coulomb/sand-boxer
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Verify bwrap execution across owner API requests

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06def-6490-7033-8448-2eab2d12ed44
This commit is contained in:
tegwick 2026-09-04 22:25:05 +02:00
parent d79e3fe358
commit fd9297810c
6 changed files with 125 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/runbooks/profile-bwrap-local.md
View file

@ -76,9 +76,17 @@ sandboxer destroy SANDBOX_ID
```
Destroy kills the namespace process group and removes the copied workspace.
The namespace is not tied to the process that handled `create`, because the
resident API handles create and exec as separate requests. TTL expiry and the
stale-resource reaper provide crash recovery for an owner service that exits
before explicit destroy.
For a non-secret create/execute/source-absence/destroy proof, run:
```bash
make smoke-bwrap-exec
make smoke-bwrap-owner-api
```
The second target exercises the bearer-protected HTTP route with the real bwrap
backend, not a mocked manager.