coulomb/sand-boxer
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement ext.bwrap: local bubblewrap namespace extension (SAND-WP-0013)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Adds the first local, same-host, kernel-namespace-only sandbox
extension: no SSH hop, no container runtime. Extends IsolationSpec.level
with "process", implements BwrapExtension (provision/wait_ready/
teardown) spawning bwrap with unshared user/mount/pid/ipc/uts/net
namespaces, registers ext.bwrap + profile.bwrap-local, and extends
manager._handle_from_status to carry pid/workspace_dir. Verified with a
live bwrap smoke run in addition to the mocked test suite.

T04 (reachability vs. the SSH-based glas-harness consumer contract)
deliberately left open pending glas-harness's harness contract.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-07-26 12:37:56 +02:00
parent d2186e8ac8
commit 76c38e758c
8 changed files with 484 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

17
workplans/SAND-WP-0013-bwrap-extension.md
View file

@ -2,6 +2,7 @@
id: SAND-WP-0013
title: "Bubblewrap (bwrap) local-exec extension"
status: proposed
state_hub_workstream_id: "29d6bdc4-69a4-4d06-b7c1-eb335aa6ab5e"
---
Add the first local, same-host, kernel-namespace-only sandbox extension.
@ -22,8 +23,9 @@ validation/display logic that switches on it.
```task
id: SAND-WP-0013-T01
status: todo
status: done
priority: high
state_hub_task_id: "b55e6025-2d80-4dc3-aed8-50b15adbdf04"
```
## Task: Implement `BwrapExtension`
@ -41,8 +43,9 @@ initially (`supports_snapshots()` stays `False`).
```task
id: SAND-WP-0013-T02
status: todo
status: done
priority: high
state_hub_task_id: "703d09c6-2f98-44da-9b61-c0d0612b0603"
```
## Task: Register the extension and a profile
@ -54,8 +57,9 @@ default: deny` actually meaningful this time, suitable for CI/local dev.
```task
id: SAND-WP-0013-T03
status: todo
status: done
priority: medium
state_hub_task_id: "fd0ae8c8-c9ae-4cd6-a840-4b5b65574f73"
```
## Task: Resolve local reachability vs. the SSH-based consumer contract
@ -74,6 +78,7 @@ built against the other.
id: SAND-WP-0013-T04
status: todo
priority: high
state_hub_task_id: "1d8b3e18-d067-4364-89e9-5d5bc5923deb"
```
## Task: Extend manager's handle whitelist
@ -85,8 +90,9 @@ teardown/restart survives a `sandboxer` CLI/process restart.
```task
id: SAND-WP-0013-T05
status: todo
status: done
priority: medium
state_hub_task_id: "9a410ce3-9e9c-42d2-abe7-95ad740279a2"
```
## Task: Tests
@ -99,6 +105,7 @@ exercised generically in `test_extension_base.py`).
```task
id: SAND-WP-0013-T06
status: todo
status: done
priority: medium
state_hub_task_id: "d9271eae-9177-4a55-bfb4-082408feb2a1"
```