Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DenyInit ¶ added in v0.9.3
func DenyInit(args []string)
DenyInit is called early in main when the binary is re-exec'd as a sandbox wrapper. It runs as root (UID 0) inside the user namespace so it can:
- Mount tmpfs over denied paths to hide their contents
- Apply write isolation: make HOME read-only, then bind writable sub-mounts
- Install seccomp filter to prevent agent from undoing isolation
After setup, it spawns the agent in a nested user namespace (CLONE_NEWUSER for UID drop) + PID namespace (CLONE_NEWPID for PID isolation). The wrapper itself is NOT in a PID namespace — this keeps host /proc valid so Go can write uid_map for the nested CLONE_NEWUSER without remounting /proc.
Args format: --uid UID --gid GID [--log PATH] [--deny PATH...] [--home PATH] [--writable PATH...] -- CMD ARGS...
Types ¶
type Config ¶
type Config struct {
Mounts []Mount
Deny []string // paths to mask (e.g. ~/.ssh) — deny read+write
DenyWrite []string // paths to deny writes only (e.g. ./egg.yaml) — read allowed
NetworkNeed NetworkNeed // granular network access required by the agent
Domains []string // domain allowlist for proxy filtering
ProxyPort int // local domain-filtering proxy port (0 = no proxy)
CPULimit time.Duration // RLIMIT_CPU (0 = backend default)
MemLimit uint64 // RLIMIT_AS in bytes (0 = backend default)
MaxFDs uint32 // RLIMIT_NOFILE (0 = backend default)
}
Config holds sandbox creation parameters.
type DomainProxy ¶ added in v0.20.0
type DomainProxy struct {
// contains filtered or unexported fields
}
DomainProxy is an HTTP CONNECT proxy that only allows connections to whitelisted domains.
func StartProxy ¶ added in v0.20.0
func StartProxy(domains []string) (*DomainProxy, error)
StartProxy starts an HTTP CONNECT proxy on localhost with the given domain allowlist. Supports exact domains ("api.anthropic.com") and wildcards ("*.anthropic.com").
func (*DomainProxy) Port ¶ added in v0.20.0
func (p *DomainProxy) Port() int
Port returns the port the proxy is listening on.
func (*DomainProxy) ServeHTTP ¶ added in v0.20.0
func (p *DomainProxy) ServeHTTP(w http.ResponseWriter, r *http.Request)
ServeHTTP handles HTTP CONNECT requests for the proxy.
type EnforcementError ¶ added in v0.8.4
EnforcementError is returned when the system cannot enforce the requested sandbox config.
func (*EnforcementError) Error ¶ added in v0.8.4
func (e *EnforcementError) Error() string
type Mount ¶
type Mount struct {
Source string
Target string
ReadOnly bool
UseRegex bool // macOS: emit regex rule instead of subpath (covers adjacent files like ~/.claude.json)
}
Mount describes a filesystem mount for the sandbox.
type NetworkNeed ¶ added in v0.9.8
type NetworkNeed int
NetworkNeed describes how much network access an agent requires.
const ( NetworkNone NetworkNeed = iota // fully isolated NetworkLocal // localhost only (e.g. ollama) NetworkHTTPS // outbound 443/80 + DNS 53 NetworkFull // no restrictions )
func NetworkNeedFromDomains ¶ added in v0.20.0
func NetworkNeedFromDomains(domains []string) NetworkNeed
NetworkNeedFromDomains derives NetworkNeed from a domain list.
func (NetworkNeed) String ¶ added in v0.9.8
func (n NetworkNeed) String() string
Source Files