aaron/infra-core
1
0
Fork 2
Code Issues Pull requests 12 Projects Releases 1 Packages Wiki Activity Actions

HOMELAB-439: fix(sandbox): fix SSH key permissions + add SANDBOX_MODE env var #80

Merged
claude-agent merged 1 commit from plane/HOMELAB-439-sandbox-ssh-permissions into live 2026-03-26 22:15:55 +00:00
Conversation 0 Commits 1 Files changed 2 +7 -7
claude-agent commented 2026-03-26 22:15:44 +00:00
Owner
Copy link

Summary

  • Replace subPath SSH secret mount with full directory mount at .ssh-secret/ and add fsGroup: 1000 to pod securityContext so claude-agent (uid 1000) can read the keys
  • Add SANDBOX_MODE=true env var so worker starts in sandbox mode by default

Test plan

  • Deploy sandbox pod and verify entrypoint doesn't crash on SSH setup
  • Verify worker starts in sandbox mode (check logs for SANDBOX_MODE)
  • Verify SSH keys are readable by claude-agent user inside pod

🤖 Generated with Claude Code

## Summary - Replace subPath SSH secret mount with full directory mount at `.ssh-secret/` and add `fsGroup: 1000` to pod securityContext so `claude-agent` (uid 1000) can read the keys - Add `SANDBOX_MODE=true` env var so worker starts in sandbox mode by default ## Test plan - [ ] Deploy sandbox pod and verify entrypoint doesn't crash on SSH setup - [ ] Verify worker starts in sandbox mode (check logs for SANDBOX_MODE) - [ ] Verify SSH keys are readable by claude-agent user inside pod 🤖 Generated with [Claude Code](https://claude.com/claude-code)
HOMELAB-439: fix(sandbox): fix SSH key permissions + add SANDBOX_MODE env var
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
4d270f88fc 
Replace subPath SSH secret mount with full directory mount at .ssh-secret/
and add fsGroup: 1000 to pod securityContext so claude-agent (uid 1000)
can read the keys. Add SANDBOX_MODE=true env var so worker starts in
sandbox mode by default.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
aaron/infra-core!80
No description provided.