fix: make dotnet run

2026-07-20 21:54:09 +02:00
parent 3b09de311b
commit 60cb143402
5 changed files with 21 additions and 3 deletions
@@ -106,7 +106,11 @@ exist only in the service-owned clone/push subprocess and are not inherited by
 Codex turns. The image and Compose capability/security settings let the non-root
 service create Codex's nested `bwrap` sandbox. They follow Codex's secure
 devcontainer pattern instead of making the service container privileged. Do not
-remove Codex's configured filesystem and network restrictions.
+remove Codex's configured filesystem and network restrictions. In particular,
+`systempaths=unconfined` removes Docker's outer masked `/proc` subpaths so the
+nested user/PID namespace can mount its own procfs. Runtimes such as CoreCLR
+require `/proc/self/maps`; Codex still controls visibility through the fresh
+procfs and its filesystem policy.

 ## State and recovery