From 5e2245b777c5d1c8e84c49d1b2070e2083e8a4ab Mon Sep 17 00:00:00 2001 From: David Karlsson <35727626+dvdksn@users.noreply.github.com> Date: Fri, 28 Aug 2026 13:42:44 +0000 Subject: [PATCH] docs: clarify direct mount hard link access Direct mounts authorize workspace access by path, so hard-linked files can expose writes outside the authorized root. Document the behavior and explain that clone mode mounts the primary host repository read-only. Refs docker/sandboxes#4715 Co-Authored-By: Claude --- content/manuals/ai/sandboxes/security/isolation.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/content/manuals/ai/sandboxes/security/isolation.md b/content/manuals/ai/sandboxes/security/isolation.md index 8515413c6b2..0da3015920c 100644 --- a/content/manuals/ai/sandboxes/security/isolation.md +++ b/content/manuals/ai/sandboxes/security/isolation.md @@ -113,6 +113,14 @@ By default, your workspace is shared into the VM as a read-write mount. The agent and the host see the same files, and changes the agent makes appear on your host as soon as they're written. +Direct mounts enforce access by path. If a workspace file is a hard link to a +file outside the workspace, the agent can read and modify the underlying file +through the workspace path. Changes affect every hard link to that file, +including links outside the authorized workspace. Filesystem access policies +do not block this access because they evaluate the workspace path rather than +other paths to the same file. [Clone mode](#clone-mode) prevents writes through +the primary workspace by mounting the host repository read-only. + There is no isolation between the agent and your workspace in this mode. The agent can create, modify, or delete any file in the workspace, including: