fix(docker): enforce sandbox container runtime contract

[RaresKeY]

Summary

This focused deployment slice makes the sandbox container boundary explicit and fail-closed for the default, NVIDIA, and AMD Compose variants. It installs and verifies the Bubblewrap/helper runtime expected by the foundation slices, consumes the generated outer seccomp policy supplied by dependency PR #6119, applies the named AppArmor profile without privileged mode, host PID/networking, or an OCI SYS_ADMIN capability, and runs a dropped-user boot self-test before the application starts. The AppArmor profile permits the namespaced Bubblewrap bootstrap required on supported Ubuntu Docker hosts; it does not grant the container a host CAP_SYS_ADMIN fallback.

Target branch

• This PR targets dev, not main. All PRs land in dev; main is curated by the maintainer at each release. If your PR is on main by accident, click "Edit" on this PR and change the base.

Linked Issue

Fixes #6117
Part of #6091
Part of #5815

The corresponding Docker/runtime slice of PR #5818 is the source context; this implementation was independently reworked for the supported container boundary.

Dependencies are the verified open draft PRs below, all still unmerged at their listed heads; this branch does not assume that any dependency is merged. PR #6119 canonically owns and provides docker/seccomp/odysseus-bubblewrap.json; this PR consumes that path and deliberately does not duplicate it.

• PR #6118 — egress foundation, head 55211d94cab1b7ce57dade43200d043bc525035c.
• PR #6119 — seccomp foundation, head b1a97c0eed02759f506da83b3a42fcd948faad24.
• PR #6120 — process-sandbox core, head a1a47d5b2b18e27c33a06403537221554fdbb29f.

Type of Change

• Bug fix (non-breaking — fixes a confirmed issue)
• New feature (non-breaking — adds new behaviour)
• Breaking change (changes or removes existing behaviour)
• Refactor / cleanup (behaviour unchanged)
• Documentation only
• CI / tooling / configuration

Checklist

• I searched open issues and open PRs — this is not a duplicate.
• This PR targets dev
• My changes are limited to the scope described above — no unrelated refactors or whitespace changes mixed in.
• I actually ran the app (docker compose up or uvicorn app:app) and verified the change works end-to-end. Type-checks and unit tests are not enough.
• I did not run the app/runtime validation and stated that gap in How to Test. Leave this unchecked when the app-run box above is checked.

How to Test

1. Run python3 -m pytest -q tests/test_container_runtime.py tests/test_gpu_compose_standalone.py; the standalone dependent branch reports 20 passed and 2 prerequisite-only skips because refactor(seccomp): extract trusted policy substrate #6119's security/seccomp and generated profile are not in dev.
2. In a temporary integrated checkout containing PRs feat(security): add brokered sandbox egress #6118, refactor(seccomp): extract trusted policy substrate #6119, and fix(sandbox): extract common process execution boundary #6120, run python3 security/seccomp/generate.py --check --verify-arches, make -C security/seccomp all, make -C security/egress check, sh -n docker/sandbox-self-test.sh docker/entrypoint.sh, and the integrated regression suite; the generated policy remains owned by refactor(seccomp): extract trusted policy substrate #6119, the helper builds pass, and the focused integrated suite reports 139 passed and 30 skipped.
3. Install docker/apparmor/odysseus-sandbox on a supported Ubuntu Docker host, load it with apparmor_parser -r -W, verify it is enforcing, then run docker compose config for all three Compose variants and docker compose up -d --build; the boot log must contain odysseus-sandbox-self-test: sandbox and broker boundaries passed before the application starts.

The secretless validation runner has no Docker daemon/CLI or AppArmor host tools, so actual image build, Compose resolution/startup, host profile loading, and end-to-end application startup were not run. The integrated full suite reported 5906 passed, 42 skipped, and three runner-environment failures: the review snapshot omits .env.example, the DNS-disabled URL-join test also fails on the pinned dev basis, and the browser smoke test requires navigator/TTS support unavailable in the Node runner. These failures are outside this deployment slice. Because this is a dependent draft, its image/Trivy job cannot succeed against dev until #6119 supplies security/seccomp; the Dockerfile remains fail-closed and must be rebased and rechecked after #6119 lands.

Visual / UI changes — REQUIRED if you touched anything that renders

Anything that changes what the UI looks like — buttons, icons, padding, colors, fonts, spacing, layout, CSS, HTML, SVG, or any static/js/ module that draws to the DOM — needs all of the following. PRs that change rendering without these WILL be closed.

• Screenshot or short clip of the change in the running app, attached below. Mobile screenshot too if the change affects mobile.
• Style match: the change uses Odysseus's existing visual language. Specifically:
  • Reuse existing CSS variables (--red, --fg, --bg, --card, --border, etc.) — do not introduce new color values, font sizes, or spacing units.
  • Reuse existing button/input/card/border classes. Don't invent parallel styling.
  • No Unicode emoji in UI or code. Use inline SVG (matching the monochrome icon style already in static/index.html) or plain text.
  • Monospaced font (Fira Code) for primary UI text. Don't override.
  • Dark theme is the default; any light-mode work must be wired through the existing theme system, not hard-coded.
• No new component patterns. If a similar widget already exists in the app, extend it instead of writing a parallel one.
• I am not an LLM agent submitting a bulk PR. If you are, please open an issue describing the problem first — bulk auto-generated PRs that don't match the project's visual style are closed on sight, even when the underlying fix is correct.

Screenshots / clips

N/A — no UI changes.

[github-actions]

⚠️ PR description is complete; validation evidence is still outstanding

Changed-file classification: backend/runtime.

Author-reported runtime / visual state

• The author explicitly reports that app/runtime validation was not performed.

Checkboxes are author attestations. GitHub Actions results remain the execution evidence for CI; this check does not prove that a local command ran.

---

This comment updates automatically when the description or changed files change.