Modules
Isolated execution sandboxes, as a library with no host-application concepts.
What this library needs from its host, and whether it is actually there (012 T013, T022, FR-016).
The conformance suite every mechanism is held to (012 T030–T035, FR-010).
The suite's third outcome (012 T034).
Separates the suite's third outcome from failure in the exit status
(012-FR-016a).
Conformance group: a sandbox's credential reaches its own store and nothing
else (003 T030–T033, FR-018 – FR-021, quickstart Scenario 4).
What a host supplies so the credentials group can attempt real connections.
Conformance group: running a command inside a sandbox (008 T005).
Emits one conformance check as an ExUnit test (012 T034).
The shared vocabulary of the conformance suite (012 T033, T034, T034b).
Conformance group: isolation (012 T031; 003 quickstart Scenario 1).
Conformance group: the sandbox lifecycle (012 T032; 003-FR-010, 003-FR-013).
Conformance group: network confinement (005 T060b, T060d; 003-FR-002,
005-FR-003, 005-FR-011a–FR-011d).
Conformance group: the states a request to a sandbox can land in
(003 T021, FR-022 – FR-024, quickstart Scenario 5).
Conformance group: what a mechanism must provide for reconciliation to be
possible at all (003 T022, FR-015, SC-008, quickstart Scenario 6).
Conformance group: resource limits (012 T034a, T034b; FR-012a, SC-008).
The listener that lives inside one sandbox's network namespace
(005 T060a1/T060a3, contracts/egress.md).
Hands out the /30 a sandbox's netns is built on, and takes it back only
when the sandbox's policy is gone (005 T060a3, contracts/egress.md).
Turns a tenant project's configured destinations into the form
ExSandbox.Egress.Policy enforces (005 T060a2, 013-FR-014b).
Ties one sandbox's resolved allowlist to the /30 its traffic arrives from,
and takes both back together (005 T060a2/T060a6, 005-FR-011a–FR-011e).
The 029-FR-016 instrument: did any bytes cross?
Every address that is this host, as this host currently reports itself
(029 T014's supply half, 029-FR-015, D103).
The ordered steps that put a tenant process inside a policed namespace
(005 T060a3, contracts/egress.md §Lifecycle).
The commands that turn a sandbox's network namespace into its only path out
(005 T060a3, contracts/egress.md).
Recovers the destination a sandbox's connection was originally aimed at,
before the netns redirect sent it to the pool (005 T060a3,
contracts/egress.md).
Finds the process that actually holds a sandbox's network namespace
(005 T060a3, contracts/egress.md).
Which destinations one sandbox may reach, and how that sandbox is identified
(005 T060a1/T060a2, contracts/egress.md, 005-FR-011a–FR-011e).
One acceptor pool for every sandbox, enforcing each one's allowlist
(005 T060a1/T060a3, contracts/egress.md).
Holds each running sandbox's egress policy, keyed by its source /30
(005 T060a1/T060a6, 005-FR-011a–FR-011e).
Forwards a permitted connection to its destination (005 T060a9,
contracts/egress.md).
The platform's DNS service for sandboxes (029 T015, 029-FR-013,
029-FR-012, 029-FR-015).
Answers "may this sandbox reach this destination?" for the per-namespace
acceptors (005 T060a1, contracts/egress.md).
Whether a running sandbox is policed rather than merely isolated
(005 T060a3/T060a5, contracts/egress.md §Capability probing).
The OS-level enforcement seam (012 T021, from 005's contracts/hardening.md).
Confines a control-plane process to one filesystem path (015 T107, from research R16 and R30).
OS-level confinement for the BEAM mechanism on macOS (014 T011 – T015, from
005 R9b and 014's re-measurement at
docs/legacy/specify/014-desktop-deployment/spikes/darwin-hardening/baseline.md).
OS-level confinement for the BEAM mechanism on Linux (005 T004 – T012, contracts/hardening.md, research R2, R3, R9).
An ExUnit formatter that writes a machine-readable per-test report.
The behaviour every isolation mechanism implements (012 T019, T020).
Runs a tenant's Elixir application on its own hardened OS-level BEAM node (005 T027).
Builds the expression that runs one command inside a BEAM sandbox, and decodes what comes back (008 T002, T003).
Starts, probes, and terminates one hardened sandbox node (005 T020-T026).
A sandbox is one container, managed through the docker CLI.
Forwards a request to a running sandbox's address (012 T041, contracts/boundary.md).
The struct every ExSandbox.Mechanism callback receives (012 T012).
Events both libraries emit, carrying the opaque owner_ref (012 T043).