You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "potiuk (via GitHub)" <gi...@apache.org> on 2026/04/29 13:07:23 UTC
[PR] secure-agent-setup: layered credential isolation + 7-day pinned tools [airflow-steward]
potiuk opened a new pull request, #11:
URL: https://github.com/apache/airflow-steward/pull/11
## Summary
Adds the framework's recommended **secure agent setup** — a layered defence for running Claude Code (or any other `SKILL.md`-aware agent) against pre-disclosure CVE content without unfettered host-credential access. The framework dogfoods the config in `.claude/settings.json`; adopters scaffold their own copy from the example block in the new doc.
The setup is four layers, each implemented in this PR:
| Layer | Mechanism |
|---|---|
| 0. Clean env | `tools/agent-isolation/claude-iso.sh` — `env -i` + tiny passthrough list |
| 1. FS sandbox | `.claude/settings.json` `sandbox.enabled: true` + bubblewrap (Linux) / Seatbelt (macOS) |
| 2. Tool permissions | `.claude/settings.json` `permissions.deny` for Read / Edit / Write / Bash |
| 3. Forced confirmation | `.claude/settings.json` `permissions.ask` for `git push`, `gh pr create`, etc. |
## 7-day cooldown for system-tool versions
Mirrors the framework's existing 7-day cooldown convention (`[tool.uv] exclude-newer = "7 days"` in `pyproject.toml`; weekly Dependabot with 7-day cooldown in `dependabot.yml`). Every host-system tool the secure setup depends on is pinned in `tools/agent-isolation/pinned-versions.toml` to a version released at least 7 days before the manifest was last touched.
| Tool | Pinned | Released | Purpose |
|---|---|---|---|
| `bubblewrap` | 0.11.1 | 2026-03-21 | Linux user-namespace sandbox (filesystem layer) |
| `socat` | 1.8.1.1 | 2026-03-13 | TCP relay for the network allowlist |
| `claude-code` | 2.1.117 | 2026-04-22 | Agent runtime (claude-code v2.1.123 from today is *not* picked up — within 7-day cooldown) |
A side-effect-free check script (`check-tool-updates.sh`) compares pinned versions to upstream and prints upgrade candidates that have themselves aged past 7 days. **No auto-install, no auto-edit of the manifest, no auto-PR** — bumps require explicit maintainer review per the procedure in `secure-agent-setup.md`. The doc also walks through wiring the script into a weekly `/schedule` routine for ongoing visibility.
## Files added
| File | Purpose |
|---|---|
| `secure-agent-setup.md` | User-facing doc: threat model, layered defence, install commands per distro, bump procedure, adopter scaffold, verification, residual risks. |
| `.claude/settings.json` | Framework's dogfooded secure config — sandbox + permissions for cwd-rooted Claude Code sessions in this repo. |
| `tools/agent-isolation/pinned-versions.toml` | Pinned upstream versions with `released` dates that satisfy the 7-day cooldown. |
| `tools/agent-isolation/check-tool-updates.sh` | Side-effect-free upstream-vs-pinned drift checker. |
| `tools/agent-isolation/claude-iso.sh` | Layer-0 wrapper. |
| `tools/agent-isolation/README.md` | Directory overview. |
## Files updated
`README.md` and `AGENTS.md` link to the new doc from the agent-prerequisites and Local-setup sections.
## Test plan
- ✅ `prek run --all-files` passes (doctoc generated TOCs for the two new .md files; all other hooks clean).
- ✅ Check script runs end-to-end against upstream, prints expected drift table:
```
TOOL PINNED PINNED@ UPSTREAM UPSTREAM@ STATUS
bubblewrap 0.11.1 2026-03-21 0.11.1 2026-03-21 ✓ up to date
socat 1.8.1.1 2026-03-13 1.8.1.1 2026-02-12 ✓ up to date
claude-code 2.1.117 2026-04-22 2.1.117 2026-04-22 ✓ up to date
```
Latest claude-code v2.1.123 is intentionally *not* picked up — within 7-day cooldown.
- ✅ `.claude/settings.json` parses as valid JSON (`python3 -c 'import json; json.load(open(".claude/settings.json"))'`).
- The actual filesystem-sandbox enforcement requires bubblewrap on the host — first invocation of Claude Code in this repo after merge will exercise it end-to-end.
## Out of scope
- An equivalent secure setup for non-Claude-Code agents (the doc is Claude-Code-specific because that's the reference implementation; other agents would need their own equivalent of `sandbox` / `permissions`).
- An automated PR-opening "bump bot" for the pinned tools — the manual review step is deliberate, matching the same convention the framework uses for everything else.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] secure-agent-setup: layered credential isolation + 7-day pinned tools [airflow-steward]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #11:
URL: https://github.com/apache/airflow-steward/pull/11#issuecomment-4344403693
Yeah ... and I have some follow-up after testing (including my mint distro quirks and setting up my Yubikey)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] secure-agent-setup: layered credential isolation + 7-day pinned tools [airflow-steward]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk merged PR #11:
URL: https://github.com/apache/airflow-steward/pull/11
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] secure-agent-setup: layered credential isolation + 7-day pinned tools [airflow-steward]
Posted by "raboof (via GitHub)" <gi...@apache.org>.
raboof commented on PR #11:
URL: https://github.com/apache/airflow-steward/pull/11#issuecomment-4344226535
cool! big fan of bubblewrap. it remains a bit odd to have claude take care of wrapping instead of wrapping claude, but :shrug: :smile:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org