mrtoth/agent-sandbox
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Expose the bwrap command line at /run/agent-sandbox inside every sandbox

Browse Source
This commit is contained in:
mrtoth
2026-09-02 16:09:46 +02:00
parent 9185d1fb26
commit c8f2d62b64
9 changed files with 193 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+6
View File
@@ -70,6 +70,12 @@ In whitelist mode, the sandbox's `/tmp` and `/var/tmp` are a fresh tmpfs by defa
Stale `/tmp/agent-sandbox-*` directories are not auto-cleaned — remove them by hand when you no longer need them. If `/tmp/agent-sandbox-<key>` already exists owned by a different user, the sandbox refuses to start rather than risk hijacked writes.
## Detecting the sandbox from inside
Every sandbox contains a read-only `/run/agent-sandbox/bwrap-args` holding the exact shell-quoted `bwrap` invocation that spawned it (identical to `--dry-run` output). Agents can test for the directory to learn they are sandboxed and read the file to see which paths are bound, which are masked, and whether the network is shared.
A user `--rw`/`--ro` targeting `/run/agent-sandbox` overrides the directory, like any other built-in path.
## Escape hatches
When the agent needs access to something the sandbox blocks, use `--rw` or `--ro` for paths and `--setenv`/`--unsetenv` for env vars. User overrides always win over the built-in policies.