From b7f0ae95a99f151f140e33b80bde9f4764cdfff8 Mon Sep 17 00:00:00 2001
From: Xubin Ren <52506698+Re-bin@users.noreply.github.com>
Date: Wed, 12 Aug 2026 22:22:46 +0900
Subject: [PATCH] test(docker): run bwrap check as final user

Co-authored-by: yu-xin-c <175149126+yu-xin-c@users.noreply.github.com>
---
 .github/workflows/ci.yml | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b02efa9d8..3b294950a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -214,12 +214,18 @@ jobs:
           INNER
           OUTER
           docker compose -f docker-compose.yml -f docker-compose.bwrap.yml \
-            run --rm --no-deps -T --entrypoint sh nanobot-cli -s <<'BWRAP'
+            run --rm --no-deps -T --user nanobot --entrypoint sh nanobot-cli -s <<'BWRAP'
           set -eu
+          field() {
+            awk -v key="$1:" '$1 == key { print $2 }' /proc/self/status
+          }
+          test "$(id -u)" = "1000"
+          test "$(field NoNewPrivs)" = "1"
+          for capability_set in CapInh CapPrm CapEff CapAmb; do
+            test "$(field "$capability_set")" = "0000000000000000"
+          done
           mkdir -p /home/nanobot/.nanobot/workspace
-          chown -R nanobot:nanobot /home/nanobot/.nanobot
-          setpriv --reuid=nanobot --regid=nanobot --init-groups \
-            bwrap --new-session --die-with-parent \
+          bwrap --new-session --die-with-parent \
             --ro-bind /usr /usr \
             --ro-bind-try /bin /bin \
             --ro-bind-try /lib /lib \