Allow the rootless Actions sandbox to create its user namespace

Hop-State: A_06FN8AEE7ENMDW78P3QPJH8
Hop-Proposal: R_06FN8ACPJSGJ9ZES912WFM0
Hop-Task: T_06FN8A73118NFBJ01HP2N10
Hop-Attempt: AT_06FN8A7313S1B4JW6QKCF10

.hop/records/prompts/P_06FN8A73112CW4CWQWAM4N8.json

@@ -0,0 +1,17 @@
+{
+  "id": "P_06FN8A73112CW4CWQWAM4N8",
+  "task_id": "T_06FN8A73118NFBJ01HP2N10",
+  "attempt_id": "AT_06FN8A7313S1B4JW6QKCF10",
+  "state_id": "P_06FN8A73112CW4CWQWAM4N8",
+  "prompt": "lets just leave it named as actions, and i think we need to let anyone use it if we are going to try and attract users.",
+  "agent_name": "codex",
+  "status": "proposed",
+  "response_summary": "Allow the rootless Actions sandbox to create its user namespace",
+  "created_at": "2026-07-12T02:29:53.544855Z",
+  "metadata": {
+    "source_tree": "70d964f480b8b231e1138a1b7a1ff65ba3b6c926",
+    "git_commit": "0d7e685b323c7931e529539512d11057ad44bdd1",
+    "attempt_head": "C_06FN8AB7NGKHHR0KH1TZD18",
+    "attempt_head_kind": "checkpoint"
+  }
+}

compose.yaml

@@ -61,7 +61,8 @@ services:
     mem_limit: 4g
     pids_limit: 1024
     security_opt:
-      - no-new-privileges:true
+      - seccomp:unconfined
+      - apparmor:unconfined
     volumes:
       - actions-runner-data:/data
     networks: [hopweb]