fix(vm): preserve image sandbox workdir

Author: drew

crates/openshell-driver-vm/scripts/openshell-vm-sandbox-init.sh

@@ -289,16 +289,12 @@ mount -t tmpfs tmpfs /run 2>/dev/null &
 mount -t devtmpfs devtmpfs /dev 2>/dev/null &
 wait
 
-mkdir -p /dev/pts /dev/shm /sys/fs/cgroup /sandbox
+mkdir -p /dev/pts /dev/shm /sys/fs/cgroup
 mount -t devpts devpts /dev/pts 2>/dev/null &
 mount -t tmpfs tmpfs /dev/shm 2>/dev/null &
 mount -t cgroup2 cgroup2 /sys/fs/cgroup 2>/dev/null &
 wait
 
-mount -t tmpfs tmpfs /sandbox 2>/dev/null || true
-mkdir -p /sandbox
-chown sandbox:sandbox /sandbox 2>/dev/null || true
-
 hostname openshell-sandbox-vm 2>/dev/null || true
 ip link set lo up 2>/dev/null || true
 

crates/openshell-driver-vm/src/rootfs.rs

@@ -174,8 +174,6 @@ fn prepare_sandbox_rootfs(rootfs: &Path) -> Result<(), String> {
     fs::write(opt_dir.join(".rootfs-type"), "sandbox\n")
         .map_err(|e| format!("write sandbox rootfs marker: {e}"))?;
     ensure_sandbox_guest_user(rootfs)?;
-    fs::create_dir_all(rootfs.join("sandbox"))
-        .map_err(|e| format!("create sandbox workdir: {e}"))?;
 
     Ok(())
 }
@@ -365,7 +363,7 @@ mod tests {
         assert!(!rootfs.join("opt/openshell/charts").exists());
         assert!(!rootfs.join("opt/openshell/manifests").exists());
         assert!(rootfs.join("srv/openshell-vm-sandbox-init.sh").is_file());
-        assert!(rootfs.join("sandbox").is_dir());
+        assert!(!rootfs.join("sandbox").exists());
         assert!(
             fs::read_to_string(rootfs.join("etc/passwd"))
                 .expect("read passwd")
@@ -384,6 +382,30 @@ mod tests {
         let _ = fs::remove_dir_all(&dir);
     }
 
+    #[test]
+    fn prepare_sandbox_rootfs_preserves_image_workdir_contents() {
+        let dir = unique_temp_dir();
+        let rootfs = dir.join("rootfs");
+
+        fs::create_dir_all(rootfs.join("opt/openshell/bin")).expect("create openshell bin");
+        fs::write(
+            rootfs.join("opt/openshell/bin/openshell-sandbox"),
+            b"sandbox",
+        )
+        .expect("write openshell-sandbox");
+        fs::create_dir_all(rootfs.join("sandbox")).expect("create sandbox workdir");
+        fs::write(rootfs.join("sandbox/app.py"), "print('hello')\n").expect("write app");
+
+        prepare_sandbox_rootfs(&rootfs).expect("prepare sandbox rootfs");
+
+        assert_eq!(
+            fs::read_to_string(rootfs.join("sandbox/app.py")).expect("read app"),
+            "print('hello')\n"
+        );
+
+        let _ = fs::remove_dir_all(&dir);
+    }
+
     #[cfg(unix)]
     #[test]
     fn create_rootfs_archive_preserves_broken_symlinks() {

examples/bring-your-own-container/Dockerfile

@@ -20,8 +20,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 RUN groupadd -g 1000660000 sandbox && \
     useradd -m -u 1000660000 -g sandbox sandbox
 
+RUN install -d -o sandbox -g sandbox /sandbox
 WORKDIR /sandbox
-COPY app.py .
+COPY --chown=sandbox:sandbox app.py .
 
 EXPOSE 8080
 

examples/bring-your-own-container/README.md

@@ -62,6 +62,8 @@ key requirements are:
 - **Create a `sandbox` user** (uid/gid 1000660000) for non-root execution.
   Use a high UID (1000000000+) to avoid conflicts with host users when running
   without user namespace remapping.
+- **Make your application workdir writable by `sandbox`**. This example creates
+  `/sandbox` with `sandbox:sandbox` ownership before copying `app.py`.
 - **Install `iproute2`** for full network namespace isolation.
 - **Use a standard Linux base image** — distroless and `FROM scratch`
   images are not supported.