Documentation
¶
Overview ¶
Hardening layers applied: process-group isolation on Unix, rlimits on Linux, bwrap filesystem/network isolation on Linux, macOS Seatbelt (sandbox-exec) filesystem and network isolation on macOS. Use the docker backend when full container isolation is required.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewFactory ¶
func NewFactory(cfg ...Config) sandboxpkg.Factory
NewFactory returns a Factory for the local backend.
Types ¶
type Config ¶ added in v0.33.0
type Config struct {
// StellaHome is the host path to the stella home directory, used for
// building a sandboxed PATH that includes $STELLA_HOME/bin.
StellaHome string
}
Config configures the local sandbox factory.
type Factory ¶
type Factory struct {
// contains filtered or unexported fields
}
Factory creates local sandbox sessions that run directly on the host OS.
func (*Factory) Available ¶
Available always returns true — the local backend has no external dependencies.
func (*Factory) CreateSession ¶
func (f *Factory) CreateSession(_ context.Context, policy sandboxpkg.Policy) (sandboxpkg.Session, error)
CreateSession creates a new localSession. If a StellaHome was provided via Config, the factory adjusts the policy env with a sandboxed PATH, HOME, and an allowlist of host variables so callers don't need to know about host-execution specifics.
Source Files