Skip to content

docs: clarify hard link behavior in direct mounts #25964

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dvdksn wants to merge 1 commit into
base: main
Choose a base branch
from
+8 −0
Open

docs: clarify hard link behavior in direct mounts #25964

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions content/manuals/ai/sandboxes/security/isolation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,14 @@ By default, your workspace is shared into the VM as a read-write mount.
The agent and the host see the same files, and changes the agent makes
appear on your host as soon as they're written.

Direct mounts enforce access by path. If a workspace file is a hard link to a
file outside the workspace, the agent can read and modify the underlying file
through the workspace path. Changes affect every hard link to that file,
including links outside the authorized workspace. Filesystem access policies
do not block this access because they evaluate the workspace path rather than
other paths to the same file. [Clone mode](#clone-mode) prevents writes through
the primary workspace by mounting the host repository read-only.

There is no isolation between the agent and your workspace in this mode.
The agent can create, modify, or delete any file in the workspace,
including:
Expand Down