Host filesystem mounts for sandboxed Python execution.

A mount maps a virtual path inside the sandbox (e.g. /data) to a real host directory (e.g. /var/lib/myapp/data) with a configurable access policy. Path canonicalisation, boundary checks, and symlink-escape detection are enforced by upstream monty regardless of mode.

Mounts are stateful — overlay writes and write_bytes_used accumulate on the mount across runs. Discard accumulated state by constructing a fresh mount.

Modes

• :read_only — reads pass through to the host; writes raise PermissionError.
• :read_write — reads and writes both hit the real disk. Footgun: sandbox code can modify real host files. Use with care.
• :overlay — reads fall through to the host; writes are captured in-memory; the host directory is untouched.

Examples

# Read-only access to a data directory
{:ok, mounts} = ExMonty.Mount.new()
{:ok, mounts} = ExMonty.Mount.add(mounts, "/data", "/var/lib/myapp/data", :read_only)

ExMonty.Sandbox.run(
  """
  from pathlib import Path
  Path("/data/users.csv").read_text()
  """,
  mounts: mounts
)

# Pipe-friendly with `add!/5`
mounts =
  ExMonty.Mount.new!()
  |> ExMonty.Mount.add!("/data",    "/var/lib/myapp/data",    :read_only)
  |> ExMonty.Mount.add!("/scratch", "/tmp/sandbox-scratch",   :overlay)
  |> ExMonty.Mount.add!("/output",  "/var/lib/myapp/output",  :read_write,
       write_bytes_limit: 10_000_000)

Lease lifecycle

Sandbox.run checks out a Lease for the duration of the run and releases it via try/after. Most users never touch checkout/1 / release/1 directly. While a lease is alive against a mount, add/5 and concurrent checkout/1 return {:error, :mount_in_use}. count/1 and list/1 keep working — they read from a side-channel that survives a lease.