## Summary The SRT sandbox (`ee/lib/gitlab/duo_workflow/sandbox.rb`) currently restricts writes to `./` (the CI project directory) and `/tmp/gitlab_duo_agent_platform` only. `/tmp` itself is **not writable**, even though it is writable in the underlying Docker image — the restriction is purely sandbox-enforced. LLMs commonly use `/tmp` for scratch files, cloning repos, writing MR descriptions, and other ephemeral operations. This is deeply embedded in LLM training data and fighting against it causes fragile fallback behaviour (e.g. cloning into `./` instead of `/tmp`). We should not artificially constrain the agent here when there is no meaningful security risk. ### Symptom When testing with the `developer_unstable` flow which uses `glab`, the agent was told to clone another repo: ``` $ glab repo clone gitlab-duo/test /tmp/gitlab-duo-test Read-only file system ``` The agent fell back to cloning into `./test/`, which worked but is fragile and unexpected. We saw similar behavior in other traces when LLMs wanted to create one-off scripts or test something. ## Analysis ### Problem 1: `/tmp` is not writable for the agent The `allowWrite` list only includes `./` and `DUO_AGENT_PLATFORM_WRITE_DIR` (`/tmp/gitlab_duo_agent_platform`): ```ruby allowWrite: ["./", DUO_AGENT_PLATFORM_WRITE_DIR] ``` `TMPDIR` is set to `/tmp/gitlab_duo_agent_platform`, but LLMs naturally use `/tmp` directly. ### Problem 2: `srt-settings.json` is writable by the agent (pre-existing security issue) The SRT sandbox config file is written to `/tmp/gitlab_duo_agent_platform/srt-settings.json` — inside the `DUO_AGENT_PLATFORM_WRITE_DIR` which is in the `allowWrite` list. This means the **agent can already overwrite the sandbox config today**, even without adding `/tmp` to `allowWrite`. While modifying the file wouldn't change an already-running sandbox session, this is not ideal from a defense-in-depth perspective. ### Problem 3: `DUO_AGENT_PLATFORM_WRITE_DIR` conflates agent scratch space with platform config `DUO_AGENT_PLATFORM_WRITE_DIR` (`/tmp/gitlab_duo_agent_platform`) is used for: | Use | Consumer | Needs this specific directory? | |---|---|---| | `srt-settings.json` | SRT (reads config at startup) | No — SRT supports `--settings <any path>` | | `GITLAB_LSP_STORAGE_DIR` | `gitlab-lsp` PersistentStorage | No — just needs a writable dir | | `NPM_CONFIG_CACHE` | npm | No — just needs a writable dir | | `TMPDIR` | General temp directory | No — `/tmp` is more natural | None of these require co-location. The directory exists as a workaround for `/tmp` not being writable, and it conflates platform-internal config (which the agent should not touch) with agent scratch space (which the agent needs to write to). ## Proposed Fix ### 1. Introduce a protected platform system directory Create a new constant `SANDBOX_SYSTEM_DIR` pointing to a location outside `/tmp` that the agent cannot write to: ```ruby SANDBOX_SYSTEM_DIR = "/opt/.gitlab-sandbox" ``` **Why `/opt/.gitlab-sandbox`:** - `/opt` exists and is writable by root in the base Docker image (`workflow-generic-image:v0.0.6`) - It's outside `/tmp`, so no dependency on `denyWrite` vs `allowWrite` precedence - A hidden dotdir in `/opt` is something an LLM would never naturally write to - The name is generic and reusable for future platform internals (audit logs, policy files, credentials, etc.) Move `srt-settings.json` there: ```ruby srt_settings_path = "#{SANDBOX_SYSTEM_DIR}/srt-settings.json" ``` Add to `denyWrite` as defense-in-depth: ```ruby denyWrite: [SANDBOX_SYSTEM_DIR] ``` Note: per [SRT docs](https://github.com/anthropic-experimental/sandbox-runtime#configuration-options), `denyWrite` takes precedence over `allowWrite`, so this provides an extra safety layer even if `allowWrite` changes in the future. ### 2. Allow `/tmp` writes ```ruby allowWrite: ["./", "/tmp"] ``` `/tmp` is ephemeral per CI job and is already isolated by the sandbox's network and sensitive-file restrictions. The risk of allowing writes here is low, and it aligns with how LLMs naturally behave. ### 3. Remove `DUO_AGENT_PLATFORM_WRITE_DIR` This constant is no longer needed. Update environment variables to use natural locations: ```ruby TMPDIR: "/tmp" NPM_CONFIG_CACHE: "/tmp/.npm-cache" GITLAB_LSP_STORAGE_DIR: "/tmp/gitlab-lsp" ``` ### 4. Update setup commands ```ruby def setup_sandbox_commands [%(mkdir -p #{SANDBOX_SYSTEM_DIR})] end ``` The `mkdir -p` for the agent write dir is no longer needed since `/tmp` is always available. ### Resulting SRT config ```ruby SANDBOX_SYSTEM_DIR = "/opt/.gitlab-sandbox" filesystem: { denyRead: ["~/.ssh"], allowWrite: ["./", "/tmp"], denyWrite: [SANDBOX_SYSTEM_DIR], allowGitConfig: true } ``` ## Files to change ### Production code - **`ee/lib/gitlab/duo_workflow/sandbox.rb`** — All changes are here: - Replace `DUO_AGENT_PLATFORM_WRITE_DIR` with `SANDBOX_SYSTEM_DIR` - Move `srt_settings_path` to `SANDBOX_SYSTEM_DIR` - Update `allowWrite` to `["./", "/tmp"]` - Add `denyWrite: [SANDBOX_SYSTEM_DIR]` - Update `environment_variables` (`TMPDIR`, `NPM_CONFIG_CACHE`, `GITLAB_LSP_STORAGE_DIR`) - Update `setup_sandbox_commands` to create `SANDBOX_SYSTEM_DIR` instead ### Tests - **`ee/spec/lib/gitlab/duo_workflow/sandbox_spec.rb`** — Update expectations for new paths and config - **`ee/spec/services/ai/duo_workflows/start_workflow_service_spec.rb`** — Update `sandbox_setup_commands` expectation - **`ee/spec/services/ai/duo_workflows/resume_workflow_service_spec.rb`** — Update `sandbox_setup_commands` expectation ## Context - Original issue for `/tmp` security discussion: https://gitlab.com/gitlab-org/gitlab/-/work_items/584527 - SRT `--settings` flag docs: https://github.com/anthropic-experimental/sandbox-runtime#settings-file-location - SRT `denyWrite` precedence: https://github.com/anthropic-experimental/sandbox-runtime#configuration-options