coulomb/sand-boxer
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Verify bwrap execution across owner API requests

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06def-6490-7033-8448-2eab2d12ed44
This commit is contained in:
tegwick 2026-09-04 22:25:05 +02:00
parent d79e3fe358
commit fd9297810c
6 changed files with 125 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
workplans/SAND-WP-0014-owner-mediated-execution.md
View file

@ -86,6 +86,11 @@ namespace exposed only `lo` under declared `default: deny`, `egress: []`; no
credential routes or values were present; and teardown reported `destroyed`
with the workspace removed.
The authenticated HTTP smoke subsequently exposed and fixed a lifecycle defect:
`--die-with-parent` tied bwrap to the process handling `create`, so the namespace
could disappear before a later API `exec`. Owner sandboxes now persist across
requests and remain bounded by explicit destroy, TTL expiry, and stale reaping.
## Prove one governed rein and coordinate consumers
```task