Documentation
¶
Overview ¶
Hardening layers applied: process-group isolation on Unix, rlimits on Linux, bwrap filesystem/network isolation on Linux, macOS Seatbelt (sandbox-exec) filesystem and network isolation on macOS. Use the docker backend when full container isolation is required.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewFactoryWithMountSources ¶ added in v0.64.0
func NewFactoryWithMountSources(mountSources map[string]string, cfg Config) sandboxpkg.Factory
NewFactoryWithMountSources binds process-visible policy roots to provider-private physical sources.
Types ¶
type Config ¶ added in v0.33.0
type Config struct {
// StellaHome is the host path to the stella home directory, used for
// building a sandboxed PATH that includes $STELLA_HOME/bin.
StellaHome string
}
Config configures the local sandbox factory.
type Factory ¶
type Factory struct {
// contains filtered or unexported fields
}
Factory creates local sandbox sessions that run directly on the host OS.
func (*Factory) Available ¶
Available always returns true — the local backend has no external dependencies.
func (*Factory) CreateSession ¶
func (f *Factory) CreateSession(_ context.Context, policy sandboxpkg.Policy) (sandboxpkg.Session, error)
CreateSession creates a new localSession. The factory always sets HOME and XDG roots for the local filesystem view; when Config provides StellaHome, it also builds a sandboxed PATH and copies the host-variable allowlist.
Source Files