Pass through CA certs, caches, home dirs; document dash run -- <cmd> #2

Merged

mathieu merged 1 commit from lain/dash-run-passthrough-sandbox-20261102084037 into main

2026-11-02 08:09:32 +00:00

Lain commented

2026-11-02 07:50:18 +00:00

Collaborator

Adds three features to dash, in one MR:

NODE_EXTRA_CA_CERTS: forwarded when set on the host; the certificate file is mounted read-only at the same path. Missing or relative file fails the run. Disable with pass_node_extra_ca_certs: false.
caches: host cache directories (e.g. ~/.cache/go-build, ~/.npm) mounted read-write at the same path when they exist.
home_dirs: non-cache host state under $HOME (e.g. ~/.cursor) mounted read-write when present. Kept separate from caches on purpose.
dash run -- <cmd>: documented; flags after -- reach the command; an empty command after -- is rejected.

Missing paths are skipped so one config works on every machine. Relative paths in caches/home_dirs are an error.

Tests: unit tests for each feature in internal/sandbox and internal/cli; gofmt, go vet ./..., go vet -tags e2e ./e2e/ and go test ./... pass. Dry-run output checked for the mount/env cases. The e2e suite was not run here (no built image; limited disk on this host).

Adds three features to dash, in one MR: - **NODE_EXTRA_CA_CERTS**: forwarded when set on the host; the certificate file is mounted read-only at the same path. Missing or relative file fails the run. Disable with `pass_node_extra_ca_certs: false`. - **caches**: host cache directories (e.g. `~/.cache/go-build`, `~/.npm`) mounted read-write at the same path when they exist. - **home_dirs**: non-cache host state under `$HOME` (e.g. `~/.cursor`) mounted read-write when present. Kept separate from `caches` on purpose. - **`dash run -- <cmd>`**: documented; flags after `--` reach the command; an empty command after `--` is rejected. Missing paths are skipped so one config works on every machine. Relative paths in `caches`/`home_dirs` are an error. Tests: unit tests for each feature in `internal/sandbox` and `internal/cli`; `gofmt`, `go vet ./...`, `go vet -tags e2e ./e2e/` and `go test ./...` pass. Dry-run output checked for the mount/env cases. The e2e suite was not run here (no built image; limited disk on this host).

Lain added 1 commit

2026-11-02 07:50:18 +00:00

Pass through CA certs, caches, home dirs; document dash run -- <cmd>

ci / test (pull_request) Successful in 1m14s

Details

bf630ad38e

- Forward NODE_EXTRA_CA_CERTS and mount its file read-only (pass_node_extra_ca_certs, default on)
- caches: host cache dirs mounted read-write when present
- home_dirs: non-cache host dirs such as ~/.cursor mounted read-write when present
- dash run -- <cmd> keeps flags after --; an empty command after -- is rejected
- Tests for each feature; README and example config updated