didericis dfc693e0b6 fix(firecracker): keep the snapshot partial private even if one was left behind ...

Follow-up to the codex review on #398. os.open's mode arg only applies on
creation, so a committed-rootfs.tar.partial left 0644 by an interrupted run
would be opened/truncated (not re-moded) and stay world-readable for the
whole SSH stream. Unlink any leftover and exclusively recreate it
(O_EXCL|O_NOFOLLOW), then fchmod 0600 immediately so umask can't loosen it.

Test pre-creates a 0644 partial and asserts the fd is 0600 mid-stream.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UoEZHDjv84ChoZbozQERhJ

2026-07-17 01:02:19 -04:00

..

__init__.py

feat(firecracker): add Linux microVM backend to replace smolmachines

2026-07-11 10:32:55 -04:00

backend.py

feat(supervise): start orchestrator on demand via backend-agnostic bring-up

2026-07-16 21:52:11 -04:00

bottle_cleanup_plan.py

refactor(de-sidecar): remove the per-bottle companion-container architecture

2026-07-14 17:02:08 -04:00

bottle_plan.py

feat(gateway): mandatory identity-token attribution on every data plane (PR #354 review)

2026-07-16 17:02:41 -04:00

bottle.py

fix(firecracker): quote guest argv tokens so codex's multi-word prompt survives ssh

2026-07-16 18:01:59 -04:00

cleanup.py

refactor(de-sidecar): remove the per-bottle companion-container architecture

2026-07-14 17:02:08 -04:00

consolidated_launch.py

feat(firecracker): launch through the infra VM, not Docker (Stage B, 5/n)

2026-07-16 14:36:54 -04:00

enumerate.py

refactor(de-sidecar): purge the "sidecar" name from live code, tests, and current docs

2026-07-14 17:07:56 -04:00

firecracker_vm.py

feat(firecracker): persistent registry volume for the infra VM (Stage B, 6/n)

2026-07-16 14:36:54 -04:00

freezer.py

fix(firecracker): keep the snapshot partial private even if one was left behind

2026-07-17 01:02:19 -04:00

image_builder.py

feat(firecracker): stream buildah build output live during agent-image build

2026-07-16 18:01:59 -04:00

infra_artifact.py

chore(firecracker): name the artifact package bot-bottle-firecracker-infra

2026-07-17 00:04:48 -04:00

infra_vm.py

feat(firecracker): pull the infra rootfs as a prebuilt artifact (PRD 0069 Stage 2)

2026-07-16 23:41:53 -04:00

isolation_probe.py

refactor(backend): generic setup/status; drop firecracker-only CLI

2026-07-11 15:18:40 -04:00

launch.py

feat(firecracker): port freeze/migrate off host Docker (PRD 0069 / #397)

2026-07-17 00:31:00 -04:00

netpool.defaults.env

feat(firecracker): NAT'd egress link for the orchestrator/builder VM

2026-07-16 14:36:54 -04:00

netpool.py

feat(firecracker): NAT'd egress link for the orchestrator/builder VM

2026-07-16 14:36:54 -04:00

publish_infra.py

chore(firecracker): name the artifact package bot-bottle-firecracker-infra

2026-07-17 00:04:48 -04:00

resolve_plan.py

feat(firecracker): add Linux microVM backend to replace smolmachines

2026-07-11 10:32:55 -04:00

setup.py

feat(firecracker): portable systemd-unit install for the network pool

2026-07-11 18:33:42 -04:00

util.py

fix(firecracker): harden committed-snapshot resume against guest-controlled data

2026-07-17 00:44:06 -04:00