The native SRT sandbox mounts / read-only and allows writes only to the workspace root and a per-sandbox scratch directory (allowWrite in packages/code/src/native-sandbox.ts, scratch from mkdtemp(<tmpdir>/librechat-code-srt-XXXXXX)). TMPDIR points at the scratch directory and reaches child processes, so tools that honor it work. Tools that hardcode /tmp fail:
mongod, and therefore mongodb-memory-server test suites, creates its unix socket at /tmp/mongodb-<port>.sock regardless of TMPDIR. It dies with Failed to unlink socket file ... Read-only file system, then fassert() 40486, which callers only see as an opaque "Mongod internal error". Its --dbpath already lands under TMPDIR.- Shell scripts and CLIs that write
/tmp/<name> directly (PR bodies, logs, scratch files).
On one trusted-VM deployment over 9 days: 38 test runs failed on the mongod socket and 32 commands on read-only /tmp. Agents keep relearning --nounixsocket / --unixSocketPrefix "$TMPDIR" workarounds.
Proposal
Give each sandbox a private writable /tmp, for example a bwrap --tmpfs /tmp (size-limited), or a bind of a per-sandbox scratch subdirectory onto /tmp. Keep it:
- private to the sandbox (never the host
/tmp, which the current design deliberately excludes to prevent a shared scratch area across workers),
- wiped when the sandbox is evicted, like the scratch directory,
- subject to the existing
/tmp/claude deny rules.
This needs a security review of the SRT policy change, and the same behavior on macOS (/private/tmp) if feasible.
Acceptance
mongod (via mongodb-memory-server defaults) starts inside a native sandbox without extra args.- A file written to
/tmp by one sandbox is not visible to another sandbox or to the host.
The native SRT sandbox mounts
/read-only and allows writes only to the workspace root and a per-sandbox scratch directory (allowWriteinpackages/code/src/native-sandbox.ts, scratch frommkdtemp(<tmpdir>/librechat-code-srt-XXXXXX)).TMPDIRpoints at the scratch directory and reaches child processes, so tools that honor it work. Tools that hardcode/tmpfail:mongod, and thereforemongodb-memory-servertest suites, creates its unix socket at/tmp/mongodb-<port>.sockregardless ofTMPDIR. It dies withFailed to unlink socket file ... Read-only file system, thenfassert() 40486, which callers only see as an opaque "Mongod internal error". Its--dbpathalready lands underTMPDIR./tmp/<name>directly (PR bodies, logs, scratch files).On one trusted-VM deployment over 9 days: 38 test runs failed on the
mongodsocket and 32 commands on read-only/tmp. Agents keep relearning--nounixsocket/--unixSocketPrefix "$TMPDIR"workarounds.Proposal
Give each sandbox a private writable
/tmp, for example a bwrap--tmpfs /tmp(size-limited), or a bind of a per-sandbox scratch subdirectory onto/tmp. Keep it:/tmp, which the current design deliberately excludes to prevent a shared scratch area across workers),/tmp/claudedeny rules.This needs a security review of the SRT policy change, and the same behavior on macOS (
/private/tmp) if feasible.Acceptance
mongod(viamongodb-memory-serverdefaults) starts inside a native sandbox without extra args./tmpby one sandbox is not visible to another sandbox or to the host.