SandboxPolicy#

Run commands and agent-written programs inside an operating-system boundary. See the guide.

class zett_agent.sandbox.policy.SandboxPolicy(writable_paths=(), denied_write_paths=(), denied_read_paths=(), network=NetworkMode.NONE, protect_defaults=True, inherit_environment=('PATH', 'HOME', 'USER', 'LOGNAME', 'SHELL', 'LANG', 'LC_ALL', 'LC_CTYPE', 'LC_MESSAGES', 'TERM', 'TZ', 'TMPDIR', 'COLORTERM', 'NO_COLOR', 'SYSTEMROOT', 'SYSTEMDRIVE', 'WINDIR', 'COMSPEC', 'PATHEXT', 'TEMP', 'TMP', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'PROGRAMFILES', 'PROGRAMDATA'), limits=<factory>)[源代码]#

The boundary a sandboxed process runs inside.

The shape follows what the established agent sandboxes converge on. Reads are open by default and a deny list hides credentials; writes are closed by default and only the listed directories open; the network is closed by default; and a few paths stay protected even inside a writable directory. A policy says what to enforce, never how: each backend turns it into its own mechanism, so the same policy works everywhere a backend exists.

Every path must be absolute (~ is expanded), so a policy means the same thing wherever it is built. Writable paths must exist; they are resolved through symbolic links, and a write is judged by where it lands.

参数:

  • writable_paths (tuple[Path, ...]) -- Directories (or files) the process may write. Empty means it can write nowhere but the temporary directory.

  • denied_write_paths (tuple[Path, ...]) -- Paths that stay unwritable even inside a writable path. A denial beats a permission.

  • denied_read_paths (tuple[Path, ...]) -- Paths the process cannot read. Add the secrets that matter to you; protect_defaults already covers common ones.

  • network (NetworkMode) -- Whether the process can reach the network.

  • protect_defaults (bool) -- Keep shell and git configuration, .git/hooks and editor settings unwritable inside writable paths, and hide the usual credential files and container sockets from reads.

  • inherit_environment (tuple[str, ...]) -- Names of host environment variables the process receives. The default is a short, secret-free list; a command that needs more gets it through the env argument of a run.

  • limits (ResourceLimits) -- What the process may use: memory, processor time, processor share, processes, file size and open files. Empty by default, which leaves the machine's own limits in place.

示例

Let a process write one directory and nothing else:

policy = SandboxPolicy.workspace_write("/work/project")

Allow the network as well, still hiding the credential files:

policy = SandboxPolicy.workspace_write("/work/project", network=NetworkMode.FULL)

备注

Temporary files always work: the process gets a private /tmp on Linux, and the user temporary directory and /tmp on macOS.

警告

A policy bounds what a process can do on this machine. It is not a defense against a process that uses the network access you allow, or against a kernel or sandbox vulnerability.

classmethod read_only(*, network=NetworkMode.NONE, limits=None)[源代码]#

Return a policy that can read the machine and write nothing but temporary files.

参数:
返回类型:

SandboxPolicy

classmethod workspace_write(*roots, network=NetworkMode.NONE, protect_defaults=True, limits=None)[源代码]#

Return a policy that can write roots, read the machine, and use the network only if asked.

参数:
返回类型:

SandboxPolicy