Documentation
¶
Overview ¶
Package firejail is a Linux-only sandbox provider that wraps the firejail binary. firejail is an SUID-root namespace sandbox that applies seccomp filters, capability drops, and a private filesystem layout via predefined or custom profiles.
Configuration is taken from cwtypes.SandboxSpec.Config:
profile string — named firejail profile (e.g. "default", "claude").
Empty = no --profile flag (firejail's auto-detect).
netns string — interface for --netns (network namespace);
empty disables the flag. Mutually exclusive
with `nonet`.
nonet bool — pass --nonet (no network at all).
private bool — pass --private (private home temporary dir).
noroot bool — pass --noroot (deny gaining privileges).
whitelist []string — extra --whitelist paths.
blacklist []string — extra --blacklist paths.
caps_drop bool — pass --caps.drop=all.
seccomp bool — pass --seccomp.
Linux-only: New returns ErrUnsupportedPlatform on other GOOS values. `firejail` must be present on PATH at New() time; otherwise ErrFirejailNotFound is returned.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( ErrUnsupportedPlatform = errors.New("firejail: unsupported platform (Linux only)") ErrFirejailNotFound = errors.New("firejail: firejail binary not found in PATH") )
Functions ¶
This section is empty.
Types ¶
type Options ¶
type Options struct {
// FirejailPath overrides the auto-detected firejail path. Empty =
// look up via exec.LookPath at New() time.
FirejailPath string
}
Options configures a firejail.Provider.
type Provider ¶
type Provider struct {
// contains filtered or unexported fields
}
Provider implements sandbox.Provider via firejail.
func New ¶
New constructs a Provider. Returns ErrUnsupportedPlatform on non-Linux, ErrFirejailNotFound if firejail cannot be located on PATH.
func (*Provider) Prepare ¶
func (p *Provider) Prepare(ctx context.Context, spec cwtypes.SandboxSpec, scripts []sandbox.Script) (sandbox.Instance, error)
Prepare returns an Instance that will exec firejail on first Instance.Exec. scripts is presently ignored — firejail composes via argv + profile files, not by writing entrypoints into a directory.
Source Files