10 Commits

Include renames

Author	SHA1	Message	Date
mrtoth	29851dc5df	Terminate leftover child processes of the entrypoint after bwrap exits	2026-10-31 14:25:17 +01:00
mrtoth	1c2f51ed3b	Spawn bwrap and mirror its exit status instead of exec'ing into it	2026-10-31 01:55:36 +01:00
mrtoth	c17e8c7c5d	Upgrade dependencies	2026-10-01 20:41:28 +02:00
mrtoth	3fb0da0577	Optionally back /tmp and /var/tmp with stable host directories	2026-05-15 01:36:58 +02:00
mrtoth	28e68b0fff	Disable doc-tests	2026-05-14 19:14:19 +02:00
mrtoth	7f9b21ef4f	Organize test code better	2026-04-25 15:10:42 +02:00
mrtoth	12644ae31e	Apply a seccomp-BPF syscall allowlist by default ... Derived from Podman's default profile, stripped of capability-conditional rules (we never grant capabilities), argument filters, and the explicit EPERM block. Dangerous syscalls (mount, unshare, ptrace, bpf, perf_event_open, io_uring_*, keyctl, kexec_*, ...) fall through to the default ENOSYS action, which also keeps glibc's clone3 -> clone fallback working. x86_64 and aarch64 are supported; other archs error out. Toggle with --seccomp / --no-seccomp or seccomp = <bool> in config.	2026-04-08 08:34:34 +02:00
mrtoth	8ecba5d6dc	Add option to pass through arguments to brwap, use shlex for dry-run	2026-04-04 08:51:08 +02:00
mrtoth	0119834d5a	Implement config file parsing and precedence with CLI	2026-03-31 01:22:08 +02:00
mrtoth	bf53d92d49	Initial commit	2026-03-20 18:40:08 +01:00