fix(deps): update ghcr.io/codize-dev/nsjail:latest docker digest to 8f6ea51

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
ghcr.io/codize-dev/nsjail	stage	digest	d38c6f4 → 8f6ea51

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

This PR updates the ghcr.io/codize-dev/nsjail Docker base image from digest d38c6f4 to 8f6ea51, built on July 28, 2026 from commit be108b1. The new image incorporates the latest upstream changes from Google's nsjail master branch.

Key Changes Included:

1. statx Syscall Tracing (PR #291, Jul 27, 2026)

   • Adds statx to the seccomp user-notify traced-syscall table
   • Improves observability for modern glibc/coreutils operations (ls, stat) that call statx before falling back to newfstatat/openat
   • Pure monitoring enhancement - does not change sandbox behavior

2. Core Scheduling Support (PR #271, Jun 18, 2026)

   • Introduces optional --use_core_scheduling flag for SMT-level isolation via PR_SCHED_CORE
   • Requires Linux kernel ≥5.14
   • Not used by this codebase - purely additive feature

3. Previous Security & Bug Fixes

   • May 7, 2026: Fixed critical bugs in seccomp notification poll loop
   • April 2-3, 2026: C++20 migration with networking hardening (mandatory UDP checksums, SSRF prevention, integer overflow protections)
   • Multiple minor fixes for unotify and command-line argument handling

Breaking Changes: None

Security Fixes: Yes - poll loop fixes, networking hardening, general stability improvements

🎯 Impact Scope Investigation

Usage Location Analysis:

• The nsjail Docker image is used as the base image in the four-stage Dockerfile (line 15)
• nsjail is invoked via internal/sandbox/execution.go with configuration from internal/sandbox/configs/nsjail.cfg
• Configuration analysis shows we use a static config file approach with CLI flags for per-invocation settings

Configuration Impact:

• ✅ We do NOT use --use_core_scheduling (new optional feature)
• ✅ Our seccomp policy (configs/seccomp.kafel) is independent and unchanged
• ✅ Our nsjail config (configs/nsjail.cfg) requires no modifications
• ✅ The statx tracing enhancement only affects internal nsjail logging/monitoring, not sandbox behavior

Dependency Impact:

• Based on debian:bookworm-slim (unchanged)
• Multi-architecture support maintained (amd64, arm64)
• No changes to runtime dependencies or language toolchain requirements

CI Test Results:

• ✅ Build: PASSED
• ✅ Unit Test: PASSED
• ✅ E2E Test (ubuntu-latest/amd64): PASSED
• ✅ E2E Test (ubuntu-24.04-arm): PASSED
• ✅ Lint: PASSED
• ✅ hadolint: PASSED
• ✅ Socket Security: PASSED

All comprehensive E2E tests passed on both architectures, confirming backward compatibility across all supported runtimes (Node.js, TypeScript, Ruby, Go, Python, Rust, Bash).

💡 Recommended Actions

Immediate Actions:

• ✅ Merge approved - This is a safe, backward-compatible update
• No code changes required
• No configuration updates needed

Post-Merge Verification:

• Monitor production sandbox executions for any unexpected behavior (standard practice)
• No specific migration or rollback plan needed due to backward compatibility

Optional Future Enhancements:

• Consider evaluating --use_core_scheduling flag for enhanced SMT isolation if running on kernels ≥5.14 and multi-tenant security requirements increase
• This would require adding the flag to internal/sandbox/execution.go:buildArgs() but is not necessary at this time

🔗 Reference Links

• nsjail Repository (codize-dev fork)
• Google nsjail Repository (upstream)
• PR #291: statx syscall tracing
• PR #271: Core scheduling support
• Docker Image Registry

Generated by koki-develop/claude-renovate-review