ae4de43ccc
## Summary This PR introduces a gated Bubblewrap (bwrap) Linux sandbox path. The curent Linux sandbox path relies on in-process restrictions (including Landlock). Bubblewrap gives us a more uniform filesystem isolation model, especially explicit writable roots with the option to make some directories read-only and granular network controls. This is behind a feature flag so we can validate behavior safely before making it the default. - Added temporary rollout flag: - `features.use_linux_sandbox_bwrap` - Preserved existing default path when the flag is off. - In Bubblewrap mode: - Added internal retry without /proc when /proc mount is not permitted by the host/container. |
||
|---|---|---|
| .. | ||
| bazel.yml | ||
| cargo-deny.yml | ||
| ci.bazelrc | ||
| ci.yml | ||
| cla.yml | ||
| close-stale-contributor-prs.yml | ||
| codespell.yml | ||
| Dockerfile.bazel | ||
| issue-deduplicator.yml | ||
| issue-labeler.yml | ||
| rust-ci.yml | ||
| rust-release-prepare.yml | ||
| rust-release.yml | ||
| sdk.yml | ||
| shell-tool-mcp-ci.yml | ||
| shell-tool-mcp.yml | ||