12 Commits

Include renames

Author	SHA1	Message	Date
mrtoth	3fb0da0577	Optionally back /tmp and /var/tmp with stable host directories	2026-05-15 01:36:58 +02:00
mrtoth	c77dbc10c3	Implement profile inheritance	2026-04-26 23:58:21 +02:00
mrtoth	0ea83b2af0	Implement extra-config option	2026-04-24 20:09:27 +02:00
mrtoth	305ac9d927	Accept SRC:DST remap syntax in --ro/--rw	2026-04-22 21:51:00 +02:00
mrtoth	494da52fc6	Replace setenv with env list supporting host passthrough	2026-04-22 20:47:01 +02:00
mrtoth	12644ae31e	Apply a seccomp-BPF syscall allowlist by default ... Derived from Podman's default profile, stripped of capability-conditional rules (we never grant capabilities), argument filters, and the explicit EPERM block. Dangerous syscalls (mount, unshare, ptrace, bpf, perf_event_open, io_uring_*, keyctl, kexec_*, ...) fall through to the default ENOSYS action, which also keeps glibc's clone3 -> clone fallback working. x86_64 and aarch64 are supported; other archs error out. Toggle with --seccomp / --no-seccomp or seccomp = <bool> in config.	2026-04-08 08:34:34 +02:00
mrtoth	cab0eb74d7	Error out if no entrypoint or command is passed (drop claude default)	2026-04-04 10:19:58 +02:00
mrtoth	8ecba5d6dc	Add option to pass through arguments to brwap, use shlex for dry-run	2026-04-04 08:51:08 +02:00
mrtoth	db60fb9ddb	Reject unknown config keys	2026-04-01 23:51:47 +02:00
mrtoth	0119834d5a	Implement config file parsing and precedence with CLI	2026-03-31 01:22:08 +02:00
mrtoth	82f84247f1	Rework handling of /run and ${RUNUSER} in blacklist mode	2026-03-25 22:48:39 +01:00
mrtoth	bf53d92d49	Initial commit	2026-03-20 18:40:08 +01:00