feat(execd): execd as sandbox init with hardening floor (OSEP-0018) - #1474

Open

Pangjiping wants to merge 17 commits into

opensandbox-group:mainfrom

Pangjiping:feat/execd-init-mode

Commits on Aug 11, 2026

feat(execd): execd as sandbox init (OSEP-0018 phase 1)
Pangjiping
committed
fae9470
feat(execd): pre-exec hardening floor (OSEP-0018 phase 2)
Pangjiping
committed
bbe5de0

Commits on Aug 12, 2026

feat(server): runtime.execd_run_as_init config injects EXECD_INIT
Pangjiping
committed
fb1e3fc
test(execd): real-container init-mode regression (OSEP-0018)
Pangjiping
committed
8818ba4
feat(execd): landlock confinement (OSEP-0018 phase 3)
Pangjiping
committed
81924c3
feat(execd): eBPF observation variant (OSEP-0018 phase 4)
Pangjiping
committed
2111654
docs(spec): drop phase markers from hardening layer descriptions
Pangjiping
committed
ab3263f
feat(sdks): surface hardening status across all execd-capabilities SDKs
Pangjiping
committed
a81109c
feat(server,k8s): pool tasks run execd as the task root (OSEP-0018 phase 5)
Pangjiping
committed
f06f1ff
docs(oseps): mark 0018 as implementing with granular phase status
Pangjiping
committed
9f9db05
fix: address Codex/human review feedback across five rounds + CI repairs
Pangjiping
committed
dc1f48f
fix: address Codex round 6 (credential identity, audit sink, /opt, sandbox_id)
Pangjiping
committed
fa7a494
test(e2e): dedicated execd-as-init real-e2e for python, plus nightly job
Pangjiping
committed
d5ac089
ci(e2e): fix execd-init e2e failures in python and k8s nightly jobs
Pangjiping
committed
b88cd97
feat(execd): ship execd-ebpf in default image; docs and e2e sync (OSEP-0018)
Pangjiping
committed
be2dc8a
fix(execd): address Codex round 7 (landlock jupyter log, init-mode report, launcher identity, ebpf build tags)
Pangjiping
committed
8ae0b49

Commits on Aug 13, 2026

docs(oseps): fold remaining-work tracking into OSEP-0018 status section
Pangjiping
committed
cba75bc