Skip to content

Add defensive behavior for strict environments like sandboxes - #411

Draft
bjester wants to merge 3 commits into
scope-filter-orderingfrom
sandboxing-defense
Draft

bjester wants to merge 3 commits into
scope-filter-orderingfrom
sandboxing-defense

Conversation

@bjester

@bjester bjester commented Nov 2, 2026

Copy link
Copy Markdown
Member

Summary

Short description

TODO

  • Have tests been written for the new code?
  • Has documentation been written/updated?
  • New dependencies (if any) added to requirements file

Reviewer guidance

If you PR has a significant size, give the reviewer some helpful remarks

Issues addressed

List the issues solved or partly solved by the PR

Documentation

If the PR has documentation, link the file here (either .rst in your repo or if built on Read The Docs)

AI usage

@bjester
bjester added this pull request to stack #412 November 2, 2026 14:55
@bjester
bjester force-pushed the sandboxing-defense branch 2 times, most recently from e660f7f to de4c5fc Compare November 2, 2026 18:09
bjester and others added 3 commits November 2, 2026 14:28
_get_client_ip_for_server opens a UDP socket to learn which local
address routes to the server. AppArmor or a sandbox can refuse to
create that socket, which raised outside the existing try block. It
now logs a warning and returns 127.0.0.1, as it already did when the
connect failed. The bare except is narrowed to OSError.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A MORANGO_NODE_ID set in the environment overrides the node ID, so
test_consistent_0_5_instance_id got a different instance ID than the
one it expects.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A sandbox can deny binding to port 0, which LiveServerTestCase uses by
default and get_free_tcp_port used to find a free port.
get_free_tcp_port moves to the test helpers and falls back to a fixed
list of ports when port 0 is denied. A new FreePortLiveServerTestCase
picks its port with it in setUpClass, so each class gets a port that
is free when its server starts. The client test cases now extend it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@bjester
bjester force-pushed the sandboxing-defense branch from de4c5fc to 605afdb Compare November 2, 2026 23:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant