viyatb-oai 912524d6fe Mount a minimal /dev in full-filesystem Bubblewrap sandboxes (#37349) ...

## Why

Binding the full host filesystem into a network-isolated Bubblewrap sandbox also
inherits the host's device tree.

## What changed

- Overlay `/dev` with Bubblewrap's minimal device filesystem while preserving
  the root bind's `nodev` behavior.
- Bind `/dev/shm` back into the sandbox when available so host and sandbox
  processes can continue to share memory files.

## Testing

Add a managed-proxy integration test that verifies standard device nodes remain
usable, `/dev` is not the host directory, and `/dev/shm` writes are shared with
the host.

GitOrigin-RevId: 1d91fe44affd792d2777adae8f2cce6d85d14103

2026-08-07 01:30:07 +00:00

..

suite

Mount a minimal /dev in full-filesystem Bubblewrap sandboxes (#37349)

2026-08-07 01:30:07 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00