/proc and /dev fully mounted in bubblewrap sandbox

[mrjf]

Summary

The bubblewrap setup mounts full /proc and /dev namespaces. Scripts can read /proc/self/mem, walk /proc/[pid]/cmdline for sibling processes, and access /dev/* devices.

Where

packages/runtime/src/band-server.ts:243-244

"--proc", "/proc",
"--dev", "/dev",

Impact

• /proc/[pid]/cmdline exposes command lines of other processes, including the brief base64 -d subprocess that decodes secrets (see /proc and /dev fully mounted in bubblewrap sandbox #28).
• /proc/self/mem can be used to introspect or modify the band-runner process memory (limited by uid).
• /dev/* exposes raw device nodes (most are 0660 root:disk and not readable by band-runner, but /dev/null, /dev/zero, /dev/urandom, and /dev/tty are).

Fix

Replace the full mounts with minimal equivalents:

• --proc /proc → leave out, or use --ro-bind /proc/self /proc/self if /proc/self is required
• --dev /dev → use --dev-bind /dev/null /dev/null, --dev-bind /dev/zero /dev/zero, --dev-bind /dev/urandom /dev/urandom

Most scripts only need /dev/null and /dev/urandom. Verify by running the skill tests after restricting.