Option to run commands, or the whole sandbox, without Linux capabilities #394

Package: @vercel/sandbox 3.8.0

The default sandbox user (uid 1000: vercel-sandbox on the node24 runtime, ubuntu on the universal image) runs with every Linux capability (CapEff 000001ffffffffff) as well as passwordless sudo. The docs already say this, so this is a feature request, not a security report.

Removing sudo is not enough to make a command unprivileged: with CAP_DAC_OVERRIDE the user can still delete a root-owned file in a root-owned folder. Removing sudo also removes the host's own root access, because runCommand({ sudo: true }) uses the same sudo. A user from sandbox.createUser() has no capabilities, but a program that must run as the default user (for example an agent bridge) cannot use it.

Reproduction (@vercel/sandbox 3.8.0, runtime: 'node24'). runCommand({ cmd: 'grep', args: ['CapEff', '/proc/self/status'] }) prints 000001ffffffffff. With sudo, create /opt/locked/file (mode 600) in a root-owned folder (mode 755). Then run runCommand({ cmd: 'rm', args: ['/opt/locked/file'] }) without sudo: exit 0, and the file is gone. The same rm on a second file, run under the setpriv line below, prints CapEff 0000000000000000 and fails with "Permission denied".

Request. An option on runCommand (or on Sandbox.create) that runs the command with no capabilities and no-new-privileges. The workaround today is to wrap the program in setpriv --inh-caps=-all --ambient-caps=-all --bounding-set=-all --no-new-privs.

Generated by Claude Code