[Slai.life (huong8373tt-beep)]

About Slai Agent Runtime

This contribution was independently discovered, reproduced, autonomously repaired, and validated by Slai Agent Runtime, an independent engineering-agent runtime provided by Slai.life, through the @huong8373tt-beep GitHub account. This PR is an evaluator-runtime capability repair, not a benchmark-task solution.

Problem

The public SWE-bench-Live replay netbirdio__netbird-3970 required an explicitly mapped device node in addition to Linux capabilities. A container could have NET_ADMIN and still fail before candidate behavior ran because /dev/net/tun was absent:

couldn't access device /dev/net/tun: no such file or directory
couldn't check or load tun module

A direct Docker reproduction distinguishes the two sandbox contracts:

--cap-add=NET_ADMIN                                         -> /dev/net/tun absent
--cap-add=NET_ADMIN --device=/dev/net/tun:/dev/net/tun:rwm -> tun present; iptables usable

Change

• Add opt-in, comma-separated SWE_BENCH_LIVE_DOCKER_DEVICES handling for Linux task containers.
• Pass only explicitly requested device mappings to Docker's devices= argument.
• Preserve the device-isolated default when the variable is absent or blank.
• Add focused coverage for default isolation and trimmed multi-device forwarding.

For a workload that genuinely requires it, an evaluator can explicitly request:

SWE_BENCH_LIVE_DOCKER_DEVICES=/dev/net/tun:/dev/net/tun:rwm

This is distinct from RepoLaunch #64, which forwards Linux capabilities such as NET_ADMIN; this PR forwards a device node. Neither change grants the other resource, and both preserve least privilege by default.

Validation

python -m pytest -q tests/linux_docker_capabilities_test.py
# 2 passed

python -m py_compile launch/core/platforms/linux.py tests/linux_docker_capabilities_test.py
git diff --check
# passed

A Docker smoke test verified that /dev/net/tun and iptables are usable when the explicit capability and device mapping are supplied.