 +- tests/integration/test_sandbox_escape.py | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/bot_bottle/contrib/claude/Dockerfile b/bot_bottle/contrib/claude/Dockerfile index 88e5014..4834dd3 100644 --- a/bot_bottle/contrib/claude/Dockerfile +++ b/bot_bottle/contrib/claude/Dockerfile @@ -21,7 +21,7 @@ FROM node:22-slim # to it) works against egress's bumped TLS without the agent needing # local DNS. RUN apt-get update \ - && apt-get install -y --no-install-recommends git ca-certificates curl ripgrep iproute2 \ + && apt-get install -y --no-install-recommends git ca-certificates curl ripgrep iproute2 dnsutils \ && rm -rf /var/lib/apt/lists/* # App-specific deps. Python isn't required by claude-code itself diff --git a/tests/integration/test_sandbox_escape.py b/tests/integration/test_sandbox_escape.py index dcb3329..af6187f 100644 --- a/tests/integration/test_sandbox_escape.py +++ b/tests/integration/test_sandbox_escape.py @@ -81,10 +81,10 @@ class TestSandboxEscape(unittest.TestCase): # those are missing rather than die-ing inside backend.prepare. backend_name = os.environ.get("BOT_BOTTLE_BACKEND", "docker") if backend_name == "smolmachines": - if sys.platform != "darwin": + if sys.platform not in ("darwin", "linux"): raise unittest.SkipTest( - "BOT_BOTTLE_BACKEND=smolmachines is macOS-only in " - "v1 (libkrun TSI)" + f"BOT_BOTTLE_BACKEND=smolmachines is not supported " + f"on {sys.platform} (macOS and Linux only)" ) if shutil.which("smolvm") is None: raise unittest.SkipTest(