Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

@@ -0,0 +6,4 @@
+
+## Related Links
+
+- [werkator PR#166](https://git.javagil.de/mi/werkator/pulls/166): Werkator passes the values of a build's variables to werkdock through its environment.

@@ -0,0 +20,4 @@
+
+## Non-Goals
+
+- No change of what the sandbox sees: the image's variables, the `-e` values and werkdock's `HOME` and `PATH`, nothing of the caller's environment.

@@ -0,0 +78,4 @@
+
+## Follow-up PRs
+
+- The configuration of a detached instance (`run -d`, the API socket) holds its environment in a file of mode 0644 below `instances/`.

@@ -44,6 +44,13 @@ const DefaultPATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bi
 // as they are in a container without --init. bwrap reports the
 // command's host pid on fd 3 (--info-fd), which Start reads.
 //
+// The environment is cleared here, but set from fd 4 (--args, see

@@ -127,0 +139,4 @@
+	}
+	var args []byte
+	for _, e := range environment(home, spec.Env) {
+		if strings.ContainsRune(e.Key, 0) || strings.ContainsRune(e.Value, 0) {

@@ -0,0 +19,4 @@
+bwrap's argv is the last place where they stand.
+
+A second leak, found on mih09 the same day: each instance, also of an attached `run --rm`,
+writes its configuration with the whole environment to `instances/<id>/config.json`, mode 0644, in a directory of mode 0755.

@@ -109,3 +112,1 @@
-	args = append(args, "--clearenv")
-	for _, e := range environment(home, spec.Env) {
-		args = append(args, "--setenv", e.Key, e.Value)
+	if _, err := EnvArgs(spec); err != nil {

@@ -362,0 +398,4 @@
+	envR.Close()
+	// written while bwrap reads, since the environment may exceed what
+	// a pipe buffers; bwrap reads it before anything else it does
+	go func() {

@@ -362,0 +400,4 @@
+	// a pipe buffers; bwrap reads it up to EOF before anything else it
+	// does, so a sandbox that would get only part of it is killed before
+	// the close could hand it that part
+	go func() {