Summary
The Dockerfile has:
```dockerfile
RUN useradd -m -s /bin/bash sandbox \
&& echo "sandbox ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers \
...
```
But `sudo` itself is never installed in any layer. Inside a running sandbox:
```
$ docker exec -u sandbox sudo whoami
bash: line 1: sudo: command not found
```
The sudoers entry is dead config. Any caller that thought `reach exec -- sudo …` would work (a reasonable assumption from reading the Dockerfile) gets the error above.
Fix
Add `sudo` to the layer 1 apt-get install list, OR remove the sudoers entry and document that root operations require `docker exec -u root` from outside the container.
I'd default to adding sudo because the sudoers entry exists and the obvious agent ergonomics ("sandbox is a Linux box, you can sudo inside it") match the project's pitch.
Discovered while
Trying to chown a bind mount from inside the sandbox as a workaround for #8. Had to fall back to `docker exec -u root` from the host.
Summary
The Dockerfile has:
```dockerfile
RUN useradd -m -s /bin/bash sandbox \
&& echo "sandbox ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers \
...
```
But `sudo` itself is never installed in any layer. Inside a running sandbox:
```
$ docker exec -u sandbox sudo whoami
bash: line 1: sudo: command not found
```
The sudoers entry is dead config. Any caller that thought `reach exec -- sudo …` would work (a reasonable assumption from reading the Dockerfile) gets the error above.
Fix
Add `sudo` to the layer 1 apt-get install list, OR remove the sudoers entry and document that root operations require `docker exec -u root` from outside the container.
I'd default to adding sudo because the sudoers entry exists and the obvious agent ergonomics ("sandbox is a Linux box, you can sudo inside it") match the project's pitch.
Discovered while
Trying to chown a bind mount from inside the sandbox as a workaround for #8. Had to fall back to `docker exec -u root` from the host.