sandbox

type Env map[string]string

type Filesystem struct {
	FullDiskReadAccess bool `toml:"fullDiskReadAccess"`
	NoCache            bool `toml:"noCache"`

	// Home control access to $HOME dir
	// if set - home available
	Home *Home `toml:"home"`

	ROPaths   []string `toml:"roPaths"`
	RWPaths   []string `toml:"rwPaths"`
	DenyPaths []string `toml:"denyPaths"`
}

type Home struct {
	// AllPaths allows access to any subpath under Home dir
	AllPaths bool `toml:"allPaths"`
	// SkipDefaultDenyList do not use default deny list
	SkipDefaultDenyList bool `toml:"skipDefaultDenyList"`
	// DenyList under home dir where access is forbidden
	DenyList []string `toml:"denyList"`
	// RW makes access to $HOME rw
	RW bool `toml:"rw"`
}

type Network struct {
	Deny bool `toml:"deny"`
}

type Policy struct {
	Env        Env        `toml:"env"`
	Filesystem Filesystem `toml:"fs"`
	Network    Network    `toml:"net"`
}

type Registry struct {
	// contains filtered or unexported fields
}

type Sandbox interface {
	Exec(ctx context.Context, cmd []string, policy Policy, logger *slog.Logger) error
}