runner-wrapper

Overview ¶

Command runner-wrapper is a process sandbox pre-exec helper.

It applies rlimits → env whitelist → chdir → seccomp BPF filter, then exec's the target command. All sandbox isolation converges here.

Usage:

runner-wrapper \
  --profile=script-runner \
  --max-memory-mb=100 \
  --max-cpu-sec=3 \
  --max-processes=5 \
  --max-file-size-mb=10 \
  --max-open-files=32 \
  --workdir=/tmp/sandbox-xxx \
  --env=LANG,LC_ALL,PATH \
  -- \
  python3 hello.py

The wrapper is self-contained — parent only needs to spawn it. rlimits + seccomp persist across execve to the target.