fix(devops): Cloud Agent Docker socket diagnostics and optional verify (#288) #421

Merged

PlasticDigits merged 1 commit from cursor/cloud-agent-docker-perms-288-6d29 into main 2026-06-03 14:29:01 +00:00

Conversation 10 Commits 1 Files changed 11 +379 -32

PlasticDigits commented 2026-06-03 14:06:53 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Summary

Fixes GitLab #288 — Cloud Agents hitting opaque permission denied on /var/run/docker.sock when running stack/QA scripts.

What changed:

• Added scripts/lib/docker_cloud_agent.sh — diagnosis, permission-denied vs overlay classification, /tmp/yieldomega-docker-unavailable marker, native Postgres hint.
• Added scripts/verify-docker-cloud-agent.sh — PASS (0) / SKIP (2) / FAIL (1 with YIELDOMEGA_DOCKER_REQUIRED=1).
• Extended scripts/bootstrap-cloud-vm-toolchain.sh — verify as $USER, socket perms, marker on failure.
• scripts/verify-cloud-vm-toolchain.sh — native Postgres verify (#287, from main) + Docker PASS/SKIP/FAIL (#288).
• scripts/start-local-anvil-stack.sh — actionable hints before dying on Docker.
• Docs + .cursor/environment.json (postgres bootstrap + post-bootstrap verify).

Rebased onto main after !418 / !420 merged — conflicts resolved in guardrails, AGENTS.md, bootstrap/verify scripts, environment.json.

Issue #288 remains open until this MR merges.

Acceptance checklist

Criterion	Command / step	Result
Bootstrap verifies Docker as $USER or writes marker + native Postgres hint	bash scripts/bootstrap-cloud-vm-toolchain.sh	PASS
docker info + hello-world without sudo or explicit SKIP	bash scripts/verify-docker-cloud-agent.sh	PASS (exit 0)
Strict mode when Docker required	YIELDOMEGA_DOCKER_REQUIRED=1 bash scripts/verify-docker-cloud-agent.sh	PASS (exit 0 on this VM; exit 1 when socket blocked)
Toolchain: Postgres (#287) + optional Docker (#288)	bash scripts/verify-cloud-vm-toolchain.sh	PASS (exit 0)
AGENTS.md troubleshooting + checklist rows	doc review	PASS
Lib unit smoke	bash scripts/test-docker-cloud-agent-lib.sh	PASS
Simulated Docker-unavailable hints	bash scripts/test-docker-cloud-agent-lib.sh	PASS

Third-party verification

git fetch origin cursor/cloud-agent-docker-perms-288-6d29
git checkout cursor/cloud-agent-docker-perms-288-6d29

bash scripts/test-docker-cloud-agent-lib.sh
bash scripts/verify-docker-cloud-agent.sh
bash scripts/verify-cloud-vm-toolchain.sh
YIELDOMEGA_DOCKER_REQUIRED=1 bash scripts/verify-docker-cloud-agent.sh

See AGENTS.md § Docker troubleshooting (#288) and INV-DEVOPS-288-* in invariants.

## Summary Fixes GitLab #288 — Cloud Agents hitting opaque `permission denied` on `/var/run/docker.sock` when running stack/QA scripts. **What changed:** - Added `scripts/lib/docker_cloud_agent.sh` — diagnosis, permission-denied vs overlay classification, `/tmp/yieldomega-docker-unavailable` marker, native Postgres hint. - Added `scripts/verify-docker-cloud-agent.sh` — **PASS** (0) / **SKIP** (2) / **FAIL** (1 with `YIELDOMEGA_DOCKER_REQUIRED=1`). - Extended `scripts/bootstrap-cloud-vm-toolchain.sh` — verify as `$USER`, socket perms, marker on failure. - `scripts/verify-cloud-vm-toolchain.sh` — native Postgres verify (#287, from `main`) + Docker PASS/SKIP/FAIL (#288). - `scripts/start-local-anvil-stack.sh` — actionable hints before dying on Docker. - Docs + `.cursor/environment.json` (postgres bootstrap + post-bootstrap verify). Rebased onto `main` after **!418** / **!420** merged — conflicts resolved in guardrails, `AGENTS.md`, bootstrap/verify scripts, `environment.json`. Issue #288 remains **open** until this MR merges. ## Acceptance checklist | Criterion | Command / step | Result | |-----------|----------------|--------| | Bootstrap verifies Docker as `$USER` or writes marker + native Postgres hint | `bash scripts/bootstrap-cloud-vm-toolchain.sh` | **PASS** | | `docker info` + `hello-world` without sudo **or** explicit SKIP | `bash scripts/verify-docker-cloud-agent.sh` | **PASS** (exit 0) | | Strict mode when Docker required | `YIELDOMEGA_DOCKER_REQUIRED=1 bash scripts/verify-docker-cloud-agent.sh` | **PASS** (exit 0 on this VM; exit 1 when socket blocked) | | Toolchain: Postgres (#287) + optional Docker (#288) | `bash scripts/verify-cloud-vm-toolchain.sh` | **PASS** (exit 0) | | AGENTS.md troubleshooting + checklist rows | doc review | **PASS** | | Lib unit smoke | `bash scripts/test-docker-cloud-agent-lib.sh` | **PASS** | | Simulated Docker-unavailable hints | `bash scripts/test-docker-cloud-agent-lib.sh` | **PASS** | ## Third-party verification ```bash git fetch origin cursor/cloud-agent-docker-perms-288-6d29 git checkout cursor/cloud-agent-docker-perms-288-6d29 bash scripts/test-docker-cloud-agent-lib.sh bash scripts/verify-docker-cloud-agent.sh bash scripts/verify-cloud-vm-toolchain.sh YIELDOMEGA_DOCKER_REQUIRED=1 bash scripts/verify-docker-cloud-agent.sh ``` See AGENTS.md § Docker troubleshooting (#288) and **INV-DEVOPS-288-*** in invariants.

PlasticDigits commented 2026-06-03 14:07:02 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

ghost1 commented 2026-06-03 14:11:21 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review (automated)

Commit reviewed: e696a74855ef01bbbfc02dee00703bd06ef35e5f
Scope: Cloud Agent Docker socket diagnostics (scripts/lib/docker_cloud_agent.sh, verify-docker-cloud-agent.sh), bootstrap/toolchain verify SKIP semantics, start-local-anvil-stack.sh hints, AGENTS.md / invariants / .cursor/environment.json docs.

Outcome: FINDINGS: 0 (no medium, high, or critical issues on this diff)

Inline threads: none

Summary

Reviewed added/modified bash and docs only (no application runtime, indexer API, contracts, or frontend attack surface). Traced env/file paths and failure modes:

• chmod 666 on /var/run/docker.sock — pre-existing Cloud Agent dev-VM remediation (refactored into yieldomega_fix_docker_socket_permissions); acceptable in documented single-tenant ephemeral agent context; not a new production exposure.
• /tmp/yieldomega-docker-unavailable marker — local state for SKIP; no auth boundary or remote input; symlink races require same-VM local attacker (out of scope for this devops change).
• yieldomega_docker_print_diagnosis — prints docker info / hello-world stderr to the agent log; no secret env vars or tokens in code paths; dev VM diagnostics only.
• Docker optional (exit 2 SKIP) — does not weaken start-local-anvil-stack (still hard-fails without Docker); strict gate remains YIELDOMEGA_DOCKER_REQUIRED=1.

Security review: no medium+ findings on this diff.

## Security review (automated) **Commit reviewed:** `e696a74855ef01bbbfc02dee00703bd06ef35e5f` **Scope:** Cloud Agent Docker socket diagnostics (`scripts/lib/docker_cloud_agent.sh`, `verify-docker-cloud-agent.sh`), bootstrap/toolchain verify SKIP semantics, `start-local-anvil-stack.sh` hints, AGENTS.md / invariants / `.cursor/environment.json` docs. **Outcome:** `FINDINGS: 0` (no medium, high, or critical issues on this diff) **Inline threads:** none ### Summary Reviewed added/modified bash and docs only (no application runtime, indexer API, contracts, or frontend attack surface). Traced env/file paths and failure modes: - **`chmod 666` on `/var/run/docker.sock`** — pre-existing Cloud Agent dev-VM remediation (refactored into `yieldomega_fix_docker_socket_permissions`); acceptable in documented single-tenant ephemeral agent context; not a new production exposure. - **`/tmp/yieldomega-docker-unavailable` marker** — local state for SKIP; no auth boundary or remote input; symlink races require same-VM local attacker (out of scope for this devops change). - **`yieldomega_docker_print_diagnosis`** — prints `docker info` / `hello-world` stderr to the agent log; no secret env vars or tokens in code paths; dev VM diagnostics only. - **Docker optional (exit 2 SKIP)** — does not weaken `start-local-anvil-stack` (still hard-fails without Docker); strict gate remains `YIELDOMEGA_DOCKER_REQUIRED=1`. Security review: **no medium+ findings** on this diff.

PlasticDigits commented 2026-06-03 14:15:39 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

ghost1 commented 2026-06-03 14:15:41 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

added 7 commits

• e696a748...0b2cbc02 - 6 commits from branch main
• 134128aa - fix(devops): Cloud Agent Docker socket diagnostics and optional verify (#288)

Compare with previous version

added 7 commits <ul><li>e696a748...0b2cbc02 - 6 commits from branch <code>main</code></li><li>134128aa - fix(devops): Cloud Agent Docker socket diagnostics and optional verify (#288)</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/51/diffs?diff_id=1832579377&start_sha=e696a74855ef01bbbfc02dee00703bd06ef35e5f)

PlasticDigits commented 2026-06-03 14:24:38 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

ghost1 commented 2026-06-03 14:24:40 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

added 5 commits

• 134128aa...c6820b64 - 4 commits from branch main
• 8f6a936f - fix(devops): Cloud Agent Docker socket diagnostics and optional verify (#288)

Compare with previous version

added 5 commits <ul><li>134128aa...c6820b64 - 4 commits from branch <code>main</code></li><li>8f6a936f - fix(devops): Cloud Agent Docker socket diagnostics and optional verify (#288)</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/51/diffs?diff_id=1832605711&start_sha=134128aa7e53840b5b636f7274cee75917f0bdc0)

PlasticDigits commented 2026-06-03 14:29:01 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit d9b1ed959c

mentioned in commit d9b1ed959c15b0567bcfac551e6edfcd4883068f

PlasticDigits (Migrated from gitlab.com) merged commit d9b1ed959c into main 2026-06-03 14:29:01 +00:00

ghost1 commented 2026-06-03 14:29:53 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review (automated)

Commit reviewed: 8f6a936faabb34155e090f3025690665e05a2349
Scope: MR !421 vs main (11 files) — scripts/lib/docker_cloud_agent.sh, verify-docker-cloud-agent.sh, test-docker-cloud-agent-lib.sh, bootstrap-cloud-vm-toolchain.sh, verify-cloud-vm-toolchain.sh, start-local-anvil-stack.sh, AGENTS.md / invariants / .cursor/environment.json.

Outcome: FINDINGS: 0 (no medium, high, or critical issues on this diff)

Inline threads: none

Re-review (MR update)

Re-reviewed after the latest push (rebased onto main per MR description). Prior automated review on e696a748 reached the same conclusion; this pass re-traced the current diff with no new medium+ issues.

Summary

• Attack surface: bash devops helpers and docs only — no indexer HTTP API, contracts, or frontend changes in this diff.
• Input → sink: no remote attacker-controlled input; yieldomega_docker_error_kind classifies fixed Docker CLI stderr patterns; marker reason strings are bootstrap-controlled (daemon_up_* / daemon_down_*).
• yieldomega_fix_docker_socket_permissions: continues documented Cloud Agent remediation (usermod -aG docker, chmod 666 on docker.sock) for ephemeral single-tenant dev VMs — not a production deploy path.
• start-local-anvil-stack.sh: still hard-requires working Docker before Postgres container; only adds diagnostics via yieldomega_docker_stack_failure_hint.
• SKIP semantics (verify-docker-cloud-agent.sh exit 2): does not weaken full-stack gate; YIELDOMEGA_DOCKER_REQUIRED=1 still fails closed.

Security review: no medium+ findings on this diff.

## Security review (automated) **Commit reviewed:** `8f6a936faabb34155e090f3025690665e05a2349` **Scope:** MR !421 vs `main` (11 files) — `scripts/lib/docker_cloud_agent.sh`, `verify-docker-cloud-agent.sh`, `test-docker-cloud-agent-lib.sh`, `bootstrap-cloud-vm-toolchain.sh`, `verify-cloud-vm-toolchain.sh`, `start-local-anvil-stack.sh`, AGENTS.md / invariants / `.cursor/environment.json`. **Outcome:** **FINDINGS: 0** (no medium, high, or critical issues on this diff) **Inline threads:** none ### Re-review (MR update) Re-reviewed after the latest push (rebased onto `main` per MR description). Prior automated review on `e696a748` reached the same conclusion; this pass re-traced the current diff with no new medium+ issues. ### Summary - **Attack surface:** bash devops helpers and docs only — no indexer HTTP API, contracts, or frontend changes in this diff. - **Input → sink:** no remote attacker-controlled input; `yieldomega_docker_error_kind` classifies fixed Docker CLI stderr patterns; marker reason strings are bootstrap-controlled (`daemon_up_*` / `daemon_down_*`). - **`yieldomega_fix_docker_socket_permissions`:** continues documented Cloud Agent remediation (`usermod -aG docker`, `chmod 666` on `docker.sock`) for ephemeral single-tenant dev VMs — not a production deploy path. - **`start-local-anvil-stack.sh`:** still hard-requires working Docker before Postgres container; only adds diagnostics via `yieldomega_docker_stack_failure_hint`. - **SKIP semantics (`verify-docker-cloud-agent.sh` exit 2):** does not weaken full-stack gate; `YIELDOMEGA_DOCKER_REQUIRED=1` still fails closed. Security review: **no medium+ findings on this diff.**

ghost1 commented 2026-06-05 09:30:07 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review (automated)

Commit reviewed: 8f6a936faabb34155e090f3025690665e05a2349
Scope: MR !421 vs main (11 files) — scripts/lib/docker_cloud_agent.sh, verify-docker-cloud-agent.sh, test-docker-cloud-agent-lib.sh, bootstrap-cloud-vm-toolchain.sh, verify-cloud-vm-toolchain.sh, start-local-anvil-stack.sh, AGENTS.md / invariants / .cursor/environment.json.

Outcome: FINDINGS: 0 (no medium, high, or critical issues on this diff)

Inline threads: none

Re-review

Re-read prior automated reviews on this MR (e696a748, 8f6a936); re-traced attacker-controlled input to sinks on the current diff. Conclusion unchanged.

Summary

Area	Assessment
Attack surface	Bash devops helpers + docs only — no indexer HTTP API, contracts, frontend, or onchain changes.
Remote input	None. yieldomega_docker_error_kind classifies fixed Docker CLI stderr patterns; marker reasons are bootstrap-controlled (daemon_up_* / daemon_down_*). All shell expansions quoted.
chmod 666 / usermod -aG docker	Documented Cloud Agent remediation for ephemeral single-tenant dev VMs (refactored from pre-existing fix_docker_socket_permissions); not a production deploy path.
start-local-anvil-stack.sh	Still hard-requires working Docker before Postgres container; only adds yieldomega_docker_stack_failure_hint diagnostics.
SKIP semantics (exit 2)	Does not weaken full-stack gate; YIELDOMEGA_DOCKER_REQUIRED=1 still fails closed.
Diagnostics logging	yieldomega_docker_print_diagnosis emits docker info / hello-world stderr to agent logs — no token/secret env vars in code paths.
Env overrides	YIELDOMEGA_DOCKER_SOCK / YIELDOMEGA_DOCKER_UNAVAILABLE_MARKER are local bootstrap knobs; exploitation requires same-VM env control (out of scope for cross-tenant production threats).

Security review: no medium+ findings on this diff.

## Security review (automated) **Commit reviewed:** `8f6a936faabb34155e090f3025690665e05a2349` **Scope:** MR !421 vs `main` (11 files) — `scripts/lib/docker_cloud_agent.sh`, `verify-docker-cloud-agent.sh`, `test-docker-cloud-agent-lib.sh`, `bootstrap-cloud-vm-toolchain.sh`, `verify-cloud-vm-toolchain.sh`, `start-local-anvil-stack.sh`, AGENTS.md / invariants / `.cursor/environment.json`. **Outcome:** **FINDINGS: 0** (no medium, high, or critical issues on this diff) **Inline threads:** none ### Re-review Re-read prior automated reviews on this MR (`e696a748`, `8f6a936`); re-traced attacker-controlled input to sinks on the current diff. Conclusion unchanged. ### Summary | Area | Assessment | |------|------------| | **Attack surface** | Bash devops helpers + docs only — no indexer HTTP API, contracts, frontend, or onchain changes. | | **Remote input** | None. `yieldomega_docker_error_kind` classifies fixed Docker CLI stderr patterns; marker reasons are bootstrap-controlled (`daemon_up_*` / `daemon_down_*`). All shell expansions quoted. | | **`chmod 666` / `usermod -aG docker`** | Documented Cloud Agent remediation for ephemeral single-tenant dev VMs (refactored from pre-existing `fix_docker_socket_permissions`); not a production deploy path. | | **`start-local-anvil-stack.sh`** | Still hard-requires working Docker before Postgres container; only adds `yieldomega_docker_stack_failure_hint` diagnostics. | | **SKIP semantics (exit 2)** | Does not weaken full-stack gate; `YIELDOMEGA_DOCKER_REQUIRED=1` still fails closed. | | **Diagnostics logging** | `yieldomega_docker_print_diagnosis` emits `docker info` / `hello-world` stderr to agent logs — no token/secret env vars in code paths. | | **Env overrides** | `YIELDOMEGA_DOCKER_SOCK` / `YIELDOMEGA_DOCKER_UNAVAILABLE_MARKER` are local bootstrap knobs; exploitation requires same-VM env control (out of scope for cross-tenant production threats). | Security review: **no medium+ findings on this diff.**

PlasticDigits commented 2026-06-08 08:45:13 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit 7698e97f5a

mentioned in commit 7698e97f5aa16dda2598c34633df48542a29cdeb

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:open_issues

  

agents

  

agent:security_audit

  

agent:verify

  

area

timecurve

  

arena

  

arena-v2

  

audit

  

block:feature_review

  

block:security

  

bug

  

contracts

  

design

  

devops

  

docs

Documentation

  

documentation

  

enhancement

  

epic

Epic / umbrella issue

  

feature

  

frontend

  

indexer

  

low priority

Low priority, investigate other issues first

  

megaeth

  

operations

  

ops

Deploy and operations

  

performance

  

QA

  

qa checklist

  

referrals

  

removal

Legacy removal

  

security

  

smart-contracts

  

tech-debt

  

testing

  

time-arena

TimeArena v2 revamp

  

timecurve

  

visual-qa

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:open_issues

agents

agent:security_audit

agent:verify

area

timecurve

arena

arena-v2

audit

block:feature_review

block:security

bug

contracts

design

devops

docs

documentation

enhancement

epic

feature

frontend

indexer

low priority

megaeth

operations

ops

performance

QA

qa checklist

referrals

removal

security

smart-contracts

tech-debt

testing

time-arena

timecurve

visual-qa

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!421

No description provided.