[ANAMASGARD]

What type of PR is this?

/kind bug

What this PR does / why we need it:

PicoD currently passes its complete process environment to executed commands, potentially exposing unrelated container configuration and credentials.

This change:

• Inherits only 14 explicitly named shell, locale, and Python settings.
• Always assigns a non-nil command environment, including when request env is omitted, null, or empty.
• Applies explicit request overrides afterward, preserving empty values without modifying PicoD’s environment.
• Preserves existing executable lookup and adds authenticated handler regressions, supported-image HTTP checks, and compatibility documentation.

Authentication, SDK interfaces, Kubernetes resources, and dependencies remain unchanged.

Which issue(s) this PR fixes:

Fixes #183

Related to #488. This PR does not resolve or close #488.

Special notes for your reviewer:

This change reduces automatic environment inheritance. It does not provide execution-specific authorization, credential expiration, revocation, or isolation between commands sharing a sandbox. Shared files, other processes, and Linux /proc remain outside its protection. The supported-image check confirmed that a dummy startup credential remains readable through the parent’s /proc environment.

Custom runtimes may require configuration changes. Passing the Python checks establishes compatibility with the tested configurations, not every existing runtime. Current Python SDK execution methods do not expose env=; the documentation includes an authenticated raw-HTTP example for supplying explicit variables.

Validation completed:

• New credential-filtering assertions fail against the unchanged handler and pass with this change.
• PicoD race tests, three shuffled regression runs, package coverage, formatting, vet, Go lint, Python lint, and the static build pass.
• Images built from the repository Dockerfile were tested through authenticated HTTP using rootless Podman and Python 3.14.4. Checks cover imports, valid PYTHONHOME, Unicode, Python settings, subprocess lookup, concurrent requests, and request overrides.
• Container checks exercise PicoD with a simulated Router signer; they do not constitute a full Kubernetes deployment test.

AI tools assisted with implementation, tests, documentation, and PR preparation. The changes were reviewed and tested locally.

Does this PR introduce a user-facing change?:

Yes.

PicoD commands now inherit only the documented allowlist of shell, locale, and Python environment settings. Previously, all container environment variables were inherited.

Other variables, including HTTPS_PROXY, SSL_CERT_FILE, REQUESTS_CA_BUNDLE, and TMPDIR, must be supplied explicitly in the execution request. Explicit request values continue to override inherited settings.

Custom runtimes relying on previously inherited variables may require changes. Current Python SDK execution methods do not expose env=; use the documented raw-HTTP request when explicit variables are required.

[volcano-sh-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign acsoto for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• docs/OWNERS
• pkg/picod/OWNERS
• sdk-python/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

[volcano-sh-bot]

Welcome @ANAMASGARD! It looks like this is your first PR to volcano-sh/agentcube 🎉

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.61%. Comparing base (f521ae9) to head (0372eea).
⚠️ Report is 25 commits behind head on main.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #501      +/-   ##
==========================================
+ Coverage   60.45%   62.61%   +2.15%     
==========================================
  Files          35       35              
  Lines        3616     3667      +51     
==========================================
+ Hits         2186     2296     +110     
+ Misses       1211     1146      -65     
- Partials      219      225       +6     

Flag	Coverage Δ
unittests	62.61% <100.00%> (+2.15%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.