coulomb/sand-boxer
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: enforce owner allowlisted bwrap HTTPS egress
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
This commit is contained in:
tegwick 2026-09-05 22:08:18 +02:00
parent d69827aaa2
commit d477c3b5d9
11 changed files with 563 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/test_bwrap_runtime.py
View file

@ -88,7 +88,7 @@ def test_source_and_runtime_overlap_refuses_before_copy(artifact):
def test_unsupported_network_refuses_before_provisioning(tmp_path, network):
profile = Profile(id="profile.test", version="1", extension="ext.bwrap", network=network)
base = tmp_path / "sandboxes"
with pytest.raises(ValueError, match="empty egress"):
with pytest.raises(ValueError, match="default-deny|owner allowlist"):
BwrapExtension({"base_dir": str(base)}).provision(profile, {}, "localhost")
assert not base.exists()