Landlock denies reads on bind mounts on Docker Desktop for Mac with VirtioFS file sharing #4733

User Story

I use OpenShell on macOS (Docker Desktop, Docker compute driver) to run coding agents in sandboxes, and I bind-mount a host repository into /workspace/<repo> with --driver-config-json docker.mounts.
After a Docker Desktop update, every agent in the sandbox gets Permission denied when it reads any file or directory in that mount.
Because of this, the agents can't read the repository they're supposed to work on.

Problem Statement

On Docker Desktop for Mac with the VirtioFS file sharing implementation, processes started by openshell sandbox exec get EACCES when they open files or list directories inside a Docker-driver bind mount under the image WORKDIR. stat and chdir on the same paths still succeed.

The policy grants this access in two ways: filesystem_policy.include_workdir: true covers it, and adding the mount target explicitly to read_write still returns EACCES.

The same files are readable from the same container with docker exec -u 1000 (same uid, no OpenShell ruleset). Files from the image under /workspace (overlayfs) are readable from the sandbox. Switching Docker Desktop to gRPC FUSE and recreating the sandbox makes the mount readable.

Impact / Why This Matters

When this happens, the sandbox reports Ready and the policy shows as Effective. Neither openshell logs nor the supervisor/agent container logs contain a warning or denial event. Users only find out when the agent fails to read its workspace.

The workaround is to switch Docker Desktop to the gRPC FUSE file sharing implementation (Settings → General → "Choose file sharing implementation"), restart Docker Desktop, and recreate every affected sandbox. VirtioFS is Docker Desktop's default and its recommended, faster option, so users have to choose between the default Docker Desktop configuration and a working OpenShell workspace.

This matters because bind-mounting the working repository is the main way to give a sandboxed agent a workspace that persists on the host. In the default macOS setup it currently fails silently.

Acceptance Criteria

• On Docker Desktop for Mac with VirtioFS, a Docker-driver bind mount under the WORKDIR with include_workdir: true can be read and written from openshell sandbox exec.
• Listing a directory explicitly allowed in filesystem_policy.read_write that lives on such a mount succeeds.
• If a bind mount can't be made accessible under the applied filesystem policy, OpenShell reports it, for example with a supervisor warning or a failed sandbox / openshell doctor check result, instead of reporting Ready with no message.

Reproduction Steps

1. On macOS, set Docker Desktop → Settings → General → "Choose file sharing implementation" to VirtioFS and restart Docker Desktop.

2. Enable bind mounts in the gateway config for the Docker driver.

3. Create policy.yaml:

   version: 1
   filesystem_policy:
     include_workdir: true
     read_only: [/bin, /usr, /lib, /proc, /dev/urandom, /etc, /var/log]
     read_write: [/tmp, /dev/null]
   landlock:
     compatibility: best_effort

4. Create a sandbox from an image with WORKDIR /workspace that includes python3, and bind-mount a host directory:

   openshell sandbox create --name repro --from <image> --policy policy.yaml \
     --driver-config-json '{"docker":{"mounts":[{"type":"bind","source":"/Users/me/src/some-repo","target":"/workspace/some-repo","read_only":false}]}}' \
     --detach

5. Run:

   openshell sandbox exec repro --workdir /workspace -- python3 -c '
   import os; t="/workspace/some-repo"
   for f in (lambda: os.stat(t), lambda: os.listdir(t)):
       try: f(); print("ok")
       except OSError as e: print("errno", e.errno, e.strerror)'

   Actual: ok then errno 13 Permission denied. Expected: ok twice.

6. Switch Docker Desktop to gRPC FUSE, restart it, recreate the sandbox, and repeat step 5. It prints ok twice.

Suggested UX (if applicable)

No response

Environment

• OpenShell: 0.1.4 (CLI and gateway)
• OS: macOS 26.7.1 (25G241), Apple silicon
• OpenShell deployment mode and runtime: local gateway (Homebrew), Docker compute driver with bind mounts enabled
• Docker Desktop: 4.96.0 (243774), Engine 29.9.1, file sharing: VirtioFS
• Docker Desktop VM kernel: 7.0.14-linuxkit (aarch64), Landlock ABI 8 (OpenShell applies ABI V3, best_effort)
• Sandbox image: Debian trixie-slim based, WORKDIR /workspace, workload runs as uid 1000

Logs