BubblewrapSandbox

Run commands and agent-written programs inside an operating-system boundary. See the guide.

class zett_agent.sandbox.bubblewrap.BubblewrapSandbox(policy=None, *, bwrap_path=None, memory_strategy=MemoryStrategy.AUTO)

Confine commands with bubblewrap namespaces and read-only mounts (Linux).

The root filesystem is read-only; only the policy's writable paths and a private /tmp accept writes; the unwritable and protected paths are bound read-only again; credential paths are masked; the network namespace is new unless the policy opens the network; and process, IPC and UTS namespaces are private. Everything the process starts is inside the same boundary.

示例

Use it directly on Linux:

sandbox = BubblewrapSandbox(SandboxPolicy.workspace_write("/work/project"))
result = await sandbox.run(["python3", "build.py"], cwd="/work/project")

备注

Bubblewrap needs unprivileged user namespaces. check() runs a probe once and, if it fails, says which of the usual causes to look at.

警告

This backend adds no seccomp filter. With the network open, the process shares the host's network namespace and so can reach local services that listen there, including abstract Unix sockets; closing the network namespace (the default) isolates them. A protected path that does not exist yet cannot be masked, so it is only protected once it exists.

参数:

• policy (SandboxPolicy | None)

• bwrap_path (str | os.PathLike[str] | None)

• memory_strategy (MemoryStrategy | str)

name: ClassVar[str] = 'bubblewrap'

Short stable name of the backend, reported in results.

isolated: ClassVar[bool] = True

Whether this backend enforces a boundary. False only for the backend that runs commands as they are.

check()

Verify that bwrap exists and can create the namespaces this sandbox uses.

返回类型:

None