b1d497f3

feat: trust nono CA cert inside sandbox

a73x 2026-03-29 16:42

Commit message

feat: trust nono CA cert inside sandbox

Bind-mount ca.pem and set SSL_CERT_FILE + NODE_EXTRA_CA_CERTS
so tools inside the sandbox trust the MITM proxy's CA.

nono

Old		New
@@ -18,6 +18,16 @@ if [[ "${1:-}" == "allow" ]]; then
18	exit	18	exit
19	fi	19	fi
20		20
		21	if [[ "${1:-}" == "clean" ]]; then
		22	if [[ ! -d "$SESSION_DIR" ]]; then
		23	echo "no overlay session for $(basename "$BASE")"
		24	exit 0
		25	fi
		26	rm -rf "$SESSION_DIR"
		27	echo "cleaned overlay for $(basename "$BASE")"
		28	exit
		29	fi
		30
21	if [[ "${1:-}" == "merge" ]]; then	31	if [[ "${1:-}" == "merge" ]]; then
22	if [[ ! -d "$UPPER" ]]; then	32	if [[ ! -d "$UPPER" ]]; then
23	echo "no overlay session for $(basename "$BASE")" >&2	33	echo "no overlay session for $(basename "$BASE")" >&2
@@ -29,6 +39,7 @@ if [[ "${1:-}" == "merge" ]]; then
29	exit 0	39	exit 0
30	fi	40	fi
31	echo "$patch" \| git apply	41	echo "$patch" \| git apply
		42	rm -rf "$SESSION_DIR"
32	echo "merged overlay changes into $BASE"	43	echo "merged overlay changes into $BASE"
33	exit	44	exit
34	fi	45	fi
@@ -57,6 +68,16 @@ else
57	echo "warning: nono-proxy not running on port $PROXY_PORT, no network filtering" >&2	68	echo "warning: nono-proxy not running on port $PROXY_PORT, no network filtering" >&2
58	fi	69	fi
59		70
		71	# CA cert for MITM (set if ca.pem exists)
		72	CA_CERT="$STORE/ca.pem"
		73	if [[ -f "$CA_CERT" ]]; then
		74	args+=(
		75	--ro-bind "$CA_CERT" "$CA_CERT"
		76	--setenv SSL_CERT_FILE "$CA_CERT"
		77	--setenv NODE_EXTRA_CA_CERTS "$CA_CERT"
		78	)
		79	fi
		80
60	args+=(	81	args+=(
61	)	82	)
62		83