Documentation / guides
Runtime
Run commands and prepared processes under compiled sandbox authority with explicit lifecycle and error contracts.
The runtime subtree is where an owned Executor turns compiled policy into work. Synchronous calls collect bounded or unbounded output. Prepared processes reserve authority before spawning and then expose live pipes, signal, wait, and lifetime-containment behavior.
How it works
An ExecutorSet owns the shared lifecycle. For(key) returns a memoized executor with an executor-bound grant key and per-key HOME and TMPDIR. RunArgv and PrepareProcess check command access before the native spawn path. Close cancels outstanding work and releases the set-owned resources.
package example
import (
"context"
"github.com/looprig/sandbox"
)
func run(executor *sandbox.Executor, workspace string) error {
_, _, err := executor.RunArgv(context.Background(), workspace, []string{"true"})
return err
}Start here
- Executors and ExecutorSets explains ownership and memoization.
- RunArgv and confinement explains shell and argv choices.
- Prepared processes and lifetime explains streaming and teardown.
- Typed errors and recovery explains fail-closed handling.
- Harness gates and prepared Tools explains how approved effects reach this runtime.