fix(runtime): an image name cannot be read by the engine as an option #161

2026-10-09T23:50:08Z

rvnminers-A-and-N commented

2026-10-09 23:50:08 +00:00

Found while writing down the security model (#160).

The fault. Container.Execute appended the job's image to the arguments of docker run unchecked. An image beginning with a dash was parsed by Docker as an option, with the first word of command taken as the image. Anyone who could submit a job (a client of the pool, or an agent through the MCP server) could add mounts or privileges on every worker that ran it, so the read-only input, --user and --network none could not be relied on.

The fix. checkImage refuses a name that is empty, begins with a dash, or has a space or control character in it. It is applied in Split, when the job is submitted, and again in Execute, since a worker should not rely on its coordinator having checked.

Also. The MCP server's --images list only looked at container jobs. It now looks at every step of a graph, at any depth, and refuses an image given as a reference to an earlier step's result. ask_planner is refused while images are listed, because the planner runs jobs of its own choosing through the node.

Nodes running an earlier build as workers remain exposed to a coordinator or client that sends such an image; they need this build.

Found while writing down the security model (#160). **The fault.** `Container.Execute` appended the job's `image` to the arguments of `docker run` unchecked. An image beginning with a dash was parsed by Docker as an option, with the first word of `command` taken as the image. Anyone who could submit a job (a client of the pool, or an agent through the MCP server) could add mounts or privileges on every worker that ran it, so the read-only input, `--user` and `--network none` could not be relied on. **The fix.** `checkImage` refuses a name that is empty, begins with a dash, or has a space or control character in it. It is applied in `Split`, when the job is submitted, and again in `Execute`, since a worker should not rely on its coordinator having checked. **Also.** The MCP server's `--images` list only looked at `container` jobs. It now looks at every step of a `graph`, at any depth, and refuses an image given as a reference to an earlier step's result. `ask_planner` is refused while images are listed, because the planner runs jobs of its own choosing through the node. Nodes running an earlier build as workers remain exposed to a coordinator or client that sends such an image; they need this build.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Sisyphus/Sisyphus#161