Unverified50% confidenceDecision RuleExact time
HarnessRouter adopts a per-session user isolation strategy; the Runner dynamically allocates a separate Linux user for each Agent session, so the entry script and the Runner require root privileges, and passing the --user parameter is officially prohibited.
1
Sources
50%
Confidence
Long-term
Relevance
10/14/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedOpenController is deployed within the user's own cluster, running under the user's own keys, with data and control remaining inside the enterprise61% similarUnverifiedA self-hosted runner is a build machine maintained by the team itself, which can be a physical server, a cloud virtual machine, or a Kubernetes Pod, and is integrated into the scheduling system by installing the GitHub Actions runner program.60% similarUnverifiedDesktop agents run directly at the user's operating system level, capable of manipulating local files and applications without relying on a remote server's sandbox60% similarUnverifiedA decoupled authorization server can carry both 'user context' and 'agent context' in a token, laying the foundation for fine-grained permission control.59% similarUnverifiedCloudroom Core runs each agent as an independent Linux user without granting administrator privileges, thereby achieving isolation between agents59% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1025586API
curl https://kongchang.com/api/v1/knowledge/claims/1025586MCP
get_claim(id=1025586)