create_sandbox

Run commands and agent-written programs inside an operating-system boundary. See the guide.

zett_agent.sandbox.factory.create_sandbox(policy=None, *, backend=SandboxBackend.AUTO, require_isolation=False, memory_strategy=MemoryStrategy.AUTO)

Create the sandbox for this machine, failing loudly rather than weakening it.

A backend that exists but cannot run (bubblewrap missing, namespaces forbidden) raises SandboxUnavailableError: the command is never run unsandboxed because of a problem the caller can fix. The one case that degrades is a platform with no backend at all, where AUTO returns a PassthroughSandbox and emits a SandboxWarning. Pass require_isolation=True to make that case an error too.

参数:

• policy (SandboxPolicy | None) -- The boundary to enforce. Defaults to a read-only policy.

• backend (SandboxBackend | str) -- A backend to force, or AUTO for this platform's own.

• require_isolation (bool) -- Raise instead of returning a sandbox that isolates nothing.

• memory_strategy (MemoryStrategy | str) -- How to enforce memory_bytes; see MemoryStrategy.

抛出:

• SandboxUnavailableError -- If the backend cannot run here, or isolation is required and the platform has none.

• SandboxPolicyError -- If backend is unknown or the policy is invalid.

返回类型:

Sandbox

示例

Take whatever this platform offers:

sandbox = create_sandbox(SandboxPolicy.workspace_write("/work/project"))

Refuse to run anywhere that cannot isolate:

sandbox = create_sandbox(policy, require_isolation=True)