id: profile.bwrap-local
version: "1.0.0"
extension: ext.bwrap
isolation:
  level: process
network:
  default: deny
  egress: []
workspace:
  mode: mirror
  access: rw
scope_default: session
ttl:
  default: 4h
  max: 24h
  idle_reap: null
resources:
  cpu: null
  memory_mb: null
setup:
  instructions: ""
  secret_refs: []
placement:
  prefer: [localhost]
  fallback: []
reachability:
  tunnel: ops-bridge
  identity: ops-warden
metadata:
  cost_class: self-hosted
  latency_class: standard