Documentation / guides
Enforcement
Understand how a profile becomes native filesystem, network, environment, and process enforcement.
The enforcement subtree explains what happens after a validated profile reaches a host backend. Compilation turns the profile into an effective policy, probes the native capability ladder, and reports the achieved level, guarantees, and per-feature compilation outcomes. The runtime subtree then uses that compiled authority for actual commands and processes.
How it works
The public sandbox.Profile carries requested authority. A backend compiles it into a reusable spawn transform and checks that required guarantees are present. The transform may be a re-exec helper, Seatbelt wrapper, restricted token, or backend-owned launch. The executor still owns the child environment, working directory, output, and lifecycle.
package example
import "github.com/looprig/sandbox"
func enforcementFacts(executor *sandbox.Executor) (uint8, sandbox.Guarantees, sandbox.CompileReport) {
return executor.Level(), executor.Guarantees(), executor.Report()
}Start here
- Platform levels and guarantees explains native capability differences.
- Compilation reports explains
Enforced,narrowed, andunenforcedentries. - Filesystem, HOME, and environment explains root and environment boundaries.
- Network routes and target grants explains routes and proxy authorization.
- Runtime executors shows how compiled enforcement is owned and consumed.